4 ms·

Authenticator app advertising on App Store sends QR codes to developer

38 points by tech234a 4y ago

littlecranky67 4y ago
It was never a good idea to use an internet-connected device with complex software stacks as the 2nd factor. We should go with Yubikeys & Co.
- franga2000 4y ago
  Until hardware security devices support "identical twins" in some way, they're simply too impractical. For them to be practical for all accounts, not just the most sensitive few, you need to be able to have another key stored in a secondary secure location. Something like: when you enroll your primary, it automatically tells the site about your secondary key. The secondary is protected by a PIN and has equivalent validity as the primary and if it's ever used, the site notifies you. If your primary is lost or stolen, you can use your secondary with the help of your "password" manager to automatically revoke the old primary on all accounts. When you buy a new secondary, the same protocol can be used to inform sites to trust it, after which you put in back in storage.
steponlego 4y ago
Ahhhh hahahahaaa… Your phone will never be a proper secure computer.
- deleted 4y ago
  [deleted]
tech234a 4y ago
The app also has a $4 weekly subscription, with $40 annual and $60 lifetime options. As of when I wrote this comment, the app can still be found on the App Store.
seanhunter 4y ago
That's a potentially terrifying breach because your second factor has effectively been permanently backdoored by the app developer without your knowledge. I'm hoping this has been reported and a check for this sort of thing is added to the review process for all MFA apps. On a related note: security experts of HN which (if any) TOTP authenticator apps would you use/recommend? I currently use duo authenticator except for one thing which bafflingly will only work with google authenticator and not duo (don't ask me why) or things like steam or lastpass which have their own homebaked authentication app. Any reason to use something different?
- seanhunter 4y ago
  I should add I have no particular affiliation with duo. I ended up with it because I worked at a place that did the duo push authentication thing as the MFA enterprise SSO. Having installed the app, every time I needed an authenticator it's just what I had and therefore used.
- brylie 4y ago
  I'm not a security expert, so consider this an anecdote, but I use Bitwarden to store my passwords and TOTP tokens.
- msravi 4y ago
  I used Authy initially. I then exported all the TOTP tokens out of Authy and imported them into unix pass and Aegis. So on my laptop I just use pass, and on mobile it's Aegis.
  - seanhunter 4y ago
    I use pass myself. I had no idea you could use it for otp. Are you using something like this? https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
    - msravi 4y ago
      Yes! That's what I use - it's very convenient. The first line of the pass file needs to be the totp string, that's all. But you can also use oathtool at the command line with the secret. oathtool -b --totp <otp secret>
switch007 4y ago
I'm reminded of the post the other day about a Chrome extension which requests lots of permissions and there were comments reassuring us that such an extension would never pass review.
- ratorx 4y ago
  It doesn’t seem equivalent. It’s hard to figure out that this app is doing anything fishy without a thorough code review/sniffing external communication. In the extension example, all the permissions are laid out.
tinus_hn 4y ago
Unfortunately it seems like companies like Microsoft are not content with all those free third party apps offering an open, standardized service where really Microsoft should be the gatekeeper. So now they are ‘enhancing’ the system with extra codes being sent, location being checked etc. And of course this advanced security, which can be enforced by just an enticing click in the policy editor, only works with the Microsoft app, on the devices Microsoft allows. And they get to decide who gets updates and who gets to make do with third rate support.

38 points by tech234a 4y ago

It was never a good idea to use an internet-connected device with complex software stacks as the 2nd factor. We should go with Yubikeys & Co.

franga2000 4y ago
Until hardware security devices support "identical twins" in some way, they're simply too impractical. For them to be practical for all accounts, not just the most sensitive few, you need to be able to have another key stored in a secondary secure location. Something like: when you enroll your primary, it automatically tells the site about your secondary key. The secondary is protected by a PIN and has equivalent validity as the primary and if it's ever used, the site notifies you. If your primary is lost or stolen, you can use your secondary with the help of your "password" manager to automatically revoke the old primary on all accounts. When you buy a new secondary, the same protocol can be used to inform sites to trust it, after which you put in back in storage.

steponlego 4y ago

Ahhhh hahahahaaa… Your phone will never be a proper secure computer.

deleted 4y ago
[deleted]

tech234a 4y ago

The app also has a $4 weekly subscription, with $40 annual and $60 lifetime options. As of when I wrote this comment, the app can still be found on the App Store.

seanhunter 4y ago

That's a potentially terrifying breach because your second factor has effectively been permanently backdoored by the app developer without your knowledge. I'm hoping this has been reported and a check for this sort of thing is added to the review process for all MFA apps. On a related note: security experts of HN which (if any) TOTP authenticator apps would you use/recommend? I currently use duo authenticator except for one thing which bafflingly will only work with google authenticator and not duo (don't ask me why) or things like steam or lastpass which have their own homebaked authentication app. Any reason to use something different?

seanhunter 4y ago
I should add I have no particular affiliation with duo. I ended up with it because I worked at a place that did the duo push authentication thing as the MFA enterprise SSO. Having installed the app, every time I needed an authenticator it's just what I had and therefore used.
brylie 4y ago
I'm not a security expert, so consider this an anecdote, but I use Bitwarden to store my passwords and TOTP tokens.
msravi 4y ago
I used Authy initially. I then exported all the TOTP tokens out of Authy and imported them into unix pass and Aegis. So on my laptop I just use pass, and on mobile it's Aegis.
- seanhunter 4y ago
  I use pass myself. I had no idea you could use it for otp. Are you using something like this? https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
  - msravi 4y ago
    Yes! That's what I use - it's very convenient. The first line of the pass file needs to be the totp string, that's all. But you can also use oathtool at the command line with the secret. oathtool -b --totp <otp secret>

switch007 4y ago

I'm reminded of the post the other day about a Chrome extension which requests lots of permissions and there were comments reassuring us that such an extension would never pass review.

ratorx 4y ago
It doesn’t seem equivalent. It’s hard to figure out that this app is doing anything fishy without a thorough code review/sniffing external communication. In the extension example, all the permissions are laid out.

tinus_hn 4y ago

Unfortunately it seems like companies like Microsoft are not content with all those free third party apps offering an open, standardized service where really Microsoft should be the gatekeeper. So now they are ‘enhancing’ the system with extra codes being sent, location being checked etc. And of course this advanced security, which can be enforced by just an enticing click in the policy editor, only works with the Microsoft app, on the devices Microsoft allows. And they get to decide who gets updates and who gets to make do with third rate support.