7 ms·

The only thing 2FA has been good for in my experience has been giving me a lot more junk calls. It should be outlawed in social media, and they should be requir

The only thing 2FA has been good for in my experience has been giving me a lot more junk calls. It should be outlawed in social media, and they should be required to build proper user support instead. Accounts are still being compromised regularly even with 2FA, it's tedious to use, and it only adds to PII overreach, as phones are becoming more involved in everyone's privacy and payment management. This is a perfect example of casual protection and "failure downplaying" that social platforms conduct on serious volumes of personal data, and how it has become too common place as they warehouse private data that they really don't need. A customer required me to use Skype for a meeting just the other day, It let me authenticate and verify an email account, but before I could even use it, it locked up and asked me for my phone number. This over reach is out of control.

six0h 4y ago
Are you writing off 2fa as a whole, or just sms? Aside from full database breach, why would requiring me to use a security key, or authenticator app be a bad idea? Physical theft is a lot harder (even just due to physical distance from a hacker) than stealing my password, which can happen at any distance
- sebow 4y ago
  I assume he mostly means SMS. And I fully agree, ever since I've got my security key I've stopped using SMS (though I never really had problems with people trying to social engineer my telecom provider). It's way more secure and it's somewhat permanent compared to a phone number, especially if left at home(since realistically unless you're commuting a lot you don't need it). The biggest perceived risk imo is when travelling(especially since changing countries will most likely trip any account session). Even authenticator apps are better than 2FA through SMS.
- winternett 4y ago
  As a whole for social media at least. For items that are of national security and high sensitivity in the business world, personal devices are regularly being used in many cases (Non Gov Furnished Equipment) as well, and that thoroughly defeats the purpose too. The people that seek that level and volume of data are not usually simple amateurs that stumble upon script tools, they are usually engineers, info warriors, and even massive operations themselves with funding, skill, and human resources to get what they want. The best ways to secure data is at the system level and by not collecting data that is not needed for direct relevance to system function to begin with. Personal phone numbers have no relevance to apps like Twitter or Facebook beyond facilitating their personal information and ID lust.
  - kube-system 4y ago
    Token based 2fa does not leak any information to the service and it has a benefit of preventing other types of attacks on the functions that the system is supposed to do. There is literally no reason to be against TOTP or WebAuthN
    - winternett 4y ago
      How could you ever guarantee that when registration for many services are conducted on such a wide variety of Internet-based web forms that are integrated into web sites? That's not logical. I've even seen sites where registration is done on sites with expired certs. Not everyone registers directly within the service itself, and there are plenty of cases where config and security are not implemented and managed properly.
      - ziddoap 4y ago
        >I've even seen sites where registration is done on sites with expired certs. Not everyone registers directly within the service itself, and there are plenty of cases where config and security are not implemented and managed properly. I might be missing something, but what does that have to do with the efficacy of token-based 2FA?
        winternett 4y ago
        Web forms allow social media sites to capture bare phone numbers and store them in other places than just for authentication services. The places they store these numbers are often exposed to the public and to partners for a fee, along with personal data, which regularly is connected to other personal data on each account user. 2FA does not keep your account secure, and is just a bogus ploy to get your phone number, by social and other platforms) if most of your personally identifiable information on a site stores can be scraped ALONG WITH YOUR PHONE NUMBER, as it was, from a social media site (Which is exactly what happened in the original article cited).
        4y ago
- ipaddr 4y ago
  You lose access to the security key or the key stops working.
  - staticassertion 4y ago
    Buy two keys. Your phone is probably a key already, so just one additional key.
    - winternett 4y ago
      Give copies of the keys to all your co-workers, and leave one under the doormat too for a good time... Hah! All the added complexity of implementing minimum character limits on passwords and requiring them to be changed every 3 months literally drove people to write passwords on post its and put them on PC monitors back in 2019... Some things never change... Maybe we should add second and third passwords, and then keep goin until admins lose root access and just use Sudo.... LOL!
      - microtonal 4y ago
        A YubiKey under the doormat protects against one of primary intended scenario: preventing phishing. It's unlikely that a phisher on the other side of the world has access to your doormat. Moreover: - Modern FIDO2 keys allow you to set a password (I think sites have to implement the newer FIDO2/Webauthn standards rather than U2F to use this functionality). So then when someone takes it from under your doormat, it is worthless. - Passkeys are coming. E.g. on Apple platforms they will be secured between devices using end-to-end encryption (through iCloud keychain) and they use biometric authentication to unlock (Face ID or Touch ID). This will make non-password authentication a lot more convenient.
        winternett 4y ago
        I know, I've used them multiple times. The thing is, no one can explain to me how it's better than just requiring 2+ passwords on each user account. You can't authenticate if you lose the Yubi when tech support is not available without circumventing the very process it was based upon... Nothing is failproof. Of course each specific use case is different. If Facebook demanded I use a dongle or even biometrics, that would very well be the exact point I quit it though.
staticassertion 4y ago
SMS 2FA never should have been deployed. It's a disaster and we'll be cleaning up this mess for decades.
- winternett 4y ago
  Even before all the robo-call Armageddon started, I was getting flooded with calls whenever I logged into Azure, which was the first time I was required to use 2FA. I would get calls from strange sources literally seconds after authenticating. Even trusted companies really dont need that private data. Secure email accounts better and use it. That way mis-use of it on government resources at least would carry harsher penalties. We should have established an email service within the postal service for every citizen, that would also regulate misuse and spam better... I wrote about it long ago, it should have been in place by now instead of corp run services being used for PII things. Gmail, Google, and many other corp run services are being used for very critical and sensitive things (Not referring to contracted services) that never should be the case.
- fragmede 4y ago
  It's true the publicized SS7 attacks brought forwards the timeline with which SMS based auth should be deprecated, but "never should have been deployed" is a bit much. There simply wasn't the infrastructure to support anything else. Hardware RSA SecurID keys from the 90's wouldn't have scaled.
  - staticassertion 4y ago
    When Twitter implemented its SMS 2FA TOTP was already standard.
    - ASalazarMX 4y ago
      Yes, but those sweet phone numbers are a valuable targeting product.
nicbou 4y ago
Try using TOTP 2FA instead of SMS. No phone number needed and it's much easier to use. It doesn't depend on a device you can lose nor a channel that can get hacked.
- winternett 4y ago
  That model is possibly better for securing (high value) private systems, but not for social media and non-contracted (public) services like Gmail. As I've said in other places here, those other sites and public (corporate owned & improperly-regulated) services need to be properly governed and instructed to not store data they don't need at all, like phone numbers, passports, and driver's licenses. There should be harsher penalties imposed on companies for data compromises to discourage unnecessary personal data gathering.
  - nicbou 4y ago
    What is the reasoning behind your first paragraph? I agree wholeheartedly with the second paragraph, but it will sadly never happen.
_Algernon_ 4y ago
You shouldn't be using sms as 2fa anyways. It's barely better than no 2fa at all. Use an authenticator app.
- ASalazarMX 4y ago
  The workflow of most big apps is pushing to get your phone number, validating it through SMS, and after that allowing you to use other 2FA. It's stupid from a security point of view.
SuperSandro2000 4y ago
You are absolute wrong. 2FA is very effective in protecting accounts against password steals. I fail to understand how 2FA TOTP gives you junk calls? SMS based 2FA is not effective but that's nothing new.
- ASalazarMX 4y ago
  > I fail to understand how 2FA TOTP gives you junk calls? Companies pushing to have your phone number for 2FA, even when better alternatives are available, is what gives you junk calls.
ThePowerOfFuet 4y ago
> A customer required me to use Skype for a meeting just the other day, It let me authenticate and verify an email account, but before I could even use it, it locked up and asked me for my phone number. This over reach is out of control. I can't recommend Whereby enough.
hnick 4y ago
I had to test some calendar links and decided to make a test account on Yahoo for work to share. I quit at this step. We'll send you a code to verify this mobile number. Message and data rates may apply. By clicking ‘Send code’, you agree to allow your mobile phone/email address to be used by us and our partners in order to deliver relevant content and ads across our products and websites. Visit our Privacy Policy Luckily I found a defunct personal account which I hadn't used in over a decade. I assume they had an opt-out at a later step, but there's no way to claw back anything they shared before that point.

six0h 4y ago

Are you writing off 2fa as a whole, or just sms? Aside from full database breach, why would requiring me to use a security key, or authenticator app be a bad idea? Physical theft is a lot harder (even just due to physical distance from a hacker) than stealing my password, which can happen at any distance

sebow 4y ago
I assume he mostly means SMS. And I fully agree, ever since I've got my security key I've stopped using SMS (though I never really had problems with people trying to social engineer my telecom provider). It's way more secure and it's somewhat permanent compared to a phone number, especially if left at home(since realistically unless you're commuting a lot you don't need it). The biggest perceived risk imo is when travelling(especially since changing countries will most likely trip any account session). Even authenticator apps are better than 2FA through SMS.
winternett 4y ago
As a whole for social media at least. For items that are of national security and high sensitivity in the business world, personal devices are regularly being used in many cases (Non Gov Furnished Equipment) as well, and that thoroughly defeats the purpose too. The people that seek that level and volume of data are not usually simple amateurs that stumble upon script tools, they are usually engineers, info warriors, and even massive operations themselves with funding, skill, and human resources to get what they want. The best ways to secure data is at the system level and by not collecting data that is not needed for direct relevance to system function to begin with. Personal phone numbers have no relevance to apps like Twitter or Facebook beyond facilitating their personal information and ID lust.
- kube-system 4y ago
  Token based 2fa does not leak any information to the service and it has a benefit of preventing other types of attacks on the functions that the system is supposed to do. There is literally no reason to be against TOTP or WebAuthN
  - winternett 4y ago
    How could you ever guarantee that when registration for many services are conducted on such a wide variety of Internet-based web forms that are integrated into web sites? That's not logical. I've even seen sites where registration is done on sites with expired certs. Not everyone registers directly within the service itself, and there are plenty of cases where config and security are not implemented and managed properly.
    - ziddoap 4y ago
      >I've even seen sites where registration is done on sites with expired certs. Not everyone registers directly within the service itself, and there are plenty of cases where config and security are not implemented and managed properly. I might be missing something, but what does that have to do with the efficacy of token-based 2FA?
      - winternett 4y ago
        Web forms allow social media sites to capture bare phone numbers and store them in other places than just for authentication services. The places they store these numbers are often exposed to the public and to partners for a fee, along with personal data, which regularly is connected to other personal data on each account user. 2FA does not keep your account secure, and is just a bogus ploy to get your phone number, by social and other platforms) if most of your personally identifiable information on a site stores can be scraped ALONG WITH YOUR PHONE NUMBER, as it was, from a social media site (Which is exactly what happened in the original article cited).
        4y ago
ipaddr 4y ago
You lose access to the security key or the key stops working.
- staticassertion 4y ago
  Buy two keys. Your phone is probably a key already, so just one additional key.
  - winternett 4y ago
    Give copies of the keys to all your co-workers, and leave one under the doormat too for a good time... Hah! All the added complexity of implementing minimum character limits on passwords and requiring them to be changed every 3 months literally drove people to write passwords on post its and put them on PC monitors back in 2019... Some things never change... Maybe we should add second and third passwords, and then keep goin until admins lose root access and just use Sudo.... LOL!
    - microtonal 4y ago
      A YubiKey under the doormat protects against one of primary intended scenario: preventing phishing. It's unlikely that a phisher on the other side of the world has access to your doormat. Moreover: - Modern FIDO2 keys allow you to set a password (I think sites have to implement the newer FIDO2/Webauthn standards rather than U2F to use this functionality). So then when someone takes it from under your doormat, it is worthless. - Passkeys are coming. E.g. on Apple platforms they will be secured between devices using end-to-end encryption (through iCloud keychain) and they use biometric authentication to unlock (Face ID or Touch ID). This will make non-password authentication a lot more convenient.
      - winternett 4y ago
        I know, I've used them multiple times. The thing is, no one can explain to me how it's better than just requiring 2+ passwords on each user account. You can't authenticate if you lose the Yubi when tech support is not available without circumventing the very process it was based upon... Nothing is failproof. Of course each specific use case is different. If Facebook demanded I use a dongle or even biometrics, that would very well be the exact point I quit it though.

staticassertion 4y ago

SMS 2FA never should have been deployed. It's a disaster and we'll be cleaning up this mess for decades.

winternett 4y ago
Even before all the robo-call Armageddon started, I was getting flooded with calls whenever I logged into Azure, which was the first time I was required to use 2FA. I would get calls from strange sources literally seconds after authenticating. Even trusted companies really dont need that private data. Secure email accounts better and use it. That way mis-use of it on government resources at least would carry harsher penalties. We should have established an email service within the postal service for every citizen, that would also regulate misuse and spam better... I wrote about it long ago, it should have been in place by now instead of corp run services being used for PII things. Gmail, Google, and many other corp run services are being used for very critical and sensitive things (Not referring to contracted services) that never should be the case.
fragmede 4y ago
It's true the publicized SS7 attacks brought forwards the timeline with which SMS based auth should be deprecated, but "never should have been deployed" is a bit much. There simply wasn't the infrastructure to support anything else. Hardware RSA SecurID keys from the 90's wouldn't have scaled.
- staticassertion 4y ago
  When Twitter implemented its SMS 2FA TOTP was already standard.
  - ASalazarMX 4y ago
    Yes, but those sweet phone numbers are a valuable targeting product.

nicbou 4y ago

Try using TOTP 2FA instead of SMS. No phone number needed and it's much easier to use. It doesn't depend on a device you can lose nor a channel that can get hacked.

winternett 4y ago
That model is possibly better for securing (high value) private systems, but not for social media and non-contracted (public) services like Gmail. As I've said in other places here, those other sites and public (corporate owned & improperly-regulated) services need to be properly governed and instructed to not store data they don't need at all, like phone numbers, passports, and driver's licenses. There should be harsher penalties imposed on companies for data compromises to discourage unnecessary personal data gathering.
- nicbou 4y ago
  What is the reasoning behind your first paragraph? I agree wholeheartedly with the second paragraph, but it will sadly never happen.

_Algernon_ 4y ago

You shouldn't be using sms as 2fa anyways. It's barely better than no 2fa at all. Use an authenticator app.

ASalazarMX 4y ago
The workflow of most big apps is pushing to get your phone number, validating it through SMS, and after that allowing you to use other 2FA. It's stupid from a security point of view.

SuperSandro2000 4y ago

You are absolute wrong. 2FA is very effective in protecting accounts against password steals. I fail to understand how 2FA TOTP gives you junk calls? SMS based 2FA is not effective but that's nothing new.

ASalazarMX 4y ago
> I fail to understand how 2FA TOTP gives you junk calls? Companies pushing to have your phone number for 2FA, even when better alternatives are available, is what gives you junk calls.

ThePowerOfFuet 4y ago

> A customer required me to use Skype for a meeting just the other day, It let me authenticate and verify an email account, but before I could even use it, it locked up and asked me for my phone number. This over reach is out of control. I can't recommend Whereby enough.

hnick 4y ago

I had to test some calendar links and decided to make a test account on Yahoo for work to share. I quit at this step. We'll send you a code to verify this mobile number. Message and data rates may apply. By clicking ‘Send code’, you agree to allow your mobile phone/email address to be used by us and our partners in order to deliver relevant content and ads across our products and websites. Visit our Privacy Policy Luckily I found a defunct personal account which I hadn't used in over a decade. I assume they had an opt-out at a later step, but there's no way to claw back anything they shared before that point.