8 ms·
I Hate MFA
- rglover 3y agoPreach. Passwords + password manager are the more secure ideal.
- SoftTalker 3y agoYes and no. Many online services still have silly rules about password construction and length that preclude the random generated passwords that many password generators create. I often have to remove/substitute disallowed characters or shorten the generated passwords because the service has an arbitrary limit on the length of a password. So yes, they are better but they are still often inconvenient at least when adding a new service.
- aczerepinski 3y agoCan’t stand this. I want to challenge the CTO of my bank to a public debate about password best practices.
- SoftTalker 3y agoAnd a double pox on those sites that disallow "paste" in their passwords fields.
- _kst_ 3y agoBlowing my own horn a little, I have a Perl script that generates random passwords, with options to, for example, generate a 16-character password with lowercase letters, but with one uppercase letter, one digit, and one punctuation mark, all chosen randomly and placed at a random position: $ gen-password -len 16 -lower -1upper -1digit -1punct e$hmvcel9nyghAyw Another script in the same project generates XKCD-style random passphrases. https://github.com/Keith-S-Thompson/random-passwords https://github.com/Keith-S-Thompson/random-passwords
- lucasyvas 3y agoI have MFA on for everything and I've about had enough. I'd rather have super non-memorable passwords for everything and have one MFA code for the password manager vault. Passkeys should not require MFA either. I see a good enough future for me and it's: 1. Bitwarden with vault password and MFA 2. Everything else within, passkey I'm completely unconvinced MFA is necessary if the "password manager at top + passkeys for services" mentality is ingrained in everyone. If you offer a service where I sign in with a passkey and also require MFA you better publish an extremely convincing security paper why, or have an infrastructure critical service that burns the world down if someone unauthorized gets in. There is no other justification for that level of security other than to be an asshole.
- thesausageking 3y agoPassword manager + MFA is a lot more secure. Password managers aren't impervious to attacks.
- autoexec 3y agoEverything I've seen to replace or "fix" the problems with passwords just makes things worse. My requirements are: 1. Nothing tied to a specific device, especially one that can be easily lost/stolen/broken like a cell phone or USB drive 2. No biometrics 3. It shouldn't permit anyone, outside the website I'm logging into, to know if, when, and/or how often I log into that site. I'm pretty sure using passwords with an offline password manager is the only thing that satisfies that, but if someone comes up with something better that meets all my requirements I'd be all for it.
- Arainach 3y agoOther than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc. If one is lost you grab a second device.
- autoexec 3y agoyubikeys are interesting, basically not much different than a password manager in the case they get lost/stolen, but I worry about the privacy aspect. I assume using the app, or the use of yubicloud would allow yubico to know which sites I use, and perhaps when.
- barkingcat 3y agoWhy would you assume that? You don’t need to use their app.
- autoexec 3y agoIt looks like it might be possible to avoid leaking a list of the sites you use with yubikeys, but I need to look closer at how they work on the website's end to make sure they aren't using YubiCloud or some other third party service for validation or key management, and to make sure nothing is trackable through it. It looks like Yubico OTP requires Yubicloud and using yubico-pam might use Yubicloud.
- 1letterunixname 3y agoFalse dichotomy and less secure. Very long passwords + password managers + separate FIDO2 hardware. The point of MFA is that even with a compromised password manager or compromised password, that extra factor is required. The more damaging the loss of credentials would be, the greater the user costs of actual security (more factors) should be allowed to protect them in order to multiply the costs and trouble to potential attackers.
- makach 3y agowe all do. but it works.
- Wowfunhappy 3y agoSo do password managers. Websites concerned about password use should provide an option to use a randomly-generated password (generated by the website, not the user) in leu of MFA. This guarantees the password is unique and complex, and practically ensures that the user has a password manager.
- lucasyvas 3y agoI agree in spirit but not in practice. I don't think a website should be trusted to generate a random password - leave that to browser infrastructure (which includes extensions).
- Wowfunhappy 3y agoThe idea is that by generating a unique password for the user, the website guarantees that it really is a unique password. How else can you do that? How is this different from the way we handle e.g. api keys?
- arccy 3y agostill vulnerable to password db leaks
- shortrounddev2 3y agoOnly if you don't hash and salt
- jampekka 3y agoI've never had any of my accounts hacked and my password practices are not great. And for most accounts I don't really care that much if somebody does. I loathe MFA and all this security theatre that makes everything janky.
- toomuchtodo 3y agoGoogle’s Titan security key supports Passkeys if you don’t want a smartphone. Very reasonably priced. I have a handful for users who need secure auth but don’t have a smartphone. I do not permit anything but passkeys or secure hardware tokens to be issued in our org’s identity providers (no sms, email, totp otps). https://store.google.com/us/product/titan_security_key?hl=en-US https://store.google.com/us/product/titan_security_key?hl=en...
- shp0ngle 3y agoIs that Google's Yubico?
- arccy 3y agothey are fido2 keys like yubikeys, though the added feature set is a bit different: titan does more resident keys / passkeys, but no extra features like the yubikey 5 series
- arccy 3y agogood: they support 250! passkeys (vs 25 for yubikeys) bad: most sites still don't support passkeys so you can't use it yet
- toomuchtodo 3y agoAgree lots of sites still don’t support passkeys, but we’re getting there slowly but surely. In a corp setting, just your idp for SSO requires it. Azure/Entra (Microsoft idp) will support next month. Okta supports today. For those who use Auth0, it’s two checkboxes in your tenant config to enable. https://passkeys.directory https://passkeys.directory https://passkeys.2fa.directory/us/ https://passkeys.2fa.directory/us/ https://janbakker.tech/prepare-for-passkeys-in-entra-id/ https://janbakker.tech/prepare-for-passkeys-in-entra-id/ https://www.okta.com/press-room/press-releases/okta-launches-passkey-support-to-help-enterprises-unlock-a-passwordless/ https://www.okta.com/press-room/press-releases/okta-launches... https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/ https://auth0.com/blog/activate-passkeys-let-users-log-in-wi... https://news.ycombinator.com/item?id=38521663 https://news.ycombinator.com/item?id=38521663
- it 3y agoAnd isn't it ominous how it's "Multi" and not just "Two"...
- PeeMcGee 3y ago"Two" is a magic number that conflates the concept with implementation. Two-factor authentication is not useful because of 2, it's useful because of >1. "Multi-factor" lets us generalize to 0 factors (anonymous), 1 factor (weakly authenticated), and many factors (strongly authenticated).
- block_dagger 3y agoCopy mfa code on iphone, paste to mac. Makes it bearable.
- gjsman-1000 3y ago“I believe MFA commits a deathly sin against the commandment “Thou shall code against interfaces, not implementations.’” I don’t disagree with the sentiment, but I’ve certainly never heard of this commandment - at least, not until the author conveniently declared it one to make the point.
- knorker 3y agoI find anything that doesn't support U2F keys annoying. It doesn't add any friction when the computer just says "push the USB key", since it's a yubikey nano that's always plugged into the computer. What REALLY annoys me though is places that do support U2F keys, but only one. Last I checked AWS was broken in this regard. And honestly that adds enough friction that I'd rather do experiments on GCP, which doesn't have this bug. Not that my experiments affect AWS's bottom line. But it does mean that I learn GCP better, and maybe will recommend it in a work context. Not recommend it because MFA, but because I will better be able to say what GCP product can and can't do, than AWS, because of this.
- slau 3y agoAWS supports multiple U2F keys, I have two on my accounts. The UI is a bit clunky, though. PayPal, on the other hand, only allows a single U2F token.
- knorker 3y agoAs another commenter pointed out, AWS only started supporting multiple MFAs last year. Ugh, but yeah Paypal… that's why I'm still on SMS (SIM hijackable) and TOTP (phishable) with them.
- jsmith99 3y agoAWS started supporting multiple keys last year.
- knorker 3y agoThat's great news. Thanks!
- destitude 3y ago1Password does allow you to set it up as an authenticator for sites with 2FA so you don't need a smartphone.
- akdor1154 3y agoAuthor should try Bitwarden - it can generate TOTP codes along with remembering your password. It even autocopies your TOTP code when you autofill password, so you can log in without mousing around menus and losing flow. Nullifies most of the benefit of MFA though so maybe keep your critical stuff like email logins out of it.
- zebracanevra 3y agoBitwarden (as well as Vaultwarden) supports Passkeys as well now. You can even export the keys!
- lucasyvas 3y ago> it can generate TOTP codes along with remembering your password Absolutely correct, if you pay. Which is their right, but I'd argue you shouldn't have to to get such a basic convenience in the digital age as "just works when I want to log in".
- DistractionRect 3y agoYou expect them to host your secrets, protect your secrets, maintain multiple extensions and clients, and provide you with a low friction flow for free? If it's a budget thing, self hosted bitwarden/vaultwarden with premium features has been a thing for a while now.
- lucasyvas 3y agoI don't expect Bitwarden to - the comment was meant to be an indirect dig at the industry in general. Why do I need to pay for secure login convenience? It should just work.
- Spivak 3y agoJust use a password manager that stores your TOTP token along with the password and never care again. I use Bitwarden. Say no to proprietary hardware enclosures that deny you access to your own keys. Only use them as secondary auth of convenience, store all your passkeys in a software vault you control.
- slau 3y agoThe author seems to not have heard of hardware tokens to store your MFA. It’s not linked to a single device (you can get your codes on a computer, phone or tablet), it doesn’t require you to be “online”, and you use them for OTP, passkeys and whatnot.
- loup-vaillant 3y agoIt's even worse than that: if you're using a local password manager like KeepassXC (I do), you already have some form of MFA: something you know to unlock your password database, and something you have (in the form of the password database itself). GitHub recently forced me to use TOTP (not quite the only choice I hear, but bear with me). Well, so I've added my TOTP secret into KeepassXC, and now instead of copying my password from it, I copy the TOTP time code. I believe the increase in security, if any, is negligible.
- peblos 3y agoUsing a local password manager isn’t MFA. How is that verifiable to the authentication service?
- loup-vaillant 3y agoAnd storing my TOTP code in the same password manager I use to store my GitHub password is not more of an MFA than using the password alone. They may hope I'm using my phone, but they can't know. And they shouldn't. My security, my business. Overall there are 2 cases to consider: one where a compromised users screws the user, and one where a compromised user screws the service. In the first case, which is most online services, the only reason the service cares about the security of an account is to protect the user. They have no business policing how said user handles their own security. Propose and nudge, sure, but verify? That goes one step too far. In the second case, which would be most enterprise networks, I would recommend that the company issues a security key to each employee, and ensures (with some form of remote attestation if need be) that employees log in with that key.
- peblos 3y agoIn scenario 1, I can see the reasoning if we’re talking a low value account e.g. pseudo-anonymous account that holds no personal/financial info. In this case the service isn’t worried about you but the platform as a whole where a person or group can control many accounts Scenario 1.5 is non enterprise but with a financial or something of value aspect e.g. rewards/loyalty programs. The service has to protect against fraud Scenario 2: if we’re having this discussion about the need for MFA, how it ties us to devices and all the other reasons mentioned already, then using a security key with remote attestation is even more difficult for the end user. I don’t see how this is an improvement. It is in fact MFA itself, just with a different, more cumbersome, type of factor
- ivan_gammel 3y agoThere is a couple of things I wouldn’t agree with. SMS as authentication factor is certainly bad idea, but it’s not MFA problem. Many services support OTP and modern password manager is expected to support it too. Unique 25 character password is much easier to steal than your biometric information. All hackers need is a successful MITM attack (key logger?) or a database dump containing unhashed passwords. They could be some script kiddies from Russia or India running an automated attack on some old version of WordPress. For biometric information they would need to get access to it first and hacking your device (or getting physical access to you) if you protect it properly may not be feasible for majority of them.
- djha-skin 3y ago> it distracts me It would be faster if a password manager is used with browser plug-in. > It forces me to have a smart phone Not if we're talking about TOTP. The information for that can be stored in a password manager. > Or couples online with offline Not if you use a password manager. > it can be replaced with other solutions TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin. My chosen pm is KeePassXC, would highly recommend. One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure.
- dishsoap 3y ago> One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure. Agreed. A particular pain point for me is Apple's proprietary (or SMS-based, even worse) iCloud 2FA, it's just awful. I would use TOTP/HOTP for it in a heartbeat if given the option.
- jackson1442 3y agoThey support standard hardware keys now, which have worked pretty well for me. Just can’t use them if you have devices which aren’t on one of the later OS updates since the OS won’t support signing in with a yubikey.
- arccy 3y agowithout a browser plugin or something better than human eyes to verify domain matches, password + totp are phishable / mitm-able in an online attack
- djha-skin 3y agoA fact that becomes important in some contexts. Nevertheless I still feel it is the best compromise between convenience and security available to us.
- iLoveOncall 3y agoIMO you don't have MFA if your codes are generated by your password manager.
- pierat 3y agoI don't mind additional factors. It's the disablement of things like paste and similar that I despise.
- teaearlgraycold 3y ago> So when my brain is at 200% CPU usage and I log into some service and they ask me to authenticate with my phone, my attention receives a right hook that directly knocks it out. When this happens it means that half of my morning productivity gets destroyed The author deserves to have a way to work that fits their needs, but really they need to realize that this is an extreme neurodivergence. This is honestly shocking to hear.
- eternityforest 3y agoI think it might also have to do with the content of their work. I'm rarely doing anything that needs deep focus, I'm making glorified CRUD screens and doing tech support. When I do more physical things like counting objects or putting away groceries I have far more trouble, dealing with multiple physical objects at once is a lot more overwhelming than writing the same boring code I should probably just pay for Copilot for...
- jiehong 3y agoI wish everything would work with my yubikey as-is. Instead it’s the Microsoft Authenticator and it’s different MFA styles: - sometimes faceID is enough - sometimes I need to select a matching number in a list of 3 - sometimes I need to type the number myself - sometimes I need to type a TOTP from my phone to my computer (much worse)
- voiceblue 3y agoI used to use Lastpass with MFA, only for them to leak my vault and completely obviate 2FA. It irks me to think of the cumulative hours I lost on entering those codes, though I still think 2FA(+) has value. You can do something relatively painless like 1Password, where my device stores my secret (I only use the odd 2-3 devices after all). Lastpass is in and of itself a solid argument against the infallibility of a password-manager-only approach.
- peblos 3y ago“For example, I’ve been using a password manager for the last two years, and now all my passwords have been generated automatically. This means that if you steal my password you’ll only have access to one of my accounts.” At risk of stating the obvious, this misses the point of MFA. Password managers are not an alternative to MFA. Also, how do you enforce the usage of a password manager such that you can confidently remove the requirement for MFA? The whole idea is to protect the one account. If you “only” lose one account that’s still a bad day. Service1 has no ability to protect Service2, so protecting all of your accounts is not something MFA tries to solve
- mooreds 3y ago> It couples online and offline That's kinda the point, as it makes it more difficult for account theft. Online only solutions are either: * knowledge based (and problematic for many people due to data breaches and common passwords, though perhaps not for OP) * public/private key based and not widely supported > It can be replaced with other solutions I love my password manager and think it is a great solution for me. But I'm a tech person and know other people who a password manager would be horrible for. Even 1password, what I'd consider to be the leading password manager for "normal" folks has only millions of users[0]. Let's be generous and suppose they have 9M and all in the USA. That's only 2.7% market penetration. Not exactly a mass market solution. 0: https://www.businesswire.com/news/home/20230919527858/en/1Password-Surpasses-250-Million-in-ARR-Propelled-by-Rapid-B2B-Growth https://www.businesswire.com/news/home/20230919527858/en/1Pa...
- beaned 3y agoThe thing that annoys me most is that there's no reason MFA needs to be tied to your mobile device, and I have to pull it out every time I'm signing in somewhere on my computer. Just let me have an MFA program like Authy on my laptop, or even make it a Chrome extension. It would be so much more convenient. MFA is not generally trying to stop the use case where someone steals your laptop while it's open, it's trying to prevent the case of someone stealing your password remotely.
- opan 3y agoSMS MFA is ridiculous and should not be a thing. Phones are very unreliable (between trying to daily drive a PinePhone in the past for a while, and AT&T's device whitelist after the 3G shutdown, I've been through a lot of crap). TOTP seems fine to me. Can run it on various devices without a SIM, including just using a password manager like keepassxc on your computer that lets you copy paste the code. Sadly this all gets dumbed down and obscured so most people don't realize what TOTP is or that standard things are being used. We get told to download Google Authenticator or Microsoft Authenticator and keep it on our personal phone against our wishes forever. Hating MFA is quite understandable when it takes this form. Plus some of these TOTP apps make it hard to back up the data for use on another device, making a lost or broken phone rather catastrophic. Tip, when presented with the setup QR code on a site, decode it and just put the secret into your password manager instead of a phone app (in keepassxc right click an entry and it has a TOTP submenu). Can also be handy to save an image of the QR for later (do at your own risk of course, this is sensitive data) in case you need to set up TOTP again. People will probably argue this is less secure than letting it all live on your phone, but it still saves you from the most likely threat: websites being hacked and leaking your password. Also it's still protected by your password manager password, which should be unique and only accessible locally.
- pengaru 3y agoIt blows my mind how prevalent smartphone-based MFA has become. People should be far less willing to comply with vendors' demands for mobile numbers under the guise of improved security. SMS 2FA generally worsens your security posture by opening up new and more convenient vectors for taking over your account[0]. What's especially shocking is when I encounter employers insisting that I setup MFA using a smartphone. Even employers that should clearly know better, working in security-sensitive areas where employees are developers with commit rights to cloud software/operating system code, making lucrative targets. There's a lot of cargo-cult negligence out there. Fortunately there are better approaches to MFA. MFA is not the problem, smartphones and cell carriers are just raging dumpster fires. [0] https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
- mrintegrity 3y agoI use Aegis authenticator on my phone which supports export, I import them into gnome authenticator from where it is incredibly fast and easy to get the code into a web application login: * Press "windows" key * Type the first letter or couple of letters of the name of the code, press enter to copy (which also closes the expose style view and returns to the previous application) * Paste Very smooth, with this setup I have no issue using 2fa with codes. Not sure if it can be simplified to this extent on other operating systems / window managers
- 0max 3y agoFIDO passkeys are the way to go now. It's saved to your password manager and just needs one click to authorize your login.
- deleted 3y ago[deleted]
- 1letterunixname 3y agoMagical thinking and bitching because you can't get something (good security) for nothing (absolutely painless). Authentication is based on something you have or something you know.