4 ms·

> We strongly believe that instead of inventing their own authentication protocol, they should migrate to an open standard Also > We notified the Australian G

by nomilk 4y ago

> We strongly believe that instead of inventing their own authentication protocol, they should migrate to an open standard Also > We notified the Australian Government of this problem, and were told by the Australian Tax Office that they do not intend to make the recommended changes to their protocol. [1] Aust Govt breaks multiple web-security 101 rules, bears no cost nor responsibility for it, and the cherry on top: they refuse to do anything about it. [1] https://www.youtube.com/watch?v=TgPdVbUbtBM&t=311s https://www.youtube.com/watch?v=TgPdVbUbtBM&t=311s

greggsy 4y ago
Isn’t this just a phishing attack? Almost any MFA service is vulnerable to this, but it’s not at all insurmountable if the user is sufficiently trained during the onboarding process. They even have an app which can leverage to help train users around the risks. App-based OTP and push seems like a reasonable middle ground, short of supplying everyone with FIDO keys. It’s still better than SMS or email - or no second factor at all.
- ntrz 4y ago
  Is it a second factor? The article makes it sound as though the MyGovID authorization is all that's needed to log in, and the official site (https://www.mygovid.gov.au/ https://www.mygovid.gov.au/) says it's used "instead of usernames and passwords."
  - greggsy 4y ago
    The app is ‘something you have’, which you can only use after you authenticate into your phone with ‘something you are’ (biometrics), or ‘something you know’ (a PIN/passphrase). I’m fairly sure the app does require you to enter a password after a set period or reboot - exactly like apple’s iCloud implementation (which IMO, is pretty good, or at least good enough for most individuals’ use cases). Things are getting a bit confused lately though, as some models require that factors can’t exist on the same device, and there’s questions around keeping physical (‘have’)factors separated for different accounts and functions.
alfiedotwtf 4y ago
I don't know how it goes these days, but for a while only a few years ago, there were departments in Defence reading their email via HTTP (not httpS) webmail (IIRC it was Squirelmail).

by nomilk 4y ago

greggsy 4y ago

Isn’t this just a phishing attack? Almost any MFA service is vulnerable to this, but it’s not at all insurmountable if the user is sufficiently trained during the onboarding process. They even have an app which can leverage to help train users around the risks. App-based OTP and push seems like a reasonable middle ground, short of supplying everyone with FIDO keys. It’s still better than SMS or email - or no second factor at all.

ntrz 4y ago
Is it a second factor? The article makes it sound as though the MyGovID authorization is all that's needed to log in, and the official site (https://www.mygovid.gov.au/ https://www.mygovid.gov.au/) says it's used "instead of usernames and passwords."
- greggsy 4y ago
  The app is ‘something you have’, which you can only use after you authenticate into your phone with ‘something you are’ (biometrics), or ‘something you know’ (a PIN/passphrase). I’m fairly sure the app does require you to enter a password after a set period or reboot - exactly like apple’s iCloud implementation (which IMO, is pretty good, or at least good enough for most individuals’ use cases). Things are getting a bit confused lately though, as some models require that factors can’t exist on the same device, and there’s questions around keeping physical (‘have’)factors separated for different accounts and functions.

alfiedotwtf 4y ago

I don't know how it goes these days, but for a while only a few years ago, there were departments in Defence reading their email via HTTP (not httpS) webmail (IIRC it was Squirelmail).