4 ms·

The new version of the Danish national authentication system had to disable push notification for the same reason. Attackers would just hammer a person with pus

The new version of the Danish national authentication system had to disable push notification for the same reason. Attackers would just hammer a person with push notification until the user accidentally authorized a login. I gave up on the Microsoft authenticator and just switched to manually enter tokens from an TOTP app. The push/popup thingy was a nice idea, but it’s annoying to use day to day.

Spooky23 5y ago
The old solutions are best IMO. Challenge/response where there’s a knowledge element. TOTP is too easy to share or steal, especially for targeted or familiar person attacks. I’ve encountered fraud scenarios where soon to be ex-spouses accessed an account via a iPad with authy to get at someone. Fundamentally, it’s too easy to think you have MFA, but you’re actually secured with a shared, no-factor-auth iPad. (People share work credentials in 1Password for convenience) Mitigation of password spray is cool, but not secure.
- Ansil849 5y ago
  > TOTP is too easy to share or steal, especially for targeted or familiar person attacks. I’ve encountered fraud scenarios where soon to be ex-spouses accessed an account via a iPad with authy to get at someone. If your threat model is 'person in proximity of other person being able to access the second factor' then no method of 2FA is safe. Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain, in fact even easier than they could get their OTP codes.
  - tialaramex 5y ago
    > Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain Stealing the physical object is quite a step up from merely using something you have access to that was never de-authorised. And if you steal say, my Security Key 2 from Yubico, it still needs its PIN. Worse the phone I use to authenticate on mobile sites requires my fingerprint, which while far from impossible to fake is definitely another step beyond "I just assumed I was allowed" and now you've also stolen my phone, how long do you think you have before I notice?
    - Ansil849 5y ago
      I'm not sure what contrived scenarios you're envisioning, but if the threat model is, once again, 'person in proximity', they don't have to "steal" anything, they can simply use it, e.g. authenticate with the key while you're in the shower. And if in your model they presumably already know your password, it stands to reason they also know your PIN.
      - Spooky23 5y ago
        Proximity of what? With a hardware token, it’s very clear that the token is in the physical possession of the user or not. It can only be in one place at a time. With a challenge/response or PIN, you mitigate the risk of the user losing possession. With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation, he has also provided the kid or other household member/visitor with access to the token. The token is wherever Authy is. The point is TOTP shares all of the risks associated with things like SSH private keys. It has value, but is inferior to many other types of token.
        Ansil849 5y ago
        > With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has. I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
        Spooky23 5y ago
        I guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.
joenathanone 5y ago
Or they change just gate the notifications/MFA requests server side, limit the number of request and set an increasing delay between request.
- dane-pgp 5y ago
  So if an attacker had access to 2 million IP addresses[0] and they were attacking a country where maybe less than 5 million people[1] have an account on the national authentication system, how easy would it be for them to DDoS the system for a week? Presumably the attackers would choose the week when people were supposed to fill in their tax forms, or (if the country was foolish enough to allow online voting) the week of an election. [0] https://www.bbc.co.uk/news/technology-11531657 https://www.bbc.co.uk/news/technology-11531657 [1] https://www.worldometers.info/world-population/denmark-population/ https://www.worldometers.info/world-population/denmark-popul...
  - joenathanone 5y ago
    An attack of that size would of course be automated which should make it easy to fingerprint, then just block the matching fingerprint, or add a captcha. Could also add a "I didn't request this MFA" link that would flag the requester.
autoexec 5y ago
> I gave up on the Microsoft authenticator and just switched to manually enter tokens from an TOTP app. My office considered Microsoft authenticator, but there was push back after looking at their privacy policy and how much access the app wanted on people's personal devices (location, storage, contacts, etc). The nice thing about a little TOTP hardware token is that you avoid the push notification problem and it doesn't collect massive amounts of your data to use against you or sell to 3rd parties.
- judge2020 5y ago
  Which one in particular? These are quite bog-standard Android permissions. https://i.judge.sh/QjsR4/m_GdOf1iig.png https://i.judge.sh/QjsR4/m_GdOf1iig.png
  - autoexec 5y ago
    Even that wants your GPS location (why?), camera (and therefore microphone) access, and storage access. Those kinds of permissions have been 'normalized' sure, but they're also 100% unnecessary considering the job is done just as well (or better as it's without security issues like the one in the article) with a tiny hardware token that requires literally none of those things and couldn't do them if it wanted to. If you aren't currently handing your location data over to Microsoft 24/7 right now, why should you start?
    - slaymaker1907 5y ago
      It wants your GPS location for the same reason banks look at your location. Even if they still let an auth request go through, they can alert you through email if a request is approved from an unexpected location. Camera permission is necessary for QR codes so you can setup the authenticator. No idea what the mic permission is about though.
      - autoexec 5y ago
        Your IP should provide them (and your bank) enough location info to alert you if your account is accessed from another state/country. QR codes weren't needed to set up the hardware token, so that feels like a feature created to justify the increased access (also phones come with their own camera apps capable of reading a QR code or at the very least photographing one). The mic access is a side effect of android's leaky permission system which hands out the ability to record audio to any app that wants access to your camera.

Spooky23 5y ago

The old solutions are best IMO. Challenge/response where there’s a knowledge element. TOTP is too easy to share or steal, especially for targeted or familiar person attacks. I’ve encountered fraud scenarios where soon to be ex-spouses accessed an account via a iPad with authy to get at someone. Fundamentally, it’s too easy to think you have MFA, but you’re actually secured with a shared, no-factor-auth iPad. (People share work credentials in 1Password for convenience) Mitigation of password spray is cool, but not secure.

Ansil849 5y ago
> TOTP is too easy to share or steal, especially for targeted or familiar person attacks. I’ve encountered fraud scenarios where soon to be ex-spouses accessed an account via a iPad with authy to get at someone. If your threat model is 'person in proximity of other person being able to access the second factor' then no method of 2FA is safe. Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain, in fact even easier than they could get their OTP codes.
- tialaramex 5y ago
  > Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain Stealing the physical object is quite a step up from merely using something you have access to that was never de-authorised. And if you steal say, my Security Key 2 from Yubico, it still needs its PIN. Worse the phone I use to authenticate on mobile sites requires my fingerprint, which while far from impossible to fake is definitely another step beyond "I just assumed I was allowed" and now you've also stolen my phone, how long do you think you have before I notice?
  - Ansil849 5y ago
    I'm not sure what contrived scenarios you're envisioning, but if the threat model is, once again, 'person in proximity', they don't have to "steal" anything, they can simply use it, e.g. authenticate with the key while you're in the shower. And if in your model they presumably already know your password, it stands to reason they also know your PIN.
    - Spooky23 5y ago
      Proximity of what? With a hardware token, it’s very clear that the token is in the physical possession of the user or not. It can only be in one place at a time. With a challenge/response or PIN, you mitigate the risk of the user losing possession. With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation, he has also provided the kid or other household member/visitor with access to the token. The token is wherever Authy is. The point is TOTP shares all of the risks associated with things like SSH private keys. It has value, but is inferior to many other types of token.
      - Ansil849 5y ago
        > With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has. I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
        Spooky23 5y ago
        I guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.

joenathanone 5y ago

Or they change just gate the notifications/MFA requests server side, limit the number of request and set an increasing delay between request.

dane-pgp 5y ago
So if an attacker had access to 2 million IP addresses[0] and they were attacking a country where maybe less than 5 million people[1] have an account on the national authentication system, how easy would it be for them to DDoS the system for a week? Presumably the attackers would choose the week when people were supposed to fill in their tax forms, or (if the country was foolish enough to allow online voting) the week of an election. [0] https://www.bbc.co.uk/news/technology-11531657 https://www.bbc.co.uk/news/technology-11531657 [1] https://www.worldometers.info/world-population/denmark-population/ https://www.worldometers.info/world-population/denmark-popul...
- joenathanone 5y ago
  An attack of that size would of course be automated which should make it easy to fingerprint, then just block the matching fingerprint, or add a captcha. Could also add a "I didn't request this MFA" link that would flag the requester.

autoexec 5y ago

> I gave up on the Microsoft authenticator and just switched to manually enter tokens from an TOTP app. My office considered Microsoft authenticator, but there was push back after looking at their privacy policy and how much access the app wanted on people's personal devices (location, storage, contacts, etc). The nice thing about a little TOTP hardware token is that you avoid the push notification problem and it doesn't collect massive amounts of your data to use against you or sell to 3rd parties.

judge2020 5y ago
Which one in particular? These are quite bog-standard Android permissions. https://i.judge.sh/QjsR4/m_GdOf1iig.png https://i.judge.sh/QjsR4/m_GdOf1iig.png
- autoexec 5y ago
  Even that wants your GPS location (why?), camera (and therefore microphone) access, and storage access. Those kinds of permissions have been 'normalized' sure, but they're also 100% unnecessary considering the job is done just as well (or better as it's without security issues like the one in the article) with a tiny hardware token that requires literally none of those things and couldn't do them if it wanted to. If you aren't currently handing your location data over to Microsoft 24/7 right now, why should you start?
  - slaymaker1907 5y ago
    It wants your GPS location for the same reason banks look at your location. Even if they still let an auth request go through, they can alert you through email if a request is approved from an unexpected location. Camera permission is necessary for QR codes so you can setup the authenticator. No idea what the mic permission is about though.
    - autoexec 5y ago
      Your IP should provide them (and your bank) enough location info to alert you if your account is accessed from another state/country. QR codes weren't needed to set up the hardware token, so that feels like a feature created to justify the increased access (also phones come with their own camera apps capable of reading a QR code or at the very least photographing one). The mic access is a side effect of android's leaky permission system which hands out the ability to record audio to any app that wants access to your camera.