4 ms·

Microsoft’s 2FA implementation does not help because it allows attackers to guess the password first and the second factor next. They just don’t get it.

tialaramex 5y ago
Sure. So, let's say you guess my password. Now you get prompted for the second factor, which you don't have. In fact I have Security Keys, so, now you're trying to break AES, which you can't do. But let's suppose you're attacking the average person whose second factor is a TOTP authenticator. Unsurprisingly Microsoft only give you a finite rate of tries at TOTP codes. And of course the correct code keeps changing meanwhile, so you can guess forever and never have better than about 1 in a 100 000 chance to guess a valid code each time. How many guesses do you think you get before your client is considered vexatious and can't try any more?
- tinus_hn 5y ago
  If the second factor were enough security why even have the password? And how do you know the attacker is one client? He can just be 1000000 clients each only trying once. And if you block them you also block the user.
  - londons_explore 5y ago
    Agreed. Second factor where you tell the attacker they got the password right before asking for the next factor isn't really 2 factor. Either that, or you force the user to do a password reset if ever they provide the password but cannot provide the 2nd factor in the same login attempt. I think that would upset a lot of users though.
  - tialaramex 5y ago
    > If the second factor were enough security why even have the password? Having two factors is better. But obviously neither of them should be a conventional password because passwords are crap. You can have WebAuthn set to do usernameless authentication, with the two factors both being local. So when you visit a site with this behaviour and it wants authentication, you maybe touch your fingerprint sensor on your phone, that's one factor, having the phone is the other factor, that's two factors, the phone hands over credentials including a large identifier that's equivalent to a user ID for the site, plus its assurance that you are present (based on the fingerprint) and a signature proving it is still the same phone used to sign up for this method. No typing your email address, no passwords, much better security. > He can just be 1000000 clients each only trying once. And if you block them you also block the user. Yes, if you rate limit attackers you also rate limit the real user. But as an attacker, what value am I getting from that? Maybe it's a chargeable service I can sell? It certainly doesn't help me steal gift cards. $1000 per hour to annoy a friend by preventing them from logging into their email? Not many buyers at that price. $100 per hour? $10 per hour? $1 per hour? Remember that to fuel this you are throwing away a botnet so that you can hammer on the login until you get blocked, and botnets aren't that cheap to buy.
    - tinus_hn 5y ago
      > You can have Yes you can have proper security. But this is about the Microsoft solution where you don’t, where you can first guess the password and then guess the 2fa code. Which is not very smart, considering it’s not that much harder to check both at the same time and fail when either is wrong.
      - tialaramex 5y ago
        > it’s not that much harder to check both at the same time and fail when either is wrong. You can't do that. Try to imagine what this looks like: You're at the Microsoft login screen. Microsoft needs you to present both a password and... * WebAuthn sign-in credentials, for which it must send data to your client * a TOTP code, from the authenticator you may or may not have * the SMS code, which you er... wait, what SMS code, how can Microsoft send it to you if you didn't say who you are? * the email code, which again er... Microsoft can't send this until it knows who you are OR * any other technology Microsoft adds later which may require any of the above or something else.
        tinus_hn 5y ago
        They can switch to display the right one when you enter your email address, they already do this. And of course indeed it doesn’t work with methods like sms and emailing codes, both of which are not secure anyway.
        tialaramex 5y ago
        > They can switch to display the right one when you enter your email address, they already do this So the effect here is this gives bad guys a free targeting feature. Just type in any email addresses and Microsoft will tell you which 2FA is enabled if any. > And of course indeed it doesn’t work with methods like sms and emailing codes So, it doesn't help at all for the good case, and it breaks the bad case worse, what was the goal again?
        5y ago
SilverRed 5y ago
You can't guess the 2FA code. It changes faster than you could ever attempt to test all combinations.
- KingMachiavelli 5y ago
  But you could try ~100 password variations and then attack the 2FA. Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number. If you can filter 10,000 accounts down to 100 with known passwords, now you just have to bypass 2FA on 100 accounts.
  - alienalp 5y ago
    How can you register a number if its already registered?
    - patmcc 5y ago
      A common service offered (I think required to be offered, actually) by telephone service providers is "number porting" - where you switch providers but keep the same number, because people don't like changing phone numbers more than they have to. It used to be this didn't have any real backend checks, so you could effectively steal someone's number, at least temporarily.
  - stef25 5y ago
    > Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number. Surely not?
    - KingMachiavelli 5y ago
      > "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," Lucky225 added, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. From 2021: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... EDIT: yea it's not 'registering' the number but rather rerouting a copy of all messages to another number.
Cthulhu_ 5y ago
Shouldn't repeated failed 2FA login attempts trigger a notification to the user? Or password OK, 2FA failed login attempts at a different location that the user normally is at? I mean if there's repeated login attempts where the password is correct but the 2FA is not that's a pretty good indication that the password may be compromised. I'd like to be notified of that.

tialaramex 5y ago

Sure. So, let's say you guess my password. Now you get prompted for the second factor, which you don't have. In fact I have Security Keys, so, now you're trying to break AES, which you can't do. But let's suppose you're attacking the average person whose second factor is a TOTP authenticator. Unsurprisingly Microsoft only give you a finite rate of tries at TOTP codes. And of course the correct code keeps changing meanwhile, so you can guess forever and never have better than about 1 in a 100 000 chance to guess a valid code each time. How many guesses do you think you get before your client is considered vexatious and can't try any more?

tinus_hn 5y ago
If the second factor were enough security why even have the password? And how do you know the attacker is one client? He can just be 1000000 clients each only trying once. And if you block them you also block the user.
- londons_explore 5y ago
  Agreed. Second factor where you tell the attacker they got the password right before asking for the next factor isn't really 2 factor. Either that, or you force the user to do a password reset if ever they provide the password but cannot provide the 2nd factor in the same login attempt. I think that would upset a lot of users though.
- tialaramex 5y ago
  > If the second factor were enough security why even have the password? Having two factors is better. But obviously neither of them should be a conventional password because passwords are crap. You can have WebAuthn set to do usernameless authentication, with the two factors both being local. So when you visit a site with this behaviour and it wants authentication, you maybe touch your fingerprint sensor on your phone, that's one factor, having the phone is the other factor, that's two factors, the phone hands over credentials including a large identifier that's equivalent to a user ID for the site, plus its assurance that you are present (based on the fingerprint) and a signature proving it is still the same phone used to sign up for this method. No typing your email address, no passwords, much better security. > He can just be 1000000 clients each only trying once. And if you block them you also block the user. Yes, if you rate limit attackers you also rate limit the real user. But as an attacker, what value am I getting from that? Maybe it's a chargeable service I can sell? It certainly doesn't help me steal gift cards. $1000 per hour to annoy a friend by preventing them from logging into their email? Not many buyers at that price. $100 per hour? $10 per hour? $1 per hour? Remember that to fuel this you are throwing away a botnet so that you can hammer on the login until you get blocked, and botnets aren't that cheap to buy.
  - tinus_hn 5y ago
    > You can have Yes you can have proper security. But this is about the Microsoft solution where you don’t, where you can first guess the password and then guess the 2fa code. Which is not very smart, considering it’s not that much harder to check both at the same time and fail when either is wrong.
    - tialaramex 5y ago
      > it’s not that much harder to check both at the same time and fail when either is wrong. You can't do that. Try to imagine what this looks like: You're at the Microsoft login screen. Microsoft needs you to present both a password and... * WebAuthn sign-in credentials, for which it must send data to your client * a TOTP code, from the authenticator you may or may not have * the SMS code, which you er... wait, what SMS code, how can Microsoft send it to you if you didn't say who you are? * the email code, which again er... Microsoft can't send this until it knows who you are OR * any other technology Microsoft adds later which may require any of the above or something else.
      - tinus_hn 5y ago
        They can switch to display the right one when you enter your email address, they already do this. And of course indeed it doesn’t work with methods like sms and emailing codes, both of which are not secure anyway.
        tialaramex 5y ago
        > They can switch to display the right one when you enter your email address, they already do this So the effect here is this gives bad guys a free targeting feature. Just type in any email addresses and Microsoft will tell you which 2FA is enabled if any. > And of course indeed it doesn’t work with methods like sms and emailing codes So, it doesn't help at all for the good case, and it breaks the bad case worse, what was the goal again?
        5y ago

SilverRed 5y ago

You can't guess the 2FA code. It changes faster than you could ever attempt to test all combinations.

KingMachiavelli 5y ago
But you could try ~100 password variations and then attack the 2FA. Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number. If you can filter 10,000 accounts down to 100 with known passwords, now you just have to bypass 2FA on 100 accounts.
- alienalp 5y ago
  How can you register a number if its already registered?
  - patmcc 5y ago
    A common service offered (I think required to be offered, actually) by telephone service providers is "number porting" - where you switch providers but keep the same number, because people don't like changing phone numbers more than they have to. It used to be this didn't have any real backend checks, so you could effectively steal someone's number, at least temporarily.
- stef25 5y ago
  > Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number. Surely not?
  - KingMachiavelli 5y ago
    > "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," Lucky225 added, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. From 2021: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... EDIT: yea it's not 'registering' the number but rather rerouting a copy of all messages to another number.

Cthulhu_ 5y ago

Shouldn't repeated failed 2FA login attempts trigger a notification to the user? Or password OK, 2FA failed login attempts at a different location that the user normally is at? I mean if there's repeated login attempts where the password is correct but the 2FA is not that's a pretty good indication that the password may be compromised. I'd like to be notified of that.