5 ms·

2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attack

2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attacker will need to take the extra step of breaching/replicating your 2FA setup, and the service provider can note the login attempts and notify you (giving you a chance to change your password, rendering the result of the initial attack unusable). 2FA is not for securing a database -- salted+hashed passwords do that.

perryizgr8 5y ago
> 2FA is more to protect users from phishing attempts Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. So I feel 2FA is worse than useless for preventing phishing attempts.
- ascagnel_ 5y ago
  I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.
  - perryizgr8 5y ago
    > If someone is phishing via a phone call, I'd expect that they already have the password in-hand, That's not how it works most of the times. Click forgot password on Gmail and it will use your second factor as a way to let you change the password. Most websites use the second factor as a backup, including bank websites.
- yjftsjthsd-h 5y ago
  > My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. For a second factor to be useful, they would already have to have her password.
  - im3w1l 5y ago
    In a theorethical world where 2fa means 2fa, but in reality the sms code is often enough by itself.
    - yjftsjthsd-h 5y ago
      Okay, then that's not a problem with 2FA, and certainly doesn't fit in an anti-2FA rant, because it isn't 2FA.
  - perryizgr8 5y ago
    No, you just need to know the account number and you can click something to the tune of "forgot password".
- ajsnigrutin 5y ago
  > Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. But this makes the SMS a single factor of authentication, which is bad. Combined with a password, it's still a good method, a lot better then just a password. If I forget my bank password, I have to go to my bank with my ID and reset the password there. I think they added a videocall + id option because of the plague, but going there in person was the only option back when i signed my contract.
UncleMeat 5y ago
2FA only prevents phishing if you are using something like a yubikey. The phisher can just ask for your SMS code or your TOTP code. You can go buy tools that completely automate this on the black market.

perryizgr8 5y ago

> 2FA is more to protect users from phishing attempts Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. So I feel 2FA is worse than useless for preventing phishing attempts.

ascagnel_ 5y ago
I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.
- perryizgr8 5y ago
  > If someone is phishing via a phone call, I'd expect that they already have the password in-hand, That's not how it works most of the times. Click forgot password on Gmail and it will use your second factor as a way to let you change the password. Most websites use the second factor as a backup, including bank websites.
yjftsjthsd-h 5y ago
> My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. For a second factor to be useful, they would already have to have her password.
- im3w1l 5y ago
  In a theorethical world where 2fa means 2fa, but in reality the sms code is often enough by itself.
  - yjftsjthsd-h 5y ago
    Okay, then that's not a problem with 2FA, and certainly doesn't fit in an anti-2FA rant, because it isn't 2FA.
- perryizgr8 5y ago
  No, you just need to know the account number and you can click something to the tune of "forgot password".
ajsnigrutin 5y ago
> Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. But this makes the SMS a single factor of authentication, which is bad. Combined with a password, it's still a good method, a lot better then just a password. If I forget my bank password, I have to go to my bank with my ID and reset the password there. I think they added a videocall + id option because of the plague, but going there in person was the only option back when i signed my contract.

UncleMeat 5y ago

2FA only prevents phishing if you are using something like a yubikey. The phisher can just ask for your SMS code or your TOTP code. You can go buy tools that completely automate this on the black market.