4 ms·

Bypassing 2FA – Secret double octopus [2019]

21 points by rolph 5y ago

skykooler 5y ago
Not sure what's up with the cookie banner on this site: "This website uses cookies to improve your experience. We’ll assume you’re ok with this, but you can opt-out if you wish." There are two buttons, "Accept" an "Read more". "Read more" is just a link to google.com (not even a search string) which feels really condescending.
- authed 5y ago
  I love it... but I didn't see it until I unblocked JavaScript... they are probably just laughing at the current mess.
1cvmask 5y ago
Saas Pass has had a passwordless authentication solution available on the market for almost a decade. The future has arrived. It is just not evenly distributed yet. - Disclaimer: Worked on UI and UX stuff
- antisthenes 5y ago
  How does it work?
  - 1cvmask 5y ago
    You can scan an ecrypted barcode or through push login or other methods. There is more at the developer site.
    - TheMatten 5y ago
      Is this basically what Discord does with it's web/desktop client?
    - tialaramex 5y ago
      Note that push login is vulnerable to one of the phishing attacks described. User goes to fakebank.example, attacker goes to realbank.example, user types in their username, it is pasted by attacker, the user gets a push login request, "Hey are you trying to log into Real Bank?". Yes, says the user, of course I am, and they let the attacker into their account. WebAuthn fixes this, by having the web browser take responsibility for the thing humans are bad at. Is this, in fact, realbank.example? No, it's fakebank.example. Attack failed.
armchairhacker 5y ago
There should be a better solution for 2FA now especially with cryptocurrency all the rage now. Like a small waterproof chip that can be attached to your skin (maybe upper elbow) with an RFID. Why hasn't such a product been invented yet? Currently there is the YubiKey, Ledger, Trezor, which all cost $25-70. Just for a USB that can generate a OTP (I'm oversimplifying but does what they do really cost $50?). Then there is Duo mobile for phones, which may be slightly less secure but is probably better for most cases. But both suffer from the situation where you can lose your key.
- encryptluks2 5y ago
  2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive with tamper-resistant chips. Prob could achieve near the same thing with some hot glue. I'm on the same page though, the issue with hardware tokens is that they can easily be lost thus causing you potentially to lose access to accounts or make replacing the token on your account way more difficult.
  - vorpalhex 5y ago
    You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.
    - tialaramex 5y ago
      I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.
      - nucleardog 5y ago
        I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.
kevwil 5y ago
Beware of paid, proprietary solutions to security problems claiming to be "the only passwordless solution offering seamless, mathematically unbreakable authentication that doesn’t require humans to come-up with, manage, memorize or input passwords". Free tools like SQRL exist, which uses elliptic curve public key crypto instead of passwords, and no doubt other solutions also exist.
castillar76 5y ago
They do get credit for having a really cool company name. However—and I know this is picky—if I see the word “authentification” multiple times on the site map it does not fill me with confidence.

21 points by rolph 5y ago

Not sure what's up with the cookie banner on this site: "This website uses cookies to improve your experience. We’ll assume you’re ok with this, but you can opt-out if you wish." There are two buttons, "Accept" an "Read more". "Read more" is just a link to google.com (not even a search string) which feels really condescending.

authed 5y ago
I love it... but I didn't see it until I unblocked JavaScript... they are probably just laughing at the current mess.

1cvmask 5y ago

Saas Pass has had a passwordless authentication solution available on the market for almost a decade. The future has arrived. It is just not evenly distributed yet. - Disclaimer: Worked on UI and UX stuff

antisthenes 5y ago
How does it work?
- 1cvmask 5y ago
  You can scan an ecrypted barcode or through push login or other methods. There is more at the developer site.
  - TheMatten 5y ago
    Is this basically what Discord does with it's web/desktop client?
  - tialaramex 5y ago
    Note that push login is vulnerable to one of the phishing attacks described. User goes to fakebank.example, attacker goes to realbank.example, user types in their username, it is pasted by attacker, the user gets a push login request, "Hey are you trying to log into Real Bank?". Yes, says the user, of course I am, and they let the attacker into their account. WebAuthn fixes this, by having the web browser take responsibility for the thing humans are bad at. Is this, in fact, realbank.example? No, it's fakebank.example. Attack failed.

armchairhacker 5y ago

There should be a better solution for 2FA now especially with cryptocurrency all the rage now. Like a small waterproof chip that can be attached to your skin (maybe upper elbow) with an RFID. Why hasn't such a product been invented yet? Currently there is the YubiKey, Ledger, Trezor, which all cost $25-70. Just for a USB that can generate a OTP (I'm oversimplifying but does what they do really cost $50?). Then there is Duo mobile for phones, which may be slightly less secure but is probably better for most cases. But both suffer from the situation where you can lose your key.

encryptluks2 5y ago
2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive with tamper-resistant chips. Prob could achieve near the same thing with some hot glue. I'm on the same page though, the issue with hardware tokens is that they can easily be lost thus causing you potentially to lose access to accounts or make replacing the token on your account way more difficult.
- vorpalhex 5y ago
  You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.
  - tialaramex 5y ago
    I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.
    - nucleardog 5y ago
      I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this. How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it. So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere. I register a new account. What's the process? Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ? Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token? What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone? This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.

kevwil 5y ago

Beware of paid, proprietary solutions to security problems claiming to be "the only passwordless solution offering seamless, mathematically unbreakable authentication that doesn’t require humans to come-up with, manage, memorize or input passwords". Free tools like SQRL exist, which uses elliptic curve public key crypto instead of passwords, and no doubt other solutions also exist.

castillar76 5y ago

They do get credit for having a really cool company name. However—and I know this is picky—if I see the word “authentification” multiple times on the site map it does not fill me with confidence.