6 ms·

It is inferior to multi-factor authentication. It sounds fancy but you are removing a layer of security for no reason other than it's trendy and hyped up! Good

by _8j50 4y ago

It is inferior to multi-factor authentication. It sounds fancy but you are removing a layer of security for no reason other than it's trendy and hyped up! Good security is application of layers of defenses in a disciplined and consistent way. I should not be able to steal a yubikey or find one flaw in your passwordless credential reset method or abuse the next and greatest phishing method like in-browser vnc with webusb and that's all I need to take over an account. Let me clarify: the problem is removal of "what you know" as a layer of defense and a factor of authentication. I don't care if it is a password, passphrase, pin, puzzle, picture or whatever, without it having only one factor of authentication is remarkably inferior to MFA. And this is detrimental to 10-15+ years of security culture improvements all because vendors and clueless c-suite execs prefer to follow trends instead of listening to actual security professionals.

1101010010 4y ago
Passwordless authentication means removing the most critical failure factor from authentication: the human. > I should not be able to steal a yubikey This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions. When there is no credential to phish because it's a hardware-backed cryptographic assertion, security is drastically improved. WebAuthN literally provides credential phishing immunity, which is by far the most prevalent source of account compromise today (see: annual Verizon threat report). It is so superior, I would even go so far as to share my password to, say, my Google account provided it is protected exclusively with a hardware authentication factor.
- _8j50 4y ago
  > Passwordless authentication means removing the most critical failure factor from authentication: the human. Yes it is but you are removing a layer of defense not a link in a chain. You think this is better based on a fundamentally flawed understanding of defensive security. > This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions Of course the threat landscape never changes right? And the process you have to issue new yubikeys is flawless too right? And threat actors never adapt right? WebUSB and in browser vnc can't possibly be abused? So many things can go wrong. Look, here is the fundamental thing you people that jump on these hype trains don't understand about security: it is that after half a century, what we've learned is that it is a cat and mouse game and there are no long lasting silver bullets and even if there were, you still do security in layers because mistakes happen and you could screw up something that makes your silver bullet ineffective. So you add multiple layers of preventive and detection focused security. You don't remove an entire layer of security and somehow twist that to sound like you improved something. It's legitimately fraudulent and harmful.
  - 1101010010 4y ago
    Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator. As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot. Hardware assertions, on the other hand, which in WebAuthN standards are also bound to domain origins, simply remove this risk entirely. Let me repeat: you cannot phish a WebAuthN assertion. Yes, you can pull off a physical attack, but at this point of the game, it is over because the adversary could just implant a bootkit, keylogger or backdoor on your valuable system. The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost - the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations").
    - _8j50 4y ago
      > Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator. Again, you are avoiding my argument. Passwords, even pin codes have been a meaningful layer of defense for half a century. You can argue that they are weaker and propose stronger methods such as paddhphrases but you arr arguing against passwords when your real argument is against "what you know" as a factor of authentication. > As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot. Are you a middle manager or executive by chance? Because I respond to incidents as a matter of routine and I very much know how much passwords get phished or cracked. You know what solved the problem: adding even the weakest layer of authentication like SMS. Now, there are many better altetnatives for a second factor of auth other than SMS as there are for passwords as what you know being a factor and I am open to that discussion. But what you are saying is you don't get why a weak layer of defense is needed so you want to get rid of it. > The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost Again, it's not a chain. Your mindset is a flawed way of thinking carried over from physical security (think "cyber killchain), which is perimeter focused, that's where the chain analogy comes from. Modern security, having learned from the past few decades is such that you have many layers of chains. The user's knowledge, as weak as it is, is one such layer. Removing it plain and simple is a reduction in your security posture. See, the critical thing you need to get is the relationship between layers od chains as opposed to links in a chain is complementary not symbiotic. Persistent threat actors will get past any layer of defense. If ransoming your company gets me a few million dollars, as a criminal there is not a whole lot I wouldn't do including physical attacks (there are even untargeted campaigns where threat actors drop or mail USB drives en masse). > the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations"). Great, guess what that means? They spent all that time and effort to get past a password and now they face a yubikey. The difference in cost to threat actors is at least geometric. They can't just steal a yubikey or compromise your phone, now they also have to steal or guess your password. By removing user knowledge as a factor, you are making it orders of magnitude cheaper for a threat actor. And you think that is fine because the latest and shiniest methods of authentication, unlike past solutions will never ever be defeated and you will never face insider threats or threat actors willing to spend more to profit off of you.
flangola7 4y ago
Most passwordless setups require at least 2FA. Using it to login demonstrates both something you have (the authentication key on device) and something you know/something you are (PIN or biometrics used to unlock the authentication key).
- _8j50 4y ago
  Not from what I have seen. For example phone-app based auth has your phone as both what you have and the code you enter or button you press as another factor but in reality that is just one phone. I have seen a place where you can take over the org if you steal one guy's yubikey. Windows hello has a pin for what you know but then it authenticates the device with TPM instead of you separately as a user. But at least windows hello requires you to remember a pin other methods have secrets generated on the fly which I am certain are phishable or just use what you have alone as a factor of auth. I mean, at least have users define a multi word passphrase with no complexity condition or expiry.
  - flangola7 4y ago
    Try this demo: https://www.passkeys.io/ https://www.passkeys.io/
    - _8j50 4y ago
      Not able to. Touch/faceids are another class of bad security design.

by _8j50 4y ago

1101010010 4y ago

Passwordless authentication means removing the most critical failure factor from authentication: the human. > I should not be able to steal a yubikey This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions. When there is no credential to phish because it's a hardware-backed cryptographic assertion, security is drastically improved. WebAuthN literally provides credential phishing immunity, which is by far the most prevalent source of account compromise today (see: annual Verizon threat report). It is so superior, I would even go so far as to share my password to, say, my Google account provided it is protected exclusively with a hardware authentication factor.

_8j50 4y ago
> Passwordless authentication means removing the most critical failure factor from authentication: the human. Yes it is but you are removing a layer of defense not a link in a chain. You think this is better based on a fundamentally flawed understanding of defensive security. > This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions Of course the threat landscape never changes right? And the process you have to issue new yubikeys is flawless too right? And threat actors never adapt right? WebUSB and in browser vnc can't possibly be abused? So many things can go wrong. Look, here is the fundamental thing you people that jump on these hype trains don't understand about security: it is that after half a century, what we've learned is that it is a cat and mouse game and there are no long lasting silver bullets and even if there were, you still do security in layers because mistakes happen and you could screw up something that makes your silver bullet ineffective. So you add multiple layers of preventive and detection focused security. You don't remove an entire layer of security and somehow twist that to sound like you improved something. It's legitimately fraudulent and harmful.
- 1101010010 4y ago
  Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator. As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot. Hardware assertions, on the other hand, which in WebAuthN standards are also bound to domain origins, simply remove this risk entirely. Let me repeat: you cannot phish a WebAuthN assertion. Yes, you can pull off a physical attack, but at this point of the game, it is over because the adversary could just implant a bootkit, keylogger or backdoor on your valuable system. The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost - the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations").
  - _8j50 4y ago
    > Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator. Again, you are avoiding my argument. Passwords, even pin codes have been a meaningful layer of defense for half a century. You can argue that they are weaker and propose stronger methods such as paddhphrases but you arr arguing against passwords when your real argument is against "what you know" as a factor of authentication. > As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot. Are you a middle manager or executive by chance? Because I respond to incidents as a matter of routine and I very much know how much passwords get phished or cracked. You know what solved the problem: adding even the weakest layer of authentication like SMS. Now, there are many better altetnatives for a second factor of auth other than SMS as there are for passwords as what you know being a factor and I am open to that discussion. But what you are saying is you don't get why a weak layer of defense is needed so you want to get rid of it. > The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost Again, it's not a chain. Your mindset is a flawed way of thinking carried over from physical security (think "cyber killchain), which is perimeter focused, that's where the chain analogy comes from. Modern security, having learned from the past few decades is such that you have many layers of chains. The user's knowledge, as weak as it is, is one such layer. Removing it plain and simple is a reduction in your security posture. See, the critical thing you need to get is the relationship between layers od chains as opposed to links in a chain is complementary not symbiotic. Persistent threat actors will get past any layer of defense. If ransoming your company gets me a few million dollars, as a criminal there is not a whole lot I wouldn't do including physical attacks (there are even untargeted campaigns where threat actors drop or mail USB drives en masse). > the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations"). Great, guess what that means? They spent all that time and effort to get past a password and now they face a yubikey. The difference in cost to threat actors is at least geometric. They can't just steal a yubikey or compromise your phone, now they also have to steal or guess your password. By removing user knowledge as a factor, you are making it orders of magnitude cheaper for a threat actor. And you think that is fine because the latest and shiniest methods of authentication, unlike past solutions will never ever be defeated and you will never face insider threats or threat actors willing to spend more to profit off of you.

flangola7 4y ago

Most passwordless setups require at least 2FA. Using it to login demonstrates both something you have (the authentication key on device) and something you know/something you are (PIN or biometrics used to unlock the authentication key).

_8j50 4y ago
Not from what I have seen. For example phone-app based auth has your phone as both what you have and the code you enter or button you press as another factor but in reality that is just one phone. I have seen a place where you can take over the org if you steal one guy's yubikey. Windows hello has a pin for what you know but then it authenticates the device with TPM instead of you separately as a user. But at least windows hello requires you to remember a pin other methods have secrets generated on the fly which I am certain are phishable or just use what you have alone as a factor of auth. I mean, at least have users define a multi word passphrase with no complexity condition or expiry.
- flangola7 4y ago
  Try this demo: https://www.passkeys.io/ https://www.passkeys.io/
  - _8j50 4y ago
    Not able to. Touch/faceids are another class of bad security design.