18 ms·

Argh. Passwords are amazing. I loathe many of the attempts at replacing them simply because the _average_ user has proven to be unable to manage them. The thr

Argh. Passwords are amazing. I loathe many of the attempts at replacing them simply because the _average_ user has proven to be unable to manage them. The three factors of authentication are a thing because they all protect against somewhat orthogonal threat vectors. Possession "have" is nice because it binds the authentication to a single thing in the real world (as opposed to some digital thing that can be copied endlessly). Biometrics, if nice, is something that is relatively unique and always carried with you (mostly identification), and bind the factor to a person, secrets like passwords are nice because they essentially bind the factor to the intent, in that a user displays their secret behaviour (of which passwords are one) as opposed to not displaying the behaviour. Articles that solely focus on the downsides of passwords, often neglect downsides of the other factor types. What are ways the strong personal binding of the "are" factor can be abused if there is no intent? FaceID/TouchID on sleeping or otherwise inattentive persons is a prime one. All factor-types can work in ways that complement eachother. Removing or at least weakening passwords is not a good way forward, we need to work on fusing all the factor-types jnto a single strong 3-factor auth

JohnFen 3y ago
> we need to work on fusing all the factor-types into a single strong 3-factor auth Would this not make logging into things three times more painful? Even just using 2FA is a pain right now.
- Phemist 3y ago
  This is another hot take, the word factor is overloaded (by marketing people) to be really confusing. The three factors of auth are categories / types. TOTP, password-entry into a form, biometric presentation, etc are _measures_. Sometimes the first measure is not sufficient, because it only implements one factor-type (e.g. the secret knowledge password), and a second measure that like TOTP is necessary which proves possession of something to a degree. The time between proving one measure and then the next 2"F"A measure allows many shenanigans (e.g. social engineering to get me to send a TOTP code to my down-on-his-luck "son"). What I am professing is a focus on measures where proof of all three factor types happens at the same time. PIN codes as entered to unlock a private key on a smartcard, which is then used to sign some other thing, would be one example of a 2-factor measure. Another is FaceID/TouchID (on-device matching). But 3-factor measures are not impossible - e.g., take also the keystroke dynamics into account of a password being entered on a specific device, apple could implement "KeystrokeID". Other options can exist, it just takes some creativity to think of how a secret behaviour can be encoded into a biometric modality that is then only understood by a specific device..
dwaite 3y ago
"Personal opinion" hat on: multiple factors do not provide perceived user benefit. They benefit the party who is providing service and exposed to risk. The old Battle.net authenticator made it harder for my account to get hacked, sure. But I had a process, involving real people behind the scenes at Blizzard, to recover from that hack. They didn't create the authenticator as a measure of altruism to users; they created it because hacks are expensive. This is why they would regularly reward users for enabling the authenticator with various items/DLC. Now the reality is that if I get hacked multiple times, they may refuse to restore my account. They might not be able to restore my account with available information, or it might take ages due to a large scale attack (such as someone managing to deploy a key logger via zero-day browser exploit, if we are speaking to personal experience). Services have good reason to not trust users to have good password hygiene - most do not, and breach lists only go so far to help alleviate the problem. SMS is expensive, but even sites with lower security needs use it because the alternative of recovering user accounts is more expensive. > All factor-types can work in ways that complement eachother. Removing or at least weakening passwords is not a good way forward, we need to work on fusing all the factor-types jnto a single strong 3-factor auth. This is likely not going to happen for anything outside of government use cases. Biometrics on most consumer hardware are a "shortcut" for a cached knowledge factor, like a device unlock PIN on boot. They cache the knowledge factor because entering passwords constantly is a lousy experience. Likewise, changing a device biometric to match other people can be done with just the knowledge and device possession factors. Maybe one day we will have embedded neural hardware which will transparently meet all three factors, or maybe there will be really clever solutions with all-day VR hardware, but today's consumer hardware doesn't support three factors, because the biometric factor is just an extension of the knowledge one.

JohnFen 3y ago

> we need to work on fusing all the factor-types into a single strong 3-factor auth Would this not make logging into things three times more painful? Even just using 2FA is a pain right now.

Phemist 3y ago
This is another hot take, the word factor is overloaded (by marketing people) to be really confusing. The three factors of auth are categories / types. TOTP, password-entry into a form, biometric presentation, etc are _measures_. Sometimes the first measure is not sufficient, because it only implements one factor-type (e.g. the secret knowledge password), and a second measure that like TOTP is necessary which proves possession of something to a degree. The time between proving one measure and then the next 2"F"A measure allows many shenanigans (e.g. social engineering to get me to send a TOTP code to my down-on-his-luck "son"). What I am professing is a focus on measures where proof of all three factor types happens at the same time. PIN codes as entered to unlock a private key on a smartcard, which is then used to sign some other thing, would be one example of a 2-factor measure. Another is FaceID/TouchID (on-device matching). But 3-factor measures are not impossible - e.g., take also the keystroke dynamics into account of a password being entered on a specific device, apple could implement "KeystrokeID". Other options can exist, it just takes some creativity to think of how a secret behaviour can be encoded into a biometric modality that is then only understood by a specific device..

dwaite 3y ago

"Personal opinion" hat on: multiple factors do not provide perceived user benefit. They benefit the party who is providing service and exposed to risk. The old Battle.net authenticator made it harder for my account to get hacked, sure. But I had a process, involving real people behind the scenes at Blizzard, to recover from that hack. They didn't create the authenticator as a measure of altruism to users; they created it because hacks are expensive. This is why they would regularly reward users for enabling the authenticator with various items/DLC. Now the reality is that if I get hacked multiple times, they may refuse to restore my account. They might not be able to restore my account with available information, or it might take ages due to a large scale attack (such as someone managing to deploy a key logger via zero-day browser exploit, if we are speaking to personal experience). Services have good reason to not trust users to have good password hygiene - most do not, and breach lists only go so far to help alleviate the problem. SMS is expensive, but even sites with lower security needs use it because the alternative of recovering user accounts is more expensive. > All factor-types can work in ways that complement eachother. Removing or at least weakening passwords is not a good way forward, we need to work on fusing all the factor-types jnto a single strong 3-factor auth. This is likely not going to happen for anything outside of government use cases. Biometrics on most consumer hardware are a "shortcut" for a cached knowledge factor, like a device unlock PIN on boot. They cache the knowledge factor because entering passwords constantly is a lousy experience. Likewise, changing a device biometric to match other people can be done with just the knowledge and device possession factors. Maybe one day we will have embedded neural hardware which will transparently meet all three factors, or maybe there will be really clever solutions with all-day VR hardware, but today's consumer hardware doesn't support three factors, because the biometric factor is just an extension of the knowledge one.