30 ms·

Push notifications to a smartphone app for login approvals is by far the most convenient 2FA method and also more secure than TOTP or SMS. I use it wherever I c

Push notifications to a smartphone app for login approvals is by far the most convenient 2FA method and also more secure than TOTP or SMS. I use it wherever I can.

tialaramex 5y ago
Push notifications mean that if you believe you're logging in, and the crook is actually logging in, (not a coincidence, they understand how this works) you get a push notify, which you accept because you think you're logging in, and you thereby let the crook in. Brilliant. Prefer WebAuthn.
- jaywalk 5y ago
  With Okta, it tells you the approximate location of where the login request is coming from. So unless the crook happens to be in the same city as me, I'm going to immediately see that something is wrong and decline the request. Not perfect, sure. Webauthn is definitely more secure, but far less convenient.
  - iudqnolq 5y ago
    Look up city on social media, buy a VPN. If you're on a mobile network the location is often off by a city or so anyway.
    - eikenberry 5y ago
      It's about raising the bar, not making it impossible.
      - tialaramex 5y ago
        Why isn't it about making it functionally impossible? You can break WebAuthn if you can guess a 128-bit AES key. You won't, but it's not impossible it's just astronomically unlikely if everybody spends their lifetime trying. That's why Google gave all its employees Security Keys. Instead of "Well, we spend a little bit of money on some half-solution but we just raised the bar and so we'll have to spend more forever and always risk phishing attacks" they just solved the problem. This saves you extra money because your adversaries stop trying. Not only are remaining attacks unsuccessful, they become much rarer and the associated clean-up (even if it's just helpdesk reassuring employees that although they fell for that scam email claiming to be from HR their credentials are fine) cost is reduced. Think about SSH. People scan and attack every SSH server on the public IPv4 Internet. But not on IPv6. Why not? Because it's statistically useless to attempt with 128-bit addresses. You're just wasting your time and money.
        eikenberry 5y ago
        Remote attacks are not the only attacks and nothing can make it impossible as long as people are involved. Security keys are easy to steal and people are easy to trick or coerce.
- qqii 5y ago
  Doesn't webauthn have the same issue? If you think your logging in, but you're actually on a phishing site you'll have given the attacker a response they can forward onto the real webserver?
  - tialaramex 5y ago
    No. In WebAuthn site A can only request credentials for site A there is no way to say "Oh, er, I'm totally site B, give me the site B credentials". Everything is cryptographically tied to the exact DNS name of the site. So the attacker at best gets valid credentials for their phishing site, which in WebAuthn are deliberately uncorrelated to other credentials, the attacker can't do anything useful with that information. In practice, of course you don't have or want credentials for their phishing site so they just get a Javascript error and give up.

Push notifications to a smartphone app for login approvals is by far the most convenient 2FA method and also more secure than TOTP or SMS. I use it wherever I can.

tialaramex 5y ago

Push notifications mean that if you believe you're logging in, and the crook is actually logging in, (not a coincidence, they understand how this works) you get a push notify, which you accept because you think you're logging in, and you thereby let the crook in. Brilliant. Prefer WebAuthn.

jaywalk 5y ago
With Okta, it tells you the approximate location of where the login request is coming from. So unless the crook happens to be in the same city as me, I'm going to immediately see that something is wrong and decline the request. Not perfect, sure. Webauthn is definitely more secure, but far less convenient.
- iudqnolq 5y ago
  Look up city on social media, buy a VPN. If you're on a mobile network the location is often off by a city or so anyway.
  - eikenberry 5y ago
    It's about raising the bar, not making it impossible.
    - tialaramex 5y ago
      Why isn't it about making it functionally impossible? You can break WebAuthn if you can guess a 128-bit AES key. You won't, but it's not impossible it's just astronomically unlikely if everybody spends their lifetime trying. That's why Google gave all its employees Security Keys. Instead of "Well, we spend a little bit of money on some half-solution but we just raised the bar and so we'll have to spend more forever and always risk phishing attacks" they just solved the problem. This saves you extra money because your adversaries stop trying. Not only are remaining attacks unsuccessful, they become much rarer and the associated clean-up (even if it's just helpdesk reassuring employees that although they fell for that scam email claiming to be from HR their credentials are fine) cost is reduced. Think about SSH. People scan and attack every SSH server on the public IPv4 Internet. But not on IPv6. Why not? Because it's statistically useless to attempt with 128-bit addresses. You're just wasting your time and money.
      - eikenberry 5y ago
        Remote attacks are not the only attacks and nothing can make it impossible as long as people are involved. Security keys are easy to steal and people are easy to trick or coerce.
qqii 5y ago
Doesn't webauthn have the same issue? If you think your logging in, but you're actually on a phishing site you'll have given the attacker a response they can forward onto the real webserver?
- tialaramex 5y ago
  No. In WebAuthn site A can only request credentials for site A there is no way to say "Oh, er, I'm totally site B, give me the site B credentials". Everything is cryptographically tied to the exact DNS name of the site. So the attacker at best gets valid credentials for their phishing site, which in WebAuthn are deliberately uncorrelated to other credentials, the attacker can't do anything useful with that information. In practice, of course you don't have or want credentials for their phishing site so they just get a Javascript error and give up.