4 ms·

Assuming that Booking.com is telling the truth, i.e. only a number of property owners has been compromised, how come 2FA is still not mandatory for property own

Assuming that Booking.com is telling the truth, i.e. only a number of property owners has been compromised, how come 2FA is still not mandatory for property owners? How come their (optional) 2FA only offers SMS, which is known to be insecure, even though FIDO2/WebAuthn/TOTP has been a thing for years?

mschuster91 4y ago
> even though FIDO2/WebAuthn/TOTP has been a thing for years? The problem is, as always, users. When the EU recently adopted PSD2, banks were forced to implement 2FA for online banking... and there was a ton of backlash. Anything more complex than "enter one-time code from SMS/e-mail" will lead to a lot of customer support issues. With SMS based 2FA, you as a service provider only have to deal with people who lost/damaged their phones and need access while they get their new phone set up or with 2FA token messages being stuck in spam filters. With anything else, you as a service provider will have a lot more scenarios to cover in support: people unable to set up TOTP apps, people travelling who need access but forgot their Yubikey, an employee took their yubikey home to work from there and fell sick but now no one can log in any more from the office (because the yubikey is with the sick employee), the yubikey got damaged, the computer is in service so no webauthn possible, the users originally had an iPhone compatible Yubikey but now have an Android device or vice versa and now need new keys... and you will have scammers acting like one of the aforementioned scenarios has just happened. Oh, and at least TOTP usually has some sort of backup codes, but people regularly lose the files or, in very random edge cases, a regular TOTP code is the same as a recovery code so the system strikes the recovery code as having been used and people get confused as a result... The easiest of the bunch is TOTP because the setup code can be backed up, but not all employees want to add corporate credentials on a personal phone, and because it's completely stateless (similar to classic JWT bearer tokens) it's impossible to keep track of the 2FA credentials and who has them, meaning a ton of work when employees depart. Hell even the really large players don't get 2FA right. The best example is Amazon AWS: as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your yubikey and you're at the mercy of AWS support. Identity and access management is insanely hard. That, however, doesn't mean booking.com isn't a shitshow in itself. I have an account with them that should have everything saved - my name, address, credit card information and the name of my s/o - and yet, for every booking I place I have to enter all the information from scratch. How they haven't managed to implement that in years is inexcusable.
- pancrufty 4y ago
  > for every booking I place I have to enter all the information from scratch. Sounds like an issue with you or your account. I never have to enter my information and bookings go usually pretty smoothly if you ignore the dozens of dark patterns. I just tried and it takes about 7 taps from list until Pay button (my CC is saved) on my iPhone app. Technically I didn’t even have to scroll.
- Hackbraten 4y ago
  Good points. > as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your yubikey and you're at the mercy of AWS support. As a fallback for my spare Yubikeys, I have created a couple of dummy, web-only IAM users with root privileges. Still an embarrassing UX failure on AWS’s side though.
  - mschuster91 4y ago
    The worst thing IMO is that the AWS API and the UI seems to be already designed with multiple 2FA devices in mind. I have absolutely zero idea what took them over the last years from implementing this absolutely basic feature.
  - nucleardog 4y ago
    For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. Last I checked (and by that I mean found out the hard way) there are still places across AWS that you can lock everyone but root out of. Particularly it seems around a few of the places where you're configuring policies on specific resources rather than through IAM. We ended up setting a policy on an S3 bucket that locked everyone out. The root account _always_ has permissions to edit/remove that policy, but the policy itself prevented the admin accounts from removing it.
    - Hackbraten 4y ago
      > For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. You’re correct, those have the AdministratorAccess policy, not root. It’s been a while since I set those up. For practical purposes, wouldn’t AdministratorAccess be sufficient to recover from a lost (root user’s) YubiKey?
em500 4y ago
I don’t know the particulars of Booking.com, but I can tell you that a very large part of property owners are small scale, largely tech-illiterate (and sometimes close to natural language illiterate) and would only recognize SMS from those abbreviations you just threw out. These are people who barely have enough time with managing the physical and admin parts of the business (dealing with staff, guest requests, repairs, cleaning, accounting and taxes, etc). Same as most other small and medium businesses that don’t specialize in tech.
- maccard 4y ago
  > would only recognize SMS from those abbreviations you just threw out. I think this is even a stretch. They likely don't know the difference between SMS and whatsapp/iMessage, it's all just a "message" or a "text".
- Hackbraten 4y ago
  Guests are trusting property owners with their personal data. If these people are ignoring the risk entirely or willingly shifting the fallout onto their guests – because the owners are so busy and no one penalizes them for data breaches anyway! – then maybe it’s time that someone starts doing just that.

mschuster91 4y ago

> even though FIDO2/WebAuthn/TOTP has been a thing for years? The problem is, as always, users. When the EU recently adopted PSD2, banks were forced to implement 2FA for online banking... and there was a ton of backlash. Anything more complex than "enter one-time code from SMS/e-mail" will lead to a lot of customer support issues. With SMS based 2FA, you as a service provider only have to deal with people who lost/damaged their phones and need access while they get their new phone set up or with 2FA token messages being stuck in spam filters. With anything else, you as a service provider will have a lot more scenarios to cover in support: people unable to set up TOTP apps, people travelling who need access but forgot their Yubikey, an employee took their yubikey home to work from there and fell sick but now no one can log in any more from the office (because the yubikey is with the sick employee), the yubikey got damaged, the computer is in service so no webauthn possible, the users originally had an iPhone compatible Yubikey but now have an Android device or vice versa and now need new keys... and you will have scammers acting like one of the aforementioned scenarios has just happened. Oh, and at least TOTP usually has some sort of backup codes, but people regularly lose the files or, in very random edge cases, a regular TOTP code is the same as a recovery code so the system strikes the recovery code as having been used and people get confused as a result... The easiest of the bunch is TOTP because the setup code can be backed up, but not all employees want to add corporate credentials on a personal phone, and because it's completely stateless (similar to classic JWT bearer tokens) it's impossible to keep track of the 2FA credentials and who has them, meaning a ton of work when employees depart. Hell even the really large players don't get 2FA right. The best example is Amazon AWS: as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your yubikey and you're at the mercy of AWS support. Identity and access management is insanely hard. That, however, doesn't mean booking.com isn't a shitshow in itself. I have an account with them that should have everything saved - my name, address, credit card information and the name of my s/o - and yet, for every booking I place I have to enter all the information from scratch. How they haven't managed to implement that in years is inexcusable.

pancrufty 4y ago
> for every booking I place I have to enter all the information from scratch. Sounds like an issue with you or your account. I never have to enter my information and bookings go usually pretty smoothly if you ignore the dozens of dark patterns. I just tried and it takes about 7 taps from list until Pay button (my CC is saved) on my iPhone app. Technically I didn’t even have to scroll.
Hackbraten 4y ago
Good points. > as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your yubikey and you're at the mercy of AWS support. As a fallback for my spare Yubikeys, I have created a couple of dummy, web-only IAM users with root privileges. Still an embarrassing UX failure on AWS’s side though.
- mschuster91 4y ago
  The worst thing IMO is that the AWS API and the UI seems to be already designed with multiple 2FA devices in mind. I have absolutely zero idea what took them over the last years from implementing this absolutely basic feature.
- nucleardog 4y ago
  For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. Last I checked (and by that I mean found out the hard way) there are still places across AWS that you can lock everyone but root out of. Particularly it seems around a few of the places where you're configuring policies on specific resources rather than through IAM. We ended up setting a policy on an S3 bucket that locked everyone out. The root account _always_ has permissions to edit/remove that policy, but the policy itself prevented the admin accounts from removing it.
  - Hackbraten 4y ago
    > For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. You’re correct, those have the AdministratorAccess policy, not root. It’s been a while since I set those up. For practical purposes, wouldn’t AdministratorAccess be sufficient to recover from a lost (root user’s) YubiKey?

em500 4y ago

I don’t know the particulars of Booking.com, but I can tell you that a very large part of property owners are small scale, largely tech-illiterate (and sometimes close to natural language illiterate) and would only recognize SMS from those abbreviations you just threw out. These are people who barely have enough time with managing the physical and admin parts of the business (dealing with staff, guest requests, repairs, cleaning, accounting and taxes, etc). Same as most other small and medium businesses that don’t specialize in tech.

maccard 4y ago
> would only recognize SMS from those abbreviations you just threw out. I think this is even a stretch. They likely don't know the difference between SMS and whatsapp/iMessage, it's all just a "message" or a "text".
Hackbraten 4y ago
Guests are trusting property owners with their personal data. If these people are ignoring the risk entirely or willingly shifting the fallout onto their guests – because the owners are so busy and no one penalizes them for data breaches anyway! – then maybe it’s time that someone starts doing just that.