8 ms·

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator

by jhgg 4y ago

And this is why we should all adopt webuathn, and get rid of totp based 2fa. This attack vector is significantly harder to pull off if a hardware authenticator will assert that the user is logging into the correct domain.

daneel_w 4y ago
Are you really suggesting that a billion netizens should stop using TOTP on their smartphones and go buy another hardware device?
- 0xCMP 4y ago
  Both latest versions of Android and iOS support passkeys plus support on Chrome/Brave/Edge/Safari. While not as secure or convenient as a security key for initially logging in there is no need for a new device in many cases. besides the fact that the webauthn yubikey is $20 vs $50-70 for it's more popular and well known versions.
xaduha 4y ago
> And this is why we should all adopt webuathn, and get rid of totp based 2fa. I'd be glad to personally, but if a site supports 2fa at all, then it's mostly likely TOTP. And some require TOTP first and allow webauth only in addition to it.
rvz 4y ago
Hilarious to see that even companies like Reddit still do not take security seriously despite being around longer than most internet companies. If this was Meta, or Twitter that got breached via there would be outrage everywhere as to why employees did not use hardware keys.
7ewis 4y ago
Is this similar to how hardware wallets show the true addresses on their displays?
- Avamander 4y ago
  It's very vaguely similar to TLS connections with mutual authentication, you can't normally MITM/proxy it.
- bawolff 4y ago
  Webauth checks the http origin so it only gives the code to the correct website, taking the human out of the decision loop.
Avamander 4y ago
Ideally yes, but let's not let the perfect become the enemy of good. If that's what available right now, it should still be used and recommended.
- rightbyte 4y ago
  In practice in many services 2FA is about hoarding PI to target ads, not improve security. I don't buy into that.
  - layer8 4y ago
    TOTP doesn’t expose PII.
    - rightbyte 4y ago
      Don't you need to send the generator hardware dongle thingy (whatever it is called in English) to the user?
      - layer8 4y ago
        TOTP uses a publicly known algorithm that you can implement yourself. Most people use an app, but that’s not mandatory. No special hardware is required.
ta1243 4y ago
10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished, you have to use 2FA" Average person reluctantly moves to SMS 2 years ago "no in some countries it's easy to take over SMS, use TOTP" Average person reluctantly moves to TOTP Today "no TOTP is rubbish, you can be phished, use this hardware authenticator" Normal people don't like new shiny ways of working every year or so. My house's front door lock is broadly the same interface as my great-grandparent's front door lock, but technologists think changing the way things work every couple of years is acceptable.
- sysihyk 4y ago
  [dead]
- kriops 4y ago
  WebAuthn is an UX improvement as well as a security improvement. I sympathize with your point, but in this case it’s easily sellable as the cure to the rest of your list … unless you somehow lose your key.
  - criley2 4y ago
    Not a UX improvement. Most users need a yubikey for the computer unless they have a new Mac. Asking my 65 year old dad to keep up with a yubikey is not just bad UX, it's failing UX. It simply will not happen. I don't even think it's realistic to get him to use a smartphone for this, he hates the things. WebAuthn works great for your Web 3.0 startup but as soon as you're talking about the average user, who is likely decades older than the commenters here, and far less interested in keeping up with these things, and far less patient with the hassles... asking them to carry hardware is a nonstarter for so many.
    - thatnerdyguy 4y ago
jefftk 4y ago
And if you are stuck using TOTP, you can mitigate with a password manager that fills it for you only when the domain matches.
- cheschire 4y ago
  You know, I used to think the same thing. But then lastpass got hacked and it made me realize password managers have a lot of eggs in those baskets. It might be worth using two separate password managers and keep TOTP in the second one.

by jhgg 4y ago

daneel_w 4y ago

Are you really suggesting that a billion netizens should stop using TOTP on their smartphones and go buy another hardware device?

0xCMP 4y ago
Both latest versions of Android and iOS support passkeys plus support on Chrome/Brave/Edge/Safari. While not as secure or convenient as a security key for initially logging in there is no need for a new device in many cases. besides the fact that the webauthn yubikey is $20 vs $50-70 for it's more popular and well known versions.

xaduha 4y ago

> And this is why we should all adopt webuathn, and get rid of totp based 2fa. I'd be glad to personally, but if a site supports 2fa at all, then it's mostly likely TOTP. And some require TOTP first and allow webauth only in addition to it.

rvz 4y ago

Hilarious to see that even companies like Reddit still do not take security seriously despite being around longer than most internet companies. If this was Meta, or Twitter that got breached via there would be outrage everywhere as to why employees did not use hardware keys.

7ewis 4y ago

Is this similar to how hardware wallets show the true addresses on their displays?

Avamander 4y ago
It's very vaguely similar to TLS connections with mutual authentication, you can't normally MITM/proxy it.
bawolff 4y ago
Webauth checks the http origin so it only gives the code to the correct website, taking the human out of the decision loop.

Avamander 4y ago

Ideally yes, but let's not let the perfect become the enemy of good. If that's what available right now, it should still be used and recommended.

rightbyte 4y ago
In practice in many services 2FA is about hoarding PI to target ads, not improve security. I don't buy into that.
- layer8 4y ago
  TOTP doesn’t expose PII.
  - rightbyte 4y ago
    Don't you need to send the generator hardware dongle thingy (whatever it is called in English) to the user?
    - layer8 4y ago
      TOTP uses a publicly known algorithm that you can implement yourself. Most people use an app, but that’s not mandatory. No special hardware is required.

ta1243 4y ago

10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pass phrase" Average person reluctantly moves from P@55word! to correct-horse-battery-staple 6 years ago "ok but you need to use different passwords on each site" Average person reluctantly moves to different passwords per site 4 years ago "but you can be phished, you have to use 2FA" Average person reluctantly moves to SMS 2 years ago "no in some countries it's easy to take over SMS, use TOTP" Average person reluctantly moves to TOTP Today "no TOTP is rubbish, you can be phished, use this hardware authenticator" Normal people don't like new shiny ways of working every year or so. My house's front door lock is broadly the same interface as my great-grandparent's front door lock, but technologists think changing the way things work every couple of years is acceptable.

sysihyk 4y ago
[dead]
kriops 4y ago
WebAuthn is an UX improvement as well as a security improvement. I sympathize with your point, but in this case it’s easily sellable as the cure to the rest of your list … unless you somehow lose your key.
- criley2 4y ago
  Not a UX improvement. Most users need a yubikey for the computer unless they have a new Mac. Asking my 65 year old dad to keep up with a yubikey is not just bad UX, it's failing UX. It simply will not happen. I don't even think it's realistic to get him to use a smartphone for this, he hates the things. WebAuthn works great for your Web 3.0 startup but as soon as you're talking about the average user, who is likely decades older than the commenters here, and far less interested in keeping up with these things, and far less patient with the hassles... asking them to carry hardware is a nonstarter for so many.
  - thatnerdyguy 4y ago

jefftk 4y ago

And if you are stuck using TOTP, you can mitigate with a password manager that fills it for you only when the domain matches.

cheschire 4y ago
You know, I used to think the same thing. But then lastpass got hacked and it made me realize password managers have a lot of eggs in those baskets. It might be worth using two separate password managers and keep TOTP in the second one.