8 ms·

That's not really true. It would be if it was done right, but most companies have some way of getting around it. I lost my yubikey I used for my AWS account (I

That's not really true. It would be if it was done right, but most companies have some way of getting around it. I lost my yubikey I used for my AWS account (I know, I should have two but I really did not have anything worthwhile on this account). I also changed phone numbers in the meantime as well as email. And then proceeded to forget my root password. I have not used the account for a number of years and it really did not sink in until I needed it. See? You would think I was totally and utterly fucked. Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back.

elif 4y ago
This is my biggest fear. Even if I use 2FA completely safely, using a physical chip, for 10/10 sites I care about, someone could spoof my phone number, call tech support with the right attitude, and remove my 2FA. I'm so over the phone system and the credit card system. We have superiors but we are stuck in the past culturally.
- Xylakant 4y ago
  Good providers have a deliberately slow and onerous process in place - send proof of identity, multiple notices to the account owner, sometimes even documents mailed to a physical address. It needs to be possible to recover high value accounts - what else would you propose as a better solution?
  - twawaaay 4y ago
    Yeah, that's exactly the point. If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account will get notified and have time to react before the attacker gets access to the account. Also, the commenters are completely wrong on that it is enough to have the email or ID to get through the process. The AWS people who contacted me required a lot more information that only the owner of the account would know.
tjoff 4y ago
> Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back. And the point of 2FA in the first place is thought by many to prevent social engineering. All you needed was an id photo and be able to talk on the phone? That and account history etc. will probably be in many peoples email. Thus access to the email only would allow you to get access to 2FA services too.
mibollma 4y ago
For me that was a reason to 'only' use a static 50 char password on my yubikey thats combined with a short password I can remember as a kind of simple 2FA. Just feels safer to me to have a printed backup of both stored away in case the tech breaks or gets lost.
beaviskhan 4y ago
You can't have multiple yubikeys associated with your AWS account! And you can't have a yubikey as primary and a software authenticator as a backup, for example. It's a huge hole in their operation imo. Even comparatively unimportant apps such as Facebook allow you to associate as many hardware tokens as you like, fallback to authenticator or SMS, etc.
- tjoff 4y ago
  Yeah the whole setup is completely broken, which forces them to build backdoors for when it breaks which completely defeats the purpose of 2FA to begin with.
  - twawaaay 4y ago
    No, it is not broken. You just make cloned yubikeys. You can't read data from the key, but you can initialise it with your own data and you can initialise more than one with the same payload.
    - tjoff 4y ago
      And how do you do that with U2F?
- twawaaay 4y ago
  You can. You make clones.
cnity 4y ago
> a procedure that took some 3 days and numerous phone calls, id photos, etc. But... We're disagreeing over semantics then. I'd call this "being locked out of my account semi-permanently". I have to say I don't fully understand your perspective. In a sibling comment you admit that free customers ought to be subject to this misery because they are using the service for free, and here you suggest that requiring numerous phone calls and numerous days of non-access to services is not an inconvenience. I suspect we simply have different life priorities. For me, those three days could be critical in my relationships with customers, clients, employers, etc.
- twawaaay 4y ago
  It is inconvenience, but necessary one. Would you like your bank to make it convenient for you to get your money if you forgot your ID? It is double edged sword -- convenient for you is also convenient for somebody who might want to steal your money. So no, I do not object to AWS doing due diligence when I recover my password because I know this hopefully makes me a bit more secure from somebody else doing the same.
jrochkind1 4y ago
On the other hand, a family member set up facebook with 2FA, but using a TOTP built into facebook (is this really a thing? It seems to be) -- such that when he switched computers and facebook decided he needed to re-auth, he couldn't get to the TOTP anymore. If this doesn't make any sense, it probably is because I have the details quite right, but the end result is I was unable to help him make any more sense of this, and there appears to be literally no way to regain access to his facebook account.
- dylan604 4y ago
  >and there appears to be literally no way to regain access to his facebook account. a blessing in disguise perhaps?
selfmodruntime 4y ago
> I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back One could argue that your accounts were never secured to begin with.

elif 4y ago

This is my biggest fear. Even if I use 2FA completely safely, using a physical chip, for 10/10 sites I care about, someone could spoof my phone number, call tech support with the right attitude, and remove my 2FA. I'm so over the phone system and the credit card system. We have superiors but we are stuck in the past culturally.

Xylakant 4y ago
Good providers have a deliberately slow and onerous process in place - send proof of identity, multiple notices to the account owner, sometimes even documents mailed to a physical address. It needs to be possible to recover high value accounts - what else would you propose as a better solution?
- twawaaay 4y ago
  Yeah, that's exactly the point. If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account will get notified and have time to react before the attacker gets access to the account. Also, the commenters are completely wrong on that it is enough to have the email or ID to get through the process. The AWS people who contacted me required a lot more information that only the owner of the account would know.

tjoff 4y ago

> Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back. And the point of 2FA in the first place is thought by many to prevent social engineering. All you needed was an id photo and be able to talk on the phone? That and account history etc. will probably be in many peoples email. Thus access to the email only would allow you to get access to 2FA services too.

mibollma 4y ago

For me that was a reason to 'only' use a static 50 char password on my yubikey thats combined with a short password I can remember as a kind of simple 2FA. Just feels safer to me to have a printed backup of both stored away in case the tech breaks or gets lost.

beaviskhan 4y ago

You can't have multiple yubikeys associated with your AWS account! And you can't have a yubikey as primary and a software authenticator as a backup, for example. It's a huge hole in their operation imo. Even comparatively unimportant apps such as Facebook allow you to associate as many hardware tokens as you like, fallback to authenticator or SMS, etc.

tjoff 4y ago
Yeah the whole setup is completely broken, which forces them to build backdoors for when it breaks which completely defeats the purpose of 2FA to begin with.
- twawaaay 4y ago
  No, it is not broken. You just make cloned yubikeys. You can't read data from the key, but you can initialise it with your own data and you can initialise more than one with the same payload.
  - tjoff 4y ago
    And how do you do that with U2F?
twawaaay 4y ago
You can. You make clones.

cnity 4y ago

> a procedure that took some 3 days and numerous phone calls, id photos, etc. But... We're disagreeing over semantics then. I'd call this "being locked out of my account semi-permanently". I have to say I don't fully understand your perspective. In a sibling comment you admit that free customers ought to be subject to this misery because they are using the service for free, and here you suggest that requiring numerous phone calls and numerous days of non-access to services is not an inconvenience. I suspect we simply have different life priorities. For me, those three days could be critical in my relationships with customers, clients, employers, etc.

twawaaay 4y ago
It is inconvenience, but necessary one. Would you like your bank to make it convenient for you to get your money if you forgot your ID? It is double edged sword -- convenient for you is also convenient for somebody who might want to steal your money. So no, I do not object to AWS doing due diligence when I recover my password because I know this hopefully makes me a bit more secure from somebody else doing the same.

jrochkind1 4y ago

On the other hand, a family member set up facebook with 2FA, but using a TOTP built into facebook (is this really a thing? It seems to be) -- such that when he switched computers and facebook decided he needed to re-auth, he couldn't get to the TOTP anymore. If this doesn't make any sense, it probably is because I have the details quite right, but the end result is I was unable to help him make any more sense of this, and there appears to be literally no way to regain access to his facebook account.

dylan604 4y ago
>and there appears to be literally no way to regain access to his facebook account. a blessing in disguise perhaps?

selfmodruntime 4y ago

> I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back One could argue that your accounts were never secured to begin with.