5 ms·

Websites with fake MFA: security theater?

Greetings, I may have discovered a very common weakness in multi-factor authentication (MFA) as widely implemented by many websites and organizations. So far, the suspects include GitLab and Credly: the exploit begins by invoking the "Forgot My Password" flow, then procuring the "Reset Password" email. Follow the link found in that email message, provide a new password, and you're signed in to the victim's account without ever being challenged for 2FA. Now, the challenge here is intercepting that email message, but that's a trivial feat: it's in plaintext and you probably know where it was sent. You may need to execute a takeover of the email account. But this may be easier than procuring the victim's TOTP secret, or otherwise providing that second factor, and you also don't need to know the other factor -- the password! Let's call it 0FA. I contacted GitLab via their HackerOne bug bounty program, and the application was rejected, because an email intercept is not part of their account threat model. I innocently contacted Credly Support, asking where to find recovery codes, and Dominique informed me with a straight face how to completely bypass MANDATORY TOTP MFA and recover my account WITHOUT EVEN GIVING THE PASSWORD to sign in. And then, she explained, I would be free to disable MFA or do whatever I wanted! yay So am I wrong? Is this a nothingburger, or is it really what it appears to be: security theater, brought to us by techbros who don't know how to roll their own auth?

jiveturkey 3y ago
It's a common problem with consumer MFA. The MFA part isn't the hard part of MFA.
faangsticle 3y ago
[dead]
LightHugger 3y ago
Most "two factor" is indeed just completely fake. The idea is that by getting people to verify with a phone number, you can harvest data about them and make money from them. That's it. A sham, scam, whatever.
- ShadowBanThis01 3y ago
  "The idea is that by getting people to verify with a phone number, you can harvest data about them and make money from them." Welcome to OpenAI.
schnable 3y ago
> Is this a nothingburger, or is it really what it appears to be: security theater, brought to us by techbros who don't know how to roll their own auth? Are those the only two options?
yjftsjthsd-h 3y ago
> it's in plaintext Is it? Obviously it gets sent to the mail server, but that's usually TLS encrypted. Worth checking if it uses STARTTLS, but not that bad. > Let's call it 0FA. No, still 1 factor.
jameswestgate 3y ago
The email is a replacement factor for the password, so this is still 1FA. This would also be an issue if email was a recovery factor for either password or MFA. I always advise people to MFA their email accounts because that’s where all password resets are sent making it single target for many account takeovers.
tehwebguy 3y ago
They are weighing the customer experience (and support costs) of all lost MFA being locked out or requiring lots of human intervention against the likelihood of your email or physical device getting owned.
horsawlarway 3y ago
> Now, the challenge here is intercepting that email message, but that's a trivial feat: it's in plaintext and you probably know where it was sent. No. Just no. This is exactly the same difficulty as compromising the account you're attacking RIGHT NOW. The email isn't plaintext (it's almost certainly smtp over tls/ssl). Knowing where it was sent doesn't help you. Executing a takeover of the email account is roughly equivalent to executing your current attack. --- >So am I wrong? Is this a nothingburger, or is it really what it appears to be: security theater, brought to us by techbros who don't know how to roll their own auth? Yes. You're wrong. They absolutely DO know how to roll their own auth. It turns out basically no one actually wants real 2fa where a lost device/key means losing the account. Right now, for good or for bad, an email address is one of the few sane ways to identify a user. Getting my email is roughly the same as having a wallet with my id - online sites will trust that ownership == identity. Particularly secure companies will sometimes require you to verify identity another way during recovery (ex: Google has asked for a notarized copy of my ID) but for most accounts the extra security likely harms more users than it helps.
- kobalsky 3y ago
  > Google has asked for a notarized copy of my ID Very interesting. Could tell how long did it take, how was the process of recovering your account? I'm in one of those months that I panic and wonder if I should disabled advanced protection.
  - horsawlarway 3y ago
    This was not for a personal account. It was recovery of a business account that was locked for session hijacking (intentional and done as part of developing a potential feature, but session hijacking none-the-less). At the time (~2013) it triggered a complete lockout and manual verification of billing identity (notarized ID) to get back in. They don't do it for personal accounts, as far as I know. Honestly, I'm not sure the Google of today would do it for a business account.
- slau 3y ago
  It strikes me as easier to target a specific user, and try to steal their email credentials (phishing is still ridiculously successful), and then basically get access to all of their online accounts. I would tend to agree that if I did lose my password, then upon change of said password, I should still provide the 2FA challenge when actually logging in. Alternatively, the password change flow should not be started unless I provide the 2FA challenge itself. After all, what are the odds I lost both the password and the 2FA device? Equally, I use two yubikeys; one as my primary and one as my backup. Every time I register a new account I have to hope the service actually allows me to register multiple security keys (looking at you PayPal) or store the TOTP on both keys. Whenever possible, I disable TOTP if Webauthn is supported, however this is quite commonly not possible (Binance I believe doesn’t even allow you to disable SMS recovery).
NoZebra120vClip 3y ago
Does anyone have resources or links on this topic? I was not succeeding in finding it being discussed on the open web. Is there a term for it that I need to know?
digitalpacman 3y ago
All 2FA is security theater. All 2FA in use today is normally just 1FA pretending to be 2FA. If I have your phone, then I have everything I need to login. That's 1 factor. 2FA is only 2FA if the physical device ownership requirement does not have access to use the thing being accessed. Why? Because you store passwords on that device. That device has your password. If I have the device, I have your password. You would have to use no auto-fill and memorize your passwords so that the physical device does not have your password in it. The point is, if I get one factor, I don't have the other. But in reality, our physical devices can access the thing we want, and therefore you likely store your credentials on that device.
- chelmzy 3y ago
  > All 2FA is security theater. Might be the worst take I have seen on this website. Anyone with first hand experience in corporate information security will not agree with you. Fact of the matter is 2FA stops majority of credential/phishing based attacks. Because majority of attackers are casting a wide net and will simply give up. Is it perfect? No. But to say its all security theater is ignorant.

jiveturkey 3y ago

It's a common problem with consumer MFA. The MFA part isn't the hard part of MFA.

faangsticle 3y ago

[dead]

LightHugger 3y ago

Most "two factor" is indeed just completely fake. The idea is that by getting people to verify with a phone number, you can harvest data about them and make money from them. That's it. A sham, scam, whatever.

ShadowBanThis01 3y ago
"The idea is that by getting people to verify with a phone number, you can harvest data about them and make money from them." Welcome to OpenAI.

schnable 3y ago

> Is this a nothingburger, or is it really what it appears to be: security theater, brought to us by techbros who don't know how to roll their own auth? Are those the only two options?

yjftsjthsd-h 3y ago

> it's in plaintext Is it? Obviously it gets sent to the mail server, but that's usually TLS encrypted. Worth checking if it uses STARTTLS, but not that bad. > Let's call it 0FA. No, still 1 factor.

jameswestgate 3y ago

The email is a replacement factor for the password, so this is still 1FA. This would also be an issue if email was a recovery factor for either password or MFA. I always advise people to MFA their email accounts because that’s where all password resets are sent making it single target for many account takeovers.

tehwebguy 3y ago

They are weighing the customer experience (and support costs) of all lost MFA being locked out or requiring lots of human intervention against the likelihood of your email or physical device getting owned.

horsawlarway 3y ago

> Now, the challenge here is intercepting that email message, but that's a trivial feat: it's in plaintext and you probably know where it was sent. No. Just no. This is exactly the same difficulty as compromising the account you're attacking RIGHT NOW. The email isn't plaintext (it's almost certainly smtp over tls/ssl). Knowing where it was sent doesn't help you. Executing a takeover of the email account is roughly equivalent to executing your current attack. --- >So am I wrong? Is this a nothingburger, or is it really what it appears to be: security theater, brought to us by techbros who don't know how to roll their own auth? Yes. You're wrong. They absolutely DO know how to roll their own auth. It turns out basically no one actually wants real 2fa where a lost device/key means losing the account. Right now, for good or for bad, an email address is one of the few sane ways to identify a user. Getting my email is roughly the same as having a wallet with my id - online sites will trust that ownership == identity. Particularly secure companies will sometimes require you to verify identity another way during recovery (ex: Google has asked for a notarized copy of my ID) but for most accounts the extra security likely harms more users than it helps.

kobalsky 3y ago
> Google has asked for a notarized copy of my ID Very interesting. Could tell how long did it take, how was the process of recovering your account? I'm in one of those months that I panic and wonder if I should disabled advanced protection.
- horsawlarway 3y ago
  This was not for a personal account. It was recovery of a business account that was locked for session hijacking (intentional and done as part of developing a potential feature, but session hijacking none-the-less). At the time (~2013) it triggered a complete lockout and manual verification of billing identity (notarized ID) to get back in. They don't do it for personal accounts, as far as I know. Honestly, I'm not sure the Google of today would do it for a business account.
slau 3y ago
It strikes me as easier to target a specific user, and try to steal their email credentials (phishing is still ridiculously successful), and then basically get access to all of their online accounts. I would tend to agree that if I did lose my password, then upon change of said password, I should still provide the 2FA challenge when actually logging in. Alternatively, the password change flow should not be started unless I provide the 2FA challenge itself. After all, what are the odds I lost both the password and the 2FA device? Equally, I use two yubikeys; one as my primary and one as my backup. Every time I register a new account I have to hope the service actually allows me to register multiple security keys (looking at you PayPal) or store the TOTP on both keys. Whenever possible, I disable TOTP if Webauthn is supported, however this is quite commonly not possible (Binance I believe doesn’t even allow you to disable SMS recovery).

NoZebra120vClip 3y ago

Does anyone have resources or links on this topic? I was not succeeding in finding it being discussed on the open web. Is there a term for it that I need to know?

digitalpacman 3y ago

All 2FA is security theater. All 2FA in use today is normally just 1FA pretending to be 2FA. If I have your phone, then I have everything I need to login. That's 1 factor. 2FA is only 2FA if the physical device ownership requirement does not have access to use the thing being accessed. Why? Because you store passwords on that device. That device has your password. If I have the device, I have your password. You would have to use no auto-fill and memorize your passwords so that the physical device does not have your password in it. The point is, if I get one factor, I don't have the other. But in reality, our physical devices can access the thing we want, and therefore you likely store your credentials on that device.

chelmzy 3y ago
> All 2FA is security theater. Might be the worst take I have seen on this website. Anyone with first hand experience in corporate information security will not agree with you. Fact of the matter is 2FA stops majority of credential/phishing based attacks. Because majority of attackers are casting a wide net and will simply give up. Is it perfect? No. But to say its all security theater is ignorant.