3 ms·

Many services seem to offer one-time codes for storage offline in case this happens. Authy can working across multiple devices, but that probably has some secur

Many services seem to offer one-time codes for storage offline in case this happens. Authy can working across multiple devices, but that probably has some security ramifications. Based on https://apple.stackexchange.com/questions/305372/will-my-google-authenticator-codes-work-if-i-restore-my-iphone-from-a-backup https://apple.stackexchange.com/questions/305372/will-my-goo..., you are able to restore Google Authenticator from iCloud. This is the usual security versus convenience problem. The site is forcing you to use an additional factor, but there is flexibility in how that is serviced. Choosing convenience may open paths for attackers, but the impact depends on your threat model.

ghaff 4y ago
I agree but how many people who have 2FA from Google for example have a printed out list of numbers? You can have multiple authentication devices but, again, how many people have this? And it's certainly very easy to be traveling and not have backups with you. One solution with Google at least is that they basically hardly ever require you to reauthenticate on a given device but that obviously doesn't help if the device in question breaks or is lost and is also your soft token. As you say, not an easy problem. The happy medium depends on the threat model and is somewhere between being able to easily social engineer new access and having to show up in Mountain View with a sheaf of notarized proof of identity documents.
- njarboe 4y ago
  I would like to have the option of only needing the password and no password reset unless you visit an office somewhere in person. For like Google, banks, brokerages, etc. But maybe that is less secure than two-factor online systems? Seems like it wouldn't be.
  - ghaff 4y ago
    Having to present physical, hard/expensive to reliably forge, government-issued ID at a reputable institution is a pretty good filter against most fraud. It's also a headache even if you live somewhere with a local branch of your bank. I tried to do this during the pandemic and the local bank branch didn't have anyone who could give me the right authentication so I had to spend a couple hours going to my local brokerage office to complete a transaction.
  - tialaramex 4y ago
    It is, in fact, less secure than what we should have been doing for at least 5 years. You are able to give away your password to bad guys, it's really easy because it's exactly like just using the password normally except whoops this was my-bank-login.example and not my-bank.example/login or login.my-bank.example or whatever the URL usually was. WebAuthn fixes that, everybody should implement and use WebAuthn. To their partial credit RubyGems apparently noticed they ought to do this, and so this message says they're working to implement it.
- Tainnor 4y ago
  > And it's certainly very easy to be traveling and not have backups with you. It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios. When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security. Of course, the difference is that people understand the value of passports and physical keys, but by and large they fail to grasp the importance of IT security or how to protect themselves. This is, ultimately, an education problem. But we don't have the same internet anymore as 20 years ago, and the problems associated with identity theft, unauthorised access, etc. are much bigger than they were, so we can't afford to be too cavalier about it anymore. Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager).
  - throw0101a 4y ago
    > When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security. Except there may not be any hoops to jump through with MFA if it is "too secure". See "I've locked myself out of my digital life" (a thought experiment): * https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my-digital-life/ https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my... * https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 > Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager). Except at that point it could be too late and they've lost all access to their digital life/assets.
  - duckmysick 4y ago
    > It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios. The difference is I can physically show myself at the embassy or consulate. I can ask a locksmith to come to my place. I can't do either when I lock myself out of my Gmail account.
- filmgirlcw 4y ago
  Passkeys (the new thing from the FIDO Alliance that Apple, Google, and Microsoft all support) will help with this a lot. Apple is going to start rolling this out in iOS 16 and I expect many sites and platforms to implement support relatively quickly. It’ll take time for this to work its way through the ecosystem and there will still be some trade-offs that will lake someone complain, but this is one of the more promising initiatives in the “passwordless” world that many security professionals have been striving for for quite some time. I do think that when it comes to software/package maintainers, the heavy lift of having to have an MFA solution is much smaller than for a regular user. Yes, you need to store your one-off keys somewhere safe (I use a password manager and store it in an encrypted file there whether that counts as a second factor or not is debatable, but I think the fact that my 1Password account requires an account key as well as my password when accessed from a new device helps protect against unauthorized access at least), but I do think this is an acceptable trade-off (for now) if you’re maintaining a popular OSS package. Maintainers have to do a lot of janitorial work, it’s true. And it does often fee unfair. But I don’t think asking people who maintain popular projects to use MFA for their package system is too much.
ValentineC 4y ago
>> More and more services are moving towards 2FA/MFA. The 2nd factor is in a phone app. What happens if I lose my phone? Without my old phone I cannot log into the services. How do I get access to my accounts again? How do I move the 2FA setup to new phone again? Do I have to do this one by one for all 50 2FAed services I use? > Many services seem to offer one-time codes for storage offline in case this happens. Adding on: even password managers like 1Password [1] and Bitwarden [2] offer support for TOTP 2FA now. [1] https://support.1password.com/one-time-passwords/ https://support.1password.com/one-time-passwords/ [2]https://bitwarden.com/help/authenticator-keys/ https://bitwarden.com/help/authenticator-keys/
- nisegami 4y ago
  The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager. But a good single factor is probably fine.
  - giaour 4y ago
    It's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).
  - worble 4y ago
    To be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.
londons_explore 4y ago
Oauth would fix this... If only everyone would use Oauth rather than hiding it behind 'enterprise' plans...
- clintonb 4y ago
  How exactly is OAuth a solution to MFA? You want everyone to run their own OAuth provider? Will the OAuth provider support MFA?

ghaff 4y ago

I agree but how many people who have 2FA from Google for example have a printed out list of numbers? You can have multiple authentication devices but, again, how many people have this? And it's certainly very easy to be traveling and not have backups with you. One solution with Google at least is that they basically hardly ever require you to reauthenticate on a given device but that obviously doesn't help if the device in question breaks or is lost and is also your soft token. As you say, not an easy problem. The happy medium depends on the threat model and is somewhere between being able to easily social engineer new access and having to show up in Mountain View with a sheaf of notarized proof of identity documents.

njarboe 4y ago
I would like to have the option of only needing the password and no password reset unless you visit an office somewhere in person. For like Google, banks, brokerages, etc. But maybe that is less secure than two-factor online systems? Seems like it wouldn't be.
- ghaff 4y ago
  Having to present physical, hard/expensive to reliably forge, government-issued ID at a reputable institution is a pretty good filter against most fraud. It's also a headache even if you live somewhere with a local branch of your bank. I tried to do this during the pandemic and the local bank branch didn't have anyone who could give me the right authentication so I had to spend a couple hours going to my local brokerage office to complete a transaction.
- tialaramex 4y ago
  It is, in fact, less secure than what we should have been doing for at least 5 years. You are able to give away your password to bad guys, it's really easy because it's exactly like just using the password normally except whoops this was my-bank-login.example and not my-bank.example/login or login.my-bank.example or whatever the URL usually was. WebAuthn fixes that, everybody should implement and use WebAuthn. To their partial credit RubyGems apparently noticed they ought to do this, and so this message says they're working to implement it.
Tainnor 4y ago
> And it's certainly very easy to be traveling and not have backups with you. It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios. When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security. Of course, the difference is that people understand the value of passports and physical keys, but by and large they fail to grasp the importance of IT security or how to protect themselves. This is, ultimately, an education problem. But we don't have the same internet anymore as 20 years ago, and the problems associated with identity theft, unauthorised access, etc. are much bigger than they were, so we can't afford to be too cavalier about it anymore. Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager).
- throw0101a 4y ago
  > When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security. Except there may not be any hoops to jump through with MFA if it is "too secure". See "I've locked myself out of my digital life" (a thought experiment): * https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my-digital-life/ https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my... * https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 > Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager). Except at that point it could be too late and they've lost all access to their digital life/assets.
- duckmysick 4y ago
  > It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios. The difference is I can physically show myself at the embassy or consulate. I can ask a locksmith to come to my place. I can't do either when I lock myself out of my Gmail account.
filmgirlcw 4y ago
Passkeys (the new thing from the FIDO Alliance that Apple, Google, and Microsoft all support) will help with this a lot. Apple is going to start rolling this out in iOS 16 and I expect many sites and platforms to implement support relatively quickly. It’ll take time for this to work its way through the ecosystem and there will still be some trade-offs that will lake someone complain, but this is one of the more promising initiatives in the “passwordless” world that many security professionals have been striving for for quite some time. I do think that when it comes to software/package maintainers, the heavy lift of having to have an MFA solution is much smaller than for a regular user. Yes, you need to store your one-off keys somewhere safe (I use a password manager and store it in an encrypted file there whether that counts as a second factor or not is debatable, but I think the fact that my 1Password account requires an account key as well as my password when accessed from a new device helps protect against unauthorized access at least), but I do think this is an acceptable trade-off (for now) if you’re maintaining a popular OSS package. Maintainers have to do a lot of janitorial work, it’s true. And it does often fee unfair. But I don’t think asking people who maintain popular projects to use MFA for their package system is too much.

ValentineC 4y ago

>> More and more services are moving towards 2FA/MFA. The 2nd factor is in a phone app. What happens if I lose my phone? Without my old phone I cannot log into the services. How do I get access to my accounts again? How do I move the 2FA setup to new phone again? Do I have to do this one by one for all 50 2FAed services I use? > Many services seem to offer one-time codes for storage offline in case this happens. Adding on: even password managers like 1Password [1] and Bitwarden [2] offer support for TOTP 2FA now. [1] https://support.1password.com/one-time-passwords/ https://support.1password.com/one-time-passwords/ [2]https://bitwarden.com/help/authenticator-keys/ https://bitwarden.com/help/authenticator-keys/

nisegami 4y ago
The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager. But a good single factor is probably fine.
- giaour 4y ago
  It's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).
- worble 4y ago
  To be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.

londons_explore 4y ago

Oauth would fix this... If only everyone would use Oauth rather than hiding it behind 'enterprise' plans...

clintonb 4y ago
How exactly is OAuth a solution to MFA? You want everyone to run their own OAuth provider? Will the OAuth provider support MFA?