10 ms·

Two-factor authentication terrifies me. For my bank from my country of origin that I maintain, I get a battery-powered RSA token. From that I can generate a mo

Two-factor authentication terrifies me. For my bank from my country of origin that I maintain, I get a battery-powered RSA token. From that I can generate a mobile 2FA token in an app that I can use to log in for day-to-day transaction. If I lose the devices with the 2FA token, I have to pray that that CR2032 is still alive or I lose access to that account until I spend thousands of dollars on international flights (replacing the battery resets the device)

causi 4y ago
I would suggest keeping an eye on the voltage with a meter and when it starts to drop solder on a second battery while you replace the first, the same way people replace game cartridge batteries without losing SRAM saves.
- tgsovlerkhgsel 4y ago
  That's a great recipe to fumble and accidentally reset the device.
  - causi 4y ago
    How? The original battery provides power while you're soldering on the backup and the backup is solidly soldered on while you swap out the original. How could you be so clumsy you rip out a solder joint?
    - kalleboo 4y ago
      What if it's only held in by the case itself and not a clip? Then I'd disconnect it simply by opening the device?
      - causi 4y ago
        Since you knew it was a CR2032 I assumed you were already familiar with it.
        kalleboo 4y ago
        I just guessed by the physical size of the device. I guess it could be a smaller coin cell as well.
      - shoghicp 4y ago
        You are correct. Those BankID physical devices have tamper switches that erase RAM on device opening. An alternative is debit card bankid (as a smartcard, then add Mobile BankID back), but it's being deprecated soon.
    - tgsovlerkhgsel 4y ago
      Accidentally disconnecting the original battery while messing with it. Or shorting something out.
- jbarberu 4y ago
  A bit OT, but at least for the Game Boy you can pop the cartridge (front of the case off) into a console (GBA is especially good as it only covers part of the cart), power it on and then replace the battery. The game save will remain. Or you can use something like the GB Operator and backup the game save, replace the battery and then rewrite it to the cart :)
BruiseLee 4y ago
I lost access to my bank account in UK because my token ran out of battery. The only way to fix this is to fly to London and show up in person. This is a pain because I can't even figure out my account balance - and this is something I must report for U.S. taxes.
- lowercased 4y ago
  Similar thing happened here to my wife (US, bank in UK). "We don't send those out any more, just use your phone". But... a) my wife didn't have a phone at the time (not one capable of running their only supported version of their app) and ... one of the signup questions was asking about bank balance (or... recent transactions, etc) - but... there's been no recent transactions and we don't know the balance because... we can't log in. This was... ~ 6-7 months ago. I'm unsure what options are left, or... if my wife sorted it out (she did recently get a newer iphone, and that may have been able to get it sorted).
  - ratww 4y ago
    Similar experience here, but when using the mobile app. My bank in my country of origin also used to use a token, but they changed to a "token app" in the phone about 10 years ago. However to authorise this app I had to use an ATM. Since this bank only has ATMs in one country, this means I couldn't lose or trade my phone. After I moved I kept a super old iPhone in a drawer only for this bank, but at some point the app kept threatening me to upgrade, otherwise it would stop working in the next version. But I couldn't upgrade because my decade-old phone was too old for the new version. Since even blocking my debit card via phone required using the "token app" (something incomprehensible to me), it became too risky to keep this account. At this point I had no recourse but to close the account.
  - userabchn 4y ago
    The Bank of America app only lets you install it if your Google (or presumably Apple) account country is set as America. I am abroad but needed to use the app. I had to create a VPN on an American cloud instance and connect my phone to it so that I could set my country to America and install the app.
tragictrash 4y ago
It shouldn't. You can just use authy, which allows you to onboard devices using your phone number, and then a password to decrypt the existing entries. If you use 2fa with authy, remember that password, and remember your password Manager's password, something like this scenario won't ruin your life.
- tluyben2 4y ago
  With 'old' banks (and other systems that use these tokens) with a physical token, you can (often?) not do that.
- kalleboo 4y ago
  My bank doesn't use TOTP but rather the Swedish BankID system for 2FA
- jimmydorry 4y ago
  You open yourself up to a much more devastating attack vector though: sim swapping. If someone can convince the human at the other end of the line that they are you and that they lost their phone, in most countries and with most telco's, they will be able to get up and running with a new SIM with _YOUR_ number. Resettting your Authy password via SMS is then just a step away.
  - avh02 4y ago
    Yeah i stopped using authy the first time a token was automatically seeded this way (may have been another way, but it was automatic and I didn't like it because I was also using the seed on my Pebble which i could then no longer do with this method). i prefer manual control over stuff like that and definitely don't want it assuming some magic is okay.
    - TedDoesntTalk 4y ago
      I think you’re being a little paranoid: https://support.authy.com/hc/en-us/articles/360036077534-Authy-Backups-Password-Recovery https://support.authy.com/hc/en-us/articles/360036077534-Aut... “How do you derive encryption keys from a Backup Password? We use the National Institute of Standards and Technology (NIST) recommended algorithm PBKDF2.”
usrn 4y ago
IMO the primary reason they're pushing 2FA is for the people who are careless enough to eg log into their personal email on their work computer. I wish there was an exam you could take that would get you a "computing license" that you could show to bypass a lot of this stuff.
- Gigachad 4y ago
  Enforcing 2FA is the most effective security rule ever created. Vastly more effective than password rules, rotation, user education, any anything else ever tried. With 2FA, almost all of the traditional attacks are impossible and the only one left is specially crafted fake login pages.
  - usrn 4y ago
    Meh. You're right when you're dealing with large groups of people which is exactly what I said in my original comment. If you understand these issues passwords on their own are fine. 2FA has some nasty edge cases that make it very easy to lose access to your account (which is what everyone in this thread is talking about.) So as always you're balancing security and availability. For some people the proper balance means just password authentication makes sense. The best IMO would be client side certificates but no one except maybe Github supports those.
    - LocalPCGuy 4y ago
      No, passwords on their own are never "enough" for you to be secure as you only control your side of the equation. You don't know if the place you are storing it is doing so in plain text, storing a decryption key right next to it, etc. Even if you are careful (I know what you said above), the network you are on could be compromised despite your best efforts/knowledge. Or any number of other things that could make it trivial for someone to gain access to your account in the event they gain access to simply the password. I don't claim 2FA is perfect, it has its own host of issues as is being discussed. But it isn't just for "the masses that don't understand how to make strong passwords or how to be secure". Certs are good, but they need to be made simpler than they are now for the very people you claim 2FA is for or they won't be adopted (one of the reasons they aren't more ubiquitous, IMO). And some certs implementations have issues with account recovery as well if you lose access to them. It's a really hard problem that you do a bit of disservice to when you dismiss it as "just a problem of the plebes".
unethical_ban 4y ago
2FA can be "backed up" by either using a 2FA soft token program that allows for backups, like 2faone or Authy, OR by the services themselves granting backup codes for emergencies. For my threat profile, I have no problem storing my 2FA backup passwords/codes in my master password safe. If that is compromised, I was doomed anyway. If a service does not allow the use of "generic" TOTP ala Authy or Google Authenticator, AND it does not allow for one time use backup codes, then I do not use 2FA with that service unless required. My main bank forces the use of their own built in 2FA (Symantec VIP on the backend) which pisses me off. My work uses Okta and RSA. Oh well.
- kalleboo 4y ago
  Pretty much all the banks in my country (Sweden) use a local national digital ID system called BankID which is issued by the banks themselves to mobile devices as a second factor and gets tied to your national ID number (and once issued by your bank is used by your bank, other banks, the government for tax filing/address change/receiving official mail digitally instead of physically, signing contracts for e.g. apartments, and even retailers to address auto-fill). All the banks I know of require 2FA in the form of either a physical, battery-powered RSA token (sometimes in the form of a EMV card reader) or a valid BankID. The assumption is you live in the country and can just visit a branch if you have any trouble, which works for 99% of customers. But not for me.
- efreak 4y ago
  python-vipaccess might interest you. I used it for both PayPal and eBay at one point. https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
journey_16162 4y ago
One bank I have set up in a new country set me up with their mobile app and that mobile app is the only way to access the bank. They have a web-app, but login to the web app can only be authorized from mobile. At least an existing install can be used to authorize installs on new devices. Got it on 3 devices installed just in case.

causi 4y ago

I would suggest keeping an eye on the voltage with a meter and when it starts to drop solder on a second battery while you replace the first, the same way people replace game cartridge batteries without losing SRAM saves.

tgsovlerkhgsel 4y ago
That's a great recipe to fumble and accidentally reset the device.
- causi 4y ago
  How? The original battery provides power while you're soldering on the backup and the backup is solidly soldered on while you swap out the original. How could you be so clumsy you rip out a solder joint?
  - kalleboo 4y ago
    What if it's only held in by the case itself and not a clip? Then I'd disconnect it simply by opening the device?
    - causi 4y ago
      Since you knew it was a CR2032 I assumed you were already familiar with it.
      - kalleboo 4y ago
        I just guessed by the physical size of the device. I guess it could be a smaller coin cell as well.
    - shoghicp 4y ago
      You are correct. Those BankID physical devices have tamper switches that erase RAM on device opening. An alternative is debit card bankid (as a smartcard, then add Mobile BankID back), but it's being deprecated soon.
  - tgsovlerkhgsel 4y ago
    Accidentally disconnecting the original battery while messing with it. Or shorting something out.
jbarberu 4y ago
A bit OT, but at least for the Game Boy you can pop the cartridge (front of the case off) into a console (GBA is especially good as it only covers part of the cart), power it on and then replace the battery. The game save will remain. Or you can use something like the GB Operator and backup the game save, replace the battery and then rewrite it to the cart :)

BruiseLee 4y ago

I lost access to my bank account in UK because my token ran out of battery. The only way to fix this is to fly to London and show up in person. This is a pain because I can't even figure out my account balance - and this is something I must report for U.S. taxes.

lowercased 4y ago
Similar thing happened here to my wife (US, bank in UK). "We don't send those out any more, just use your phone". But... a) my wife didn't have a phone at the time (not one capable of running their only supported version of their app) and ... one of the signup questions was asking about bank balance (or... recent transactions, etc) - but... there's been no recent transactions and we don't know the balance because... we can't log in. This was... ~ 6-7 months ago. I'm unsure what options are left, or... if my wife sorted it out (she did recently get a newer iphone, and that may have been able to get it sorted).
- ratww 4y ago
  Similar experience here, but when using the mobile app. My bank in my country of origin also used to use a token, but they changed to a "token app" in the phone about 10 years ago. However to authorise this app I had to use an ATM. Since this bank only has ATMs in one country, this means I couldn't lose or trade my phone. After I moved I kept a super old iPhone in a drawer only for this bank, but at some point the app kept threatening me to upgrade, otherwise it would stop working in the next version. But I couldn't upgrade because my decade-old phone was too old for the new version. Since even blocking my debit card via phone required using the "token app" (something incomprehensible to me), it became too risky to keep this account. At this point I had no recourse but to close the account.
- userabchn 4y ago
  The Bank of America app only lets you install it if your Google (or presumably Apple) account country is set as America. I am abroad but needed to use the app. I had to create a VPN on an American cloud instance and connect my phone to it so that I could set my country to America and install the app.

tragictrash 4y ago

It shouldn't. You can just use authy, which allows you to onboard devices using your phone number, and then a password to decrypt the existing entries. If you use 2fa with authy, remember that password, and remember your password Manager's password, something like this scenario won't ruin your life.

tluyben2 4y ago
With 'old' banks (and other systems that use these tokens) with a physical token, you can (often?) not do that.
kalleboo 4y ago
My bank doesn't use TOTP but rather the Swedish BankID system for 2FA
jimmydorry 4y ago
You open yourself up to a much more devastating attack vector though: sim swapping. If someone can convince the human at the other end of the line that they are you and that they lost their phone, in most countries and with most telco's, they will be able to get up and running with a new SIM with _YOUR_ number. Resettting your Authy password via SMS is then just a step away.
- avh02 4y ago
  Yeah i stopped using authy the first time a token was automatically seeded this way (may have been another way, but it was automatic and I didn't like it because I was also using the seed on my Pebble which i could then no longer do with this method). i prefer manual control over stuff like that and definitely don't want it assuming some magic is okay.
  - TedDoesntTalk 4y ago
    I think you’re being a little paranoid: https://support.authy.com/hc/en-us/articles/360036077534-Authy-Backups-Password-Recovery https://support.authy.com/hc/en-us/articles/360036077534-Aut... “How do you derive encryption keys from a Backup Password? We use the National Institute of Standards and Technology (NIST) recommended algorithm PBKDF2.”

usrn 4y ago

IMO the primary reason they're pushing 2FA is for the people who are careless enough to eg log into their personal email on their work computer. I wish there was an exam you could take that would get you a "computing license" that you could show to bypass a lot of this stuff.

Gigachad 4y ago
Enforcing 2FA is the most effective security rule ever created. Vastly more effective than password rules, rotation, user education, any anything else ever tried. With 2FA, almost all of the traditional attacks are impossible and the only one left is specially crafted fake login pages.
- usrn 4y ago
  Meh. You're right when you're dealing with large groups of people which is exactly what I said in my original comment. If you understand these issues passwords on their own are fine. 2FA has some nasty edge cases that make it very easy to lose access to your account (which is what everyone in this thread is talking about.) So as always you're balancing security and availability. For some people the proper balance means just password authentication makes sense. The best IMO would be client side certificates but no one except maybe Github supports those.
  - LocalPCGuy 4y ago
    No, passwords on their own are never "enough" for you to be secure as you only control your side of the equation. You don't know if the place you are storing it is doing so in plain text, storing a decryption key right next to it, etc. Even if you are careful (I know what you said above), the network you are on could be compromised despite your best efforts/knowledge. Or any number of other things that could make it trivial for someone to gain access to your account in the event they gain access to simply the password. I don't claim 2FA is perfect, it has its own host of issues as is being discussed. But it isn't just for "the masses that don't understand how to make strong passwords or how to be secure". Certs are good, but they need to be made simpler than they are now for the very people you claim 2FA is for or they won't be adopted (one of the reasons they aren't more ubiquitous, IMO). And some certs implementations have issues with account recovery as well if you lose access to them. It's a really hard problem that you do a bit of disservice to when you dismiss it as "just a problem of the plebes".

unethical_ban 4y ago

2FA can be "backed up" by either using a 2FA soft token program that allows for backups, like 2faone or Authy, OR by the services themselves granting backup codes for emergencies. For my threat profile, I have no problem storing my 2FA backup passwords/codes in my master password safe. If that is compromised, I was doomed anyway. If a service does not allow the use of "generic" TOTP ala Authy or Google Authenticator, AND it does not allow for one time use backup codes, then I do not use 2FA with that service unless required. My main bank forces the use of their own built in 2FA (Symantec VIP on the backend) which pisses me off. My work uses Okta and RSA. Oh well.

kalleboo 4y ago
Pretty much all the banks in my country (Sweden) use a local national digital ID system called BankID which is issued by the banks themselves to mobile devices as a second factor and gets tied to your national ID number (and once issued by your bank is used by your bank, other banks, the government for tax filing/address change/receiving official mail digitally instead of physically, signing contracts for e.g. apartments, and even retailers to address auto-fill). All the banks I know of require 2FA in the form of either a physical, battery-powered RSA token (sometimes in the form of a EMV card reader) or a valid BankID. The assumption is you live in the country and can just visit a branch if you have any trouble, which works for 99% of customers. But not for me.
efreak 4y ago
python-vipaccess might interest you. I used it for both PayPal and eBay at one point. https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess

journey_16162 4y ago

One bank I have set up in a new country set me up with their mobile app and that mobile app is the only way to access the bank. They have a web-app, but login to the web app can only be authorized from mobile. At least an existing install can be used to authorize installs on new devices. Got it on 3 devices installed just in case.