5 ms·

I feel I'm the only one who absolutely hates the zoo of MFA I'm subjected to as part of the latest and greatest in security for the masses. I hope something com

by aimor 5y ago

I feel I'm the only one who absolutely hates the zoo of MFA I'm subjected to as part of the latest and greatest in security for the masses. I hope something comes along to replace all of it soon.

TeaDude 5y ago
Don't worry. Many companies are already replacing it with a simple webcam image of your mug (Hopefully directly stored on a server somewhere so it can be used for identity theft purposes).
- treesknees 5y ago
  Assuming you mean face and not a coffee mug, can you give an example? Most companies using facial recognition are using 3D maps of facial features using IR or other sensors, not a camera image. Windows Hello and Face ID come to mind, hence why they work in the dark.
  - TeaDude 5y ago
    I am fully aware that these algorithms use reference points on your face. I'm still not pleased with that data getting passed around. As for the part of my comment in parentheses; I'm graciously awaiting the facial equivalent of "passwords in plaintext on the server". It's rather uncommon these days but I can almost guarantee it'll happen at least once.
    - treesknees 5y ago
      My point is that generalizing it as a "webcam image on a server" is not only disingenuous, it's incorrect. It's not from the webcam, it's not an image, and it's not on any server except your own local device. Unless you have an example of a company doing this, which I did ask for. As far as I know companies are not storing that data in the cloud, at least the major ones I'm aware of.
ZetaZero 5y ago
Sure, but doesn't that lead to XKCD Standards? https://xkcd.com/927/ https://xkcd.com/927/
- mid-kid 5y ago
  Literally everything you can make to solve a problem leads to XKCD standards. If we go by XKCD logic we wouldn't have Netflix because it would just be another "standard" alongside all of the other film distribution methods.
dbbk 5y ago
Apple is working on this using WebAuthn, they call it Passkeys: https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the-first-steps-to-a-password-less-future/ https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the...
- cromwellian 5y ago
  This seems pretty worrisome if you have ANY non-Apple device. So if I create an account using PassKeys, but at some later date, I need to log in using a browser on a Windows or Linux box, what do I do? I don't have a password, since one was never created. And all my credentials are in iCloud.
  - username190 5y ago
    This is already an issue Apple has with their own Apple ID 2-factor authentication; in order to authenticate, you must either accept the prompt and receive the code on a current Apple device, or (secondarily) recieve a code via SMS. Frustratingly, there is no option to add a TOTP code (like most other services, including Google, offer) or to disable SMS 2FA as a backup (despite its known security issues). I say this mostly because I assume Apple would use your Apple ID credentials as a way to log in to these services on a Windows or Linux machine, as they do currently with the "Sign in with Apple" flow.
  - dbbk 5y ago
    Currently yes, they're obviously working on a solution to that (it's the only non-green part of the chart)
TheJoeMan 5y ago
Would you be interested in an emulated Android phone hosted somewhere that just auto-clicks "approve" on 2FA, maybe as a low-fee subscription service? Could even set up rules for like "only during business hours in my country"
- loxias 5y ago
  Hah! I actually did exactly that! (ran Android in a VM just for 2FA) until I realized I could do it from the command line easily with `oathtool`.
mywittyname 5y ago
Yes. I feel like my PC is should be the source of truth for my identity, not my phone. Phones get lost, stolen, and destroyed at times and there's no guarantee that I'll have access to my phone number for the rest of my life. I'm already completely screwed if my phone number changes, because not every service offers one-time-use codes to bypass 2FA. It is absolutely baffling that there's no desktop 2FA program that's widely used. I guess tech savvy people are using android emulators on their PC to run google authenticator, but that's such a pain. Has anyone had luck with yubikeys for personal accounts?
- patrakov 5y ago
  You can use https://authenticator.cc/ https://authenticator.cc/ with Chrome or Firefox. There are many other TOTP generators for desktop. No need for Google Authenticator.
- pepoluan 5y ago
  > I guess tech savvy people are using android emulators on their PC to run google authenticator I simply use Authy instead of Google Authenticator. It has a desktop app that syncs to the Authy app on my phone. With Windows 11, you'll soon be able to run Android apps without needing to install an Android emulator, but that's not here and now, though...
- SAI_Peregrinus 5y ago
  I use Yubikeys for everything that allows them. Haven't had any problems.

by aimor 5y ago

I feel I'm the only one who absolutely hates the zoo of MFA I'm subjected to as part of the latest and greatest in security for the masses. I hope something comes along to replace all of it soon.

TeaDude 5y ago

Don't worry. Many companies are already replacing it with a simple webcam image of your mug (Hopefully directly stored on a server somewhere so it can be used for identity theft purposes).

treesknees 5y ago
Assuming you mean face and not a coffee mug, can you give an example? Most companies using facial recognition are using 3D maps of facial features using IR or other sensors, not a camera image. Windows Hello and Face ID come to mind, hence why they work in the dark.
- TeaDude 5y ago
  I am fully aware that these algorithms use reference points on your face. I'm still not pleased with that data getting passed around. As for the part of my comment in parentheses; I'm graciously awaiting the facial equivalent of "passwords in plaintext on the server". It's rather uncommon these days but I can almost guarantee it'll happen at least once.
  - treesknees 5y ago
    My point is that generalizing it as a "webcam image on a server" is not only disingenuous, it's incorrect. It's not from the webcam, it's not an image, and it's not on any server except your own local device. Unless you have an example of a company doing this, which I did ask for. As far as I know companies are not storing that data in the cloud, at least the major ones I'm aware of.

ZetaZero 5y ago

Sure, but doesn't that lead to XKCD Standards? https://xkcd.com/927/ https://xkcd.com/927/

mid-kid 5y ago
Literally everything you can make to solve a problem leads to XKCD standards. If we go by XKCD logic we wouldn't have Netflix because it would just be another "standard" alongside all of the other film distribution methods.

dbbk 5y ago

Apple is working on this using WebAuthn, they call it Passkeys: https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the-first-steps-to-a-password-less-future/ https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the...

cromwellian 5y ago
This seems pretty worrisome if you have ANY non-Apple device. So if I create an account using PassKeys, but at some later date, I need to log in using a browser on a Windows or Linux box, what do I do? I don't have a password, since one was never created. And all my credentials are in iCloud.
- username190 5y ago
  This is already an issue Apple has with their own Apple ID 2-factor authentication; in order to authenticate, you must either accept the prompt and receive the code on a current Apple device, or (secondarily) recieve a code via SMS. Frustratingly, there is no option to add a TOTP code (like most other services, including Google, offer) or to disable SMS 2FA as a backup (despite its known security issues). I say this mostly because I assume Apple would use your Apple ID credentials as a way to log in to these services on a Windows or Linux machine, as they do currently with the "Sign in with Apple" flow.
- dbbk 5y ago
  Currently yes, they're obviously working on a solution to that (it's the only non-green part of the chart)

TheJoeMan 5y ago

Would you be interested in an emulated Android phone hosted somewhere that just auto-clicks "approve" on 2FA, maybe as a low-fee subscription service? Could even set up rules for like "only during business hours in my country"

loxias 5y ago
Hah! I actually did exactly that! (ran Android in a VM just for 2FA) until I realized I could do it from the command line easily with `oathtool`.

mywittyname 5y ago

Yes. I feel like my PC is should be the source of truth for my identity, not my phone. Phones get lost, stolen, and destroyed at times and there's no guarantee that I'll have access to my phone number for the rest of my life. I'm already completely screwed if my phone number changes, because not every service offers one-time-use codes to bypass 2FA. It is absolutely baffling that there's no desktop 2FA program that's widely used. I guess tech savvy people are using android emulators on their PC to run google authenticator, but that's such a pain. Has anyone had luck with yubikeys for personal accounts?

patrakov 5y ago
You can use https://authenticator.cc/ https://authenticator.cc/ with Chrome or Firefox. There are many other TOTP generators for desktop. No need for Google Authenticator.
pepoluan 5y ago
> I guess tech savvy people are using android emulators on their PC to run google authenticator I simply use Authy instead of Google Authenticator. It has a desktop app that syncs to the Authy app on my phone. With Windows 11, you'll soon be able to run Android apps without needing to install an Android emulator, but that's not here and now, though...
SAI_Peregrinus 5y ago
I use Yubikeys for everything that allows them. Haven't had any problems.