5 ms·

I do not want anything to do with this, but I imagine I'm about to be railroaded into it anyway. It's bad enough that so many web sites are starting to assume

I do not want anything to do with this, but I imagine I'm about to be railroaded into it anyway. It's bad enough that so many web sites are starting to assume I must have my phone handy and I must have cell service where I'm sitting. I didn't want to give them my phone number in the first place but now they're SMSing me before letting me in, and if I happen to be out in the boonies, unable to receive their six-digit code... they don't have a solution for that.

ehutch79 4y ago
No one thinks SMS is a good idea. That's why most competent places are pushing time based one time passwords, or some kind of cert based push method.
- ThunderSizzle 4y ago
  Which also assumes I have a particular device or service open. My randomly generated offline passwords should be sufficient security.
  - hiccuphippo 4y ago
    I made a simple TOTP client in python so the device they assume I have is the same device from which I intent to log in. Sadly I can't do that for services.
  - tracker1 4y ago
    Other than really obscure options, OTP is pretty much available anywhere/everywhere in terms of device support.
  - mmh0000 4y ago
    If you want the quickest and dirtiest solution to your problem, then oathtool is for you: $ oathtool --totp -b "S3GXITTAZXNN4LCPXWQREDYBIE" 646063 Otherwise, most password managers, i.e. Bitwarden, have integrated TOTP support.
    - mooreds 4y ago
      Do you store the secret in your password manager? When a password manager has both the password and the secret for TOTP, that always seemed like it degraded the concept of multi-factor authentication to me.
      - secabeen 4y ago
        Personally, I don't, I explicitly and intentionally keep my Email, Password Manager and 2FA providers all distinct and separate. (This was very useful for extracting the TOTP secret out of the Symantec VIP 2FA system: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess) At work, we do for non-person accounts. It's non-ideal, but I don't want to manage two separate systems for storing that data and trying to keep them in sync. The password vault system itself has a hard requirement for 2FA to download the vault.
      - mmh0000 4y ago
        Convenience and security are constantly at war with each other. I've decided that, for me, the risk of someone obtaining access to my password manager is very low. I've been using password managers since ~2000, randomly generated passwords; I've never had an account compromised. There's enough other sensitive information in my password manager that if someone did obtain access to it, I'd be fucked anyway, to the point that someone getting my TOTP secrets would be minor.
    - marssaxman 4y ago
      That looks promising! Thank you for the reference.
- peoplefromibiza 4y ago
  physical keys, the equivalent of passwords, have been working for millenia and will keep working in the future, despite their limits, which present a good trade off generally speaking. everything biometric is scary as hell, I can't change my fingerprints. everything involving cryptographic keys has the same problem: if someone get ahold of my keys, I'm f*cked. if I need a device to be close to me, the solution is not as bullet proof as they make it sound. we all know nobody ever loses their devices or forgets them on the train, they never get stolen, they never break or suddenly stop working. They also admit that Passkeys aren’t reused across sites like passwords often are, so stolen credentials do less damage or It sounds simple enough, but in my experience, I’ve found that the process can be confusing. When I attempted to test it by creating a Kayak account, I repeatedly got stuck waiting for a verification email that never showed up. Eventually, I managed to log in, and the passkey worked seamlessly on an iPhone. But when I tried to create a passkey on my Mac, I was locked in a loop where the site repeatedly asked me to enter my email address; I soon realized that I had to select the option to scan a QR code with my phone because my Mac mini doesn’t have Face ID or Touch ID, and I needed to authenticate on a device that does. At no point in the login process was that made clear. so, yeah, thanks, no thanks.
  - ehutch79 4y ago
    Passkeys absolutely do not need an email.
- afiori 4y ago
  recently I found myself in an interesting conundrum; I was for a time near a timezone boundary and so I had my phone's "sync clock to network clock" disabled. At a certain point I discovered that some of my OTP apps stopped working which I blame on my phone's clock drifting by almost 2 minutes.
- hansvm 4y ago
  Agreed. I just wish literally any bank or 401k provider or other mainstream financial institution were competent.
latexr 4y ago
> if I happen to be out in the boonies, unable to receive their six-digit code... they don't have a solution for that. Typically, when you turn on 2FA on a service they give you a handful of one-time codes exactly for situations like that.
- rhn_mk1 4y ago
  Your typical experience doesn't match my typical experience.
  - latexr 4y ago
    Fair enough. There is a solution to your problem, but if websites don’t implement it then it’s the same as no solution. Do double-check if the services you most depend on have added the feature since, though, as you may able to get the codes now.
    - rhn_mk1 4y ago
      I just opt to use another service when it happens, but that stream is drying out.
mooreds 4y ago
Hmmm. I haven't seen any hard numbers on this, but I can only think of a few sites that made me turn on MFA, and they were financial in nature. Many many sites encourage MFA, but I haven't run across too many that require it. Can you share any details about the sites?
- hendersoon 4y ago
  It's becoming increasingly common for sites to not offer password authentication at all. Instead they send you a SMS text or email with an auto-login link. I hate this so, so much.
  - gardenfelder 4y ago
    Why?
    - illiac786 4y ago
      It’s slows your login significantly, it’s cumbersome. The more often you have to do it, the more infuriating it becomes. Disclaimer: I hate this as well.
    - chrisandchris 4y ago
      Because SMS may not arrive. E-Mails may be delayed or blocked by spam filters. You may not have e-mail set up on the device you're trying to log in from - so what will you do with a link on another device? Meanwhile, a password is something you already have at hand and works instantly. Recently tried 3 weeks to setup Slack because it's magic mail did not arrive. Was even unable to reset the password. We just gave up and used another e-mail service provider and created a ned account.
  - mooreds 4y ago
    I dislike that intensely as well. I don't have any trouble with sites offering magic link login, but to have that be the only option seems short sighted to me. I worked at a company once that only offered federated login. It was a dev tool, so they offered login with google or github. I disliked it, because, hey, maybe I don't want to link random devtool with the core accounts I use. I'm not aware of any research that shows what the conversion rate is for each type of login: * username/password * magic link * federation (login with google, etc) But I'd sure love to see it. I imagine it would also vary by application type (devtools would be skewed towards username/password, consumer towards federated login or magic link) as well.
jsmith45 4y ago
Passkeys are just using WebAuthn as the primary authentication method. WebAuthn works by users having a separate private key for each site, with the sites storing a copy of the public key, and sign-in works conceptually by the site generating a nonce, which must be signed by the private key, with the signature presented back to the site who can verify it against the public key. The problem though is that WebAuthn is most convenient when using the platform authenticator (so you don't need to plug in a U2F style dongle). But conceptually the platform authenticator is tied to a single device. (Because the private keys are supposed to be stored within a TPM or secure element of some form). But that means if you lose/damage the device you are locked out. Obviously one option is to have a lockout flow that asks security questions, or sends an email or something, but obviously those are not nearly as secure as private key stored on a device you need to physically possess. Plus generally you need to authenticate to the device too, with biometrics, or pin, or something, before WebAuthn flow can proceed, making these flows inherently two factor (something you have, plus either who you are for biometrics, or something you know for pins). The original solution for this was to always register a roaming key (like the U2F style dongle), as a backup, and as a method to initially sign in on a new device (aftwe which you could enroll the platform authenticator). But nobody does that, so instead most platforms are also storing a copy of these passkeys in their associated clouds, meaning that if you lose your device, you can get a new one of the same type, sign in it the Microsoft/Google/Apple account, and you can now sign into sites that use WebAuthn as sole authentication again. But this only helps when moving between devices in the same ecosystem, what if you only have an account on your iPhone, and want to sign in on a Windows PC? The new idea is to allow this via scanning a QR code, and verifying that the two devices are physically near each other (verified via bluetooth low energy). (So this will work for laptops, but not all desktops have bluetooth). Obviously once you sign in like this once, you could then add the new devices platform authenticator as a sign in method, so you don't need to do this every time. This cross-device QR sign-in approach is being standardized via FIDO, although as far as I can tell there is no published specification right now. Draft versions of FIDO specifications are not publicly available, with the exception of the WebAuthn spec, since that is developed jointly with W3C, under the W3C process. But most of this would be on the CTAP side of FIDO2, which is a pure FIDO developed specification, so the only way to see the current draft specification would be to become a FIDO member.

ehutch79 4y ago

No one thinks SMS is a good idea. That's why most competent places are pushing time based one time passwords, or some kind of cert based push method.

ThunderSizzle 4y ago
Which also assumes I have a particular device or service open. My randomly generated offline passwords should be sufficient security.
- hiccuphippo 4y ago
  I made a simple TOTP client in python so the device they assume I have is the same device from which I intent to log in. Sadly I can't do that for services.
- tracker1 4y ago
  Other than really obscure options, OTP is pretty much available anywhere/everywhere in terms of device support.
- mmh0000 4y ago
  If you want the quickest and dirtiest solution to your problem, then oathtool is for you: $ oathtool --totp -b "S3GXITTAZXNN4LCPXWQREDYBIE" 646063 Otherwise, most password managers, i.e. Bitwarden, have integrated TOTP support.
  - mooreds 4y ago
    Do you store the secret in your password manager? When a password manager has both the password and the secret for TOTP, that always seemed like it degraded the concept of multi-factor authentication to me.
    - secabeen 4y ago
      Personally, I don't, I explicitly and intentionally keep my Email, Password Manager and 2FA providers all distinct and separate. (This was very useful for extracting the TOTP secret out of the Symantec VIP 2FA system: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess) At work, we do for non-person accounts. It's non-ideal, but I don't want to manage two separate systems for storing that data and trying to keep them in sync. The password vault system itself has a hard requirement for 2FA to download the vault.
    - mmh0000 4y ago
      Convenience and security are constantly at war with each other. I've decided that, for me, the risk of someone obtaining access to my password manager is very low. I've been using password managers since ~2000, randomly generated passwords; I've never had an account compromised. There's enough other sensitive information in my password manager that if someone did obtain access to it, I'd be fucked anyway, to the point that someone getting my TOTP secrets would be minor.
  - marssaxman 4y ago
    That looks promising! Thank you for the reference.
peoplefromibiza 4y ago
physical keys, the equivalent of passwords, have been working for millenia and will keep working in the future, despite their limits, which present a good trade off generally speaking. everything biometric is scary as hell, I can't change my fingerprints. everything involving cryptographic keys has the same problem: if someone get ahold of my keys, I'm f*cked. if I need a device to be close to me, the solution is not as bullet proof as they make it sound. we all know nobody ever loses their devices or forgets them on the train, they never get stolen, they never break or suddenly stop working. They also admit that Passkeys aren’t reused across sites like passwords often are, so stolen credentials do less damage or It sounds simple enough, but in my experience, I’ve found that the process can be confusing. When I attempted to test it by creating a Kayak account, I repeatedly got stuck waiting for a verification email that never showed up. Eventually, I managed to log in, and the passkey worked seamlessly on an iPhone. But when I tried to create a passkey on my Mac, I was locked in a loop where the site repeatedly asked me to enter my email address; I soon realized that I had to select the option to scan a QR code with my phone because my Mac mini doesn’t have Face ID or Touch ID, and I needed to authenticate on a device that does. At no point in the login process was that made clear. so, yeah, thanks, no thanks.
- ehutch79 4y ago
  Passkeys absolutely do not need an email.
afiori 4y ago
recently I found myself in an interesting conundrum; I was for a time near a timezone boundary and so I had my phone's "sync clock to network clock" disabled. At a certain point I discovered that some of my OTP apps stopped working which I blame on my phone's clock drifting by almost 2 minutes.
hansvm 4y ago
Agreed. I just wish literally any bank or 401k provider or other mainstream financial institution were competent.

latexr 4y ago

> if I happen to be out in the boonies, unable to receive their six-digit code... they don't have a solution for that. Typically, when you turn on 2FA on a service they give you a handful of one-time codes exactly for situations like that.

rhn_mk1 4y ago
Your typical experience doesn't match my typical experience.
- latexr 4y ago
  Fair enough. There is a solution to your problem, but if websites don’t implement it then it’s the same as no solution. Do double-check if the services you most depend on have added the feature since, though, as you may able to get the codes now.
  - rhn_mk1 4y ago
    I just opt to use another service when it happens, but that stream is drying out.

mooreds 4y ago

Hmmm. I haven't seen any hard numbers on this, but I can only think of a few sites that made me turn on MFA, and they were financial in nature. Many many sites encourage MFA, but I haven't run across too many that require it. Can you share any details about the sites?

hendersoon 4y ago
It's becoming increasingly common for sites to not offer password authentication at all. Instead they send you a SMS text or email with an auto-login link. I hate this so, so much.
- gardenfelder 4y ago
  Why?
  - illiac786 4y ago
    It’s slows your login significantly, it’s cumbersome. The more often you have to do it, the more infuriating it becomes. Disclaimer: I hate this as well.
  - chrisandchris 4y ago
    Because SMS may not arrive. E-Mails may be delayed or blocked by spam filters. You may not have e-mail set up on the device you're trying to log in from - so what will you do with a link on another device? Meanwhile, a password is something you already have at hand and works instantly. Recently tried 3 weeks to setup Slack because it's magic mail did not arrive. Was even unable to reset the password. We just gave up and used another e-mail service provider and created a ned account.
- mooreds 4y ago
  I dislike that intensely as well. I don't have any trouble with sites offering magic link login, but to have that be the only option seems short sighted to me. I worked at a company once that only offered federated login. It was a dev tool, so they offered login with google or github. I disliked it, because, hey, maybe I don't want to link random devtool with the core accounts I use. I'm not aware of any research that shows what the conversion rate is for each type of login: * username/password * magic link * federation (login with google, etc) But I'd sure love to see it. I imagine it would also vary by application type (devtools would be skewed towards username/password, consumer towards federated login or magic link) as well.

jsmith45 4y ago

Passkeys are just using WebAuthn as the primary authentication method. WebAuthn works by users having a separate private key for each site, with the sites storing a copy of the public key, and sign-in works conceptually by the site generating a nonce, which must be signed by the private key, with the signature presented back to the site who can verify it against the public key. The problem though is that WebAuthn is most convenient when using the platform authenticator (so you don't need to plug in a U2F style dongle). But conceptually the platform authenticator is tied to a single device. (Because the private keys are supposed to be stored within a TPM or secure element of some form). But that means if you lose/damage the device you are locked out. Obviously one option is to have a lockout flow that asks security questions, or sends an email or something, but obviously those are not nearly as secure as private key stored on a device you need to physically possess. Plus generally you need to authenticate to the device too, with biometrics, or pin, or something, before WebAuthn flow can proceed, making these flows inherently two factor (something you have, plus either who you are for biometrics, or something you know for pins). The original solution for this was to always register a roaming key (like the U2F style dongle), as a backup, and as a method to initially sign in on a new device (aftwe which you could enroll the platform authenticator). But nobody does that, so instead most platforms are also storing a copy of these passkeys in their associated clouds, meaning that if you lose your device, you can get a new one of the same type, sign in it the Microsoft/Google/Apple account, and you can now sign into sites that use WebAuthn as sole authentication again. But this only helps when moving between devices in the same ecosystem, what if you only have an account on your iPhone, and want to sign in on a Windows PC? The new idea is to allow this via scanning a QR code, and verifying that the two devices are physically near each other (verified via bluetooth low energy). (So this will work for laptops, but not all desktops have bluetooth). Obviously once you sign in like this once, you could then add the new devices platform authenticator as a sign in method, so you don't need to do this every time. This cross-device QR sign-in approach is being standardized via FIDO, although as far as I can tell there is no published specification right now. Draft versions of FIDO specifications are not publicly available, with the exception of the WebAuthn spec, since that is developed jointly with W3C, under the W3C process. But most of this would be on the CTAP side of FIDO2, which is a pure FIDO developed specification, so the only way to see the current draft specification would be to become a FIDO member.