5 ms·

If you think this all sounds terrible, it's time to start building your alternative.

sph 4y ago
There already is, at least for the techies: YubiKey + OTP with your password manager. Non techies are SOL as usual. Proper password education apparently is too hard, so big tech is frothing at the mouth to get total control over your password management so you can't ever leave.
- JustFinishedBSG 4y ago
  OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.
  - sph 4y ago
    How do you MITM an OTP code? I haven't been talking about SMS 2FA.
    - tzs 4y ago
      The same way you MITM a user name or a password. You come to my phishing site thinking you are going to your bank site. You enter account and password. I enter that on the bank site. The bank site asks for your OTP code. My site then asks for your OTP code, which you enter because you think you are talking to the bank site. My site enters the OTP code on the bank site.
      - sph 4y ago
        How is that an OTP flaw? You've just described phishing, which 1FA, 2FA, OTP or even FIDO/Yubikey can't directly protect you from.
        saltcured 4y ago
        The authentication process effectively salts the response with both the web origin and the anti-replay counter. The result is then different for every web origin and so the phishing site would get a different authentication response that is incorrect/useless for the real site. This protection is only for the classic phishing scenario where the user-agent is showing a different origin that is masquerading as the user's desired site. AFAIK, this won't solve the problem of Trojan apps where the authenticated user-agent itself can be subverted into making inappropriate requests. In such malware scenarios, you could also just hijack the other temporary session cookie/token secrets after the login step.
Avamander 4y ago
If Webauthn is not to your liking you can also do mTLS, both have large-scale deployments and usage.

sph 4y ago

There already is, at least for the techies: YubiKey + OTP with your password manager. Non techies are SOL as usual. Proper password education apparently is too hard, so big tech is frothing at the mouth to get total control over your password management so you can't ever leave.

JustFinishedBSG 4y ago
OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.
- sph 4y ago
  How do you MITM an OTP code? I haven't been talking about SMS 2FA.
  - tzs 4y ago
    The same way you MITM a user name or a password. You come to my phishing site thinking you are going to your bank site. You enter account and password. I enter that on the bank site. The bank site asks for your OTP code. My site then asks for your OTP code, which you enter because you think you are talking to the bank site. My site enters the OTP code on the bank site.
    - sph 4y ago
      How is that an OTP flaw? You've just described phishing, which 1FA, 2FA, OTP or even FIDO/Yubikey can't directly protect you from.
      - saltcured 4y ago
        The authentication process effectively salts the response with both the web origin and the anti-replay counter. The result is then different for every web origin and so the phishing site would get a different authentication response that is incorrect/useless for the real site. This protection is only for the classic phishing scenario where the user-agent is showing a different origin that is masquerading as the user's desired site. AFAIK, this won't solve the problem of Trojan apps where the authenticated user-agent itself can be subverted into making inappropriate requests. In such malware scenarios, you could also just hijack the other temporary session cookie/token secrets after the login step.

Avamander 4y ago

If Webauthn is not to your liking you can also do mTLS, both have large-scale deployments and usage.