3 ms·

Sorry if I'm a security noob but I have a genuine question. Why at the beginning I need to use 2FA if I can remember secure enough passwords (or use password ma

Sorry if I'm a security noob but I have a genuine question. Why at the beginning I need to use 2FA if I can remember secure enough passwords (or use password managers) and I'll not stupid enough to give the passwords away easily?

orangepurple 4y ago
In this case 2FA is useful if someone sniffs your password (key logger) and uses it later to try and fail to log in without your presence. Many wireless keyboards don't use encrypted comms. Keyboards can be bugged easily. There is tech to observe to thermals of keys after they are pressed from a distance. And listen to key strokes. Or capture wirelessly transmitted keystrokes with a parabolic dish pointed at you from across the street if you are far away and an SDR or ASIC. Or a compact omni antenna in a backpack sitting next to you if you are in a public area. The possibilities are endless!
- qwezxcrty 4y ago
  I see, maybe it serves as kind of defense in depth. I'll be surprised about most Bluetooth keyboards don't use encryption. And I feel like it's too panorid for me to worry about someone probing to your keyboard with an USRP or a HT-301.
  - orangepurple 4y ago
    CVE-2019-13054 CVE-2019-13055 CVE-2018-8117 CVE-2010-1184
    - pabs3 4y ago
      These are all CVEs of security issues in the proprietary firmware of wireless input devices, that lead to either eavesdropping or input injection or both.
batch12 4y ago
> I'll not stupid enough to give the passwords away easily? Don't underestimate a determined adversary. Secondly, look for single points of failure and eliminate them as best you can. If someone gains access to your email, could they perform password resets?
aendruk 4y ago
> stupid Phishing victims are not categorically stupid.
rsync 4y ago
"Sorry if I'm a security noob but I have a genuine question. Why at the beginning I need to use 2FA if I can remember secure enough passwords (or use password managers) and I'll not stupid enough to give the passwords away easily?" Glad you asked ... ... and your comments children are not just wrong, but completely misunderstand the ecosystem they are discussing. Mobile telephone 2FA is not for you. It's not to help you - it's not for your security. All of that is bullshit - and demonstrably so[1][2]. What is actually happening is that FAANGs, etc., have a brutal, unrelenting spam/scam problem which they have no idea how to solve. Forcing every user to burn a phone number tied to a physical SIM card is their last-ditch attempt to throw enough sand in the gears and stay above water. It sort of works. It's very painful for end users, introduces all kinds of strange inconveniences and probably doesn't stop determined abusers ... but it seems to work better than anything else they've come up with thus far. But make no mistake: It's not for you. It is not for your security or safety. [1] Post-signup challenge to user - help us prove your identity by entering in a phone number you've never shown us before. [2] Interestingly, very high value logins like brokerage and banking typically allow other forms of 2FA that don't involve burning a mobile number because those firms already have many other routes of identification and verification.

orangepurple 4y ago

In this case 2FA is useful if someone sniffs your password (key logger) and uses it later to try and fail to log in without your presence. Many wireless keyboards don't use encrypted comms. Keyboards can be bugged easily. There is tech to observe to thermals of keys after they are pressed from a distance. And listen to key strokes. Or capture wirelessly transmitted keystrokes with a parabolic dish pointed at you from across the street if you are far away and an SDR or ASIC. Or a compact omni antenna in a backpack sitting next to you if you are in a public area. The possibilities are endless!

qwezxcrty 4y ago
I see, maybe it serves as kind of defense in depth. I'll be surprised about most Bluetooth keyboards don't use encryption. And I feel like it's too panorid for me to worry about someone probing to your keyboard with an USRP or a HT-301.
- orangepurple 4y ago
  CVE-2019-13054 CVE-2019-13055 CVE-2018-8117 CVE-2010-1184
  - pabs3 4y ago
    These are all CVEs of security issues in the proprietary firmware of wireless input devices, that lead to either eavesdropping or input injection or both.

batch12 4y ago

> I'll not stupid enough to give the passwords away easily? Don't underestimate a determined adversary. Secondly, look for single points of failure and eliminate them as best you can. If someone gains access to your email, could they perform password resets?

aendruk 4y ago

> stupid Phishing victims are not categorically stupid.

rsync 4y ago

"Sorry if I'm a security noob but I have a genuine question. Why at the beginning I need to use 2FA if I can remember secure enough passwords (or use password managers) and I'll not stupid enough to give the passwords away easily?" Glad you asked ... ... and your comments children are not just wrong, but completely misunderstand the ecosystem they are discussing. Mobile telephone 2FA is not for you. It's not to help you - it's not for your security. All of that is bullshit - and demonstrably so[1][2]. What is actually happening is that FAANGs, etc., have a brutal, unrelenting spam/scam problem which they have no idea how to solve. Forcing every user to burn a phone number tied to a physical SIM card is their last-ditch attempt to throw enough sand in the gears and stay above water. It sort of works. It's very painful for end users, introduces all kinds of strange inconveniences and probably doesn't stop determined abusers ... but it seems to work better than anything else they've come up with thus far. But make no mistake: It's not for you. It is not for your security or safety. [1] Post-signup challenge to user - help us prove your identity by entering in a phone number you've never shown us before. [2] Interestingly, very high value logins like brokerage and banking typically allow other forms of 2FA that don't involve burning a mobile number because those firms already have many other routes of identification and verification.