4 ms·

Imagine you already know the passwords for many emails, or likely password patterns, from other sources. That's the kind of the attack we're talking about here.

Imagine you already know the passwords for many emails, or likely password patterns, from other sources. That's the kind of the attack we're talking about here. Also, those attacks are normally performed very slowly, and probably through botnets. (And yes, 2FA is the only real answer here, preferably YubiKeys to also defeat phishing)

browningstreet 3y ago
2FA is so, so, so very tiring.. all day long, 2FAing. We need to move past it. And no, I don't have an answer for it.
- rafaelmn 3y ago
  Passkeys ?
- marcosdumay 3y ago
  It just needs to be done correctly, not as a "gimme your phone number, peasant" excuse for data mining. How many computers do you use normally? How hard would it be to link them to your accounts?
  - littlecranky67 3y ago
    Problem is using multiple browsers, or when a privacy-conscious user decides to delete internet history.
  - oarsinsync 3y ago
    > How many computers do you use normally? How hard would it be to link them to your accounts? I use private browsing exclusively, so, I’d hope that’s difficult link to me reliably.
    - marcosdumay 3y ago
      Well, you if want to both refuse that a site reliably identify you and have a flawless process for identifying you, you'll have a hard time.
      - oarsinsync 3y ago
        > Well, you if want to both refuse that a site reliably identify you and have a flawless process for identifying you, you'll have a hard time. and yet the digital certificate the government issues me means they can flawlessly identify me, when i choose for them to be able to identify me, rather than by them permanently tracking my machine. Explicitly allowlisting a particular install of a particular browser isn’t a strong choice when we already have PKI.
    - alpaca128 3y ago
      In case you refer to incognito/private windows: that's completely useless. All you can hope to get from it is automatic deletion of cookies. Google got a huge fine for tracking everyone in private mode [0] and you can be certain everyone else who didn't yet get dragged to court is still doing it. [0] https://www.theguardian.com/technology/2023/dec/29/google-lawsuit-settlement-incognito-mode https://www.theguardian.com/technology/2023/dec/29/google-la...
  - crazygringo 3y ago
    It's still exhausting. Literally every time I pay for something via PayPal on my computer, I need to pull out my phone, find the authenticator app, open it, scroll to PayPal, tap it, see if there's enough time for this code or if I should wait for the next one, type the 6 digits into the site... I mean it takes half a minute, and this easily gets repeated several times a day if you engage in a lot of transaction-type things. And it's no faster if it's by SMS or by e-mail because I'm still spending 15 seconds waiting for the message, and then opening it, typing, then going back to delete the message so it doesn't clutter my inbox -- half a minute total again.
    - kaibee 3y ago
      > see if there's enough time for this code or if I should wait for the next one, type the 6 digits into the site... In my experience on most services (not sure about paypal specifically) there's a grace period where a code that just 'expired' is still valid for another ~10-30 seconds? So... at least you can skip that part.
    - vel0city 3y ago
      Sounds like a good use case for fido authenticators or passkeys.
    - mvdtnz 3y ago
      Have you ever done literally anything that is actually exhausting? Because this.... this is not exhausting.
    - wlesieutre 3y ago
      > see if there's enough time for this code I haven't tried PayPal specifically, but websites will usually still accept the previous code for at least a few seconds after a new one rolls over
    - sratner 3y ago
      Not to disagree with the cumbersome process - just want to point out that TOTP codes are valid for 30 seconds after the "expire" (60 seconds total). So as long as you are able to remember / copy the digits, there is no need to wait for the next code even if you don't have enough time to type it in. It will still work. Tangentially, I really wish authenticator apps continued to show the previous code for 30 seconds so I can continue to refer to it for apps that don't allow copy and paste.
- DenisM 3y ago
  A simple solution is 2FA unknown/new devices.
- asimpletune 3y ago
  On Apple devices it's super easy, barely an inconvenience
- wolpoli 3y ago
  Right now, the web experience for 2FA is very poor compared to using a mobile app. I wish I could just put my phone on an NFC reader when a site requires 2FA, and then all I have to do is to confirm on the phone itself.
chimeracoder 3y ago
> (And yes, 2FA is the only real answer here) It's not the only answer. You can also use tools that detect and reject insecure passwords, integrate with HaveIBeenPwned to force-roll passwords that have been previously compromised, etc. 2FA would solve a lot of the problem, but it's not the only option that could have mitigated this.
- lolinder 3y ago
  If the passwords are leaked after the user creates their account with your service, you can't go back and re-check their password against HIBP (unless you're inexplicably storing your passwords as plain text or SHA-1). Using HIBP is a partial solution, but not sufficient to prevent a leak like this. Mandatory 2FA is sufficient, but not very user-friendly.
  - chimeracoder 3y ago
    > Using HIBP is a partial solution, but not sufficient to prevent a leak like this. I didn't say it was sufficient to prevent this. I said it was another tool that would have mitigated some of this (and which presumably 23&Me did not implement).
  - arwineap 3y ago
    You can check against HIBP on login the same as you check on password reset. If password is compromised on HIBP, force a 2FA and a password reset Ideally MFA should be based on the accounts / sessions risk and not mandatory
    - lolinder 3y ago
      That's another step in the right direction, but 23andMe is the kind of service that people create an account for and then don't use for years at a time. Still not a complete solution. And I agree that mandatory 2FA isn't a good answer either. As someone who uses long, random passwords on all websites, I like to be able to choose whether to add 2FA on top.
rpastuszak 3y ago
> 23andMe then claims that poor password practices are responsible for this data leak. My account (now removed) relied on a long, unique, generated password + Apple SSO. I don't see how I could've made my 23andMe account more secure (I'm in the 6mm pool of users, not the original 14k).
- dpkonofa 3y ago
  You couldn’t but the access they have to your info is limited to only the info you shared with an account that reused their password from another site. If you’re not sharing info with people you don’t know or trust, you’re ok.
- deleted 3y ago
  [deleted]

browningstreet 3y ago

2FA is so, so, so very tiring.. all day long, 2FAing. We need to move past it. And no, I don't have an answer for it.

rafaelmn 3y ago
Passkeys ?
marcosdumay 3y ago
It just needs to be done correctly, not as a "gimme your phone number, peasant" excuse for data mining. How many computers do you use normally? How hard would it be to link them to your accounts?
- littlecranky67 3y ago
  Problem is using multiple browsers, or when a privacy-conscious user decides to delete internet history.
- oarsinsync 3y ago
  > How many computers do you use normally? How hard would it be to link them to your accounts? I use private browsing exclusively, so, I’d hope that’s difficult link to me reliably.
  - marcosdumay 3y ago
    Well, you if want to both refuse that a site reliably identify you and have a flawless process for identifying you, you'll have a hard time.
    - oarsinsync 3y ago
      > Well, you if want to both refuse that a site reliably identify you and have a flawless process for identifying you, you'll have a hard time. and yet the digital certificate the government issues me means they can flawlessly identify me, when i choose for them to be able to identify me, rather than by them permanently tracking my machine. Explicitly allowlisting a particular install of a particular browser isn’t a strong choice when we already have PKI.
  - alpaca128 3y ago
    In case you refer to incognito/private windows: that's completely useless. All you can hope to get from it is automatic deletion of cookies. Google got a huge fine for tracking everyone in private mode [0] and you can be certain everyone else who didn't yet get dragged to court is still doing it. [0] https://www.theguardian.com/technology/2023/dec/29/google-lawsuit-settlement-incognito-mode https://www.theguardian.com/technology/2023/dec/29/google-la...
- crazygringo 3y ago
  It's still exhausting. Literally every time I pay for something via PayPal on my computer, I need to pull out my phone, find the authenticator app, open it, scroll to PayPal, tap it, see if there's enough time for this code or if I should wait for the next one, type the 6 digits into the site... I mean it takes half a minute, and this easily gets repeated several times a day if you engage in a lot of transaction-type things. And it's no faster if it's by SMS or by e-mail because I'm still spending 15 seconds waiting for the message, and then opening it, typing, then going back to delete the message so it doesn't clutter my inbox -- half a minute total again.
  - kaibee 3y ago
    > see if there's enough time for this code or if I should wait for the next one, type the 6 digits into the site... In my experience on most services (not sure about paypal specifically) there's a grace period where a code that just 'expired' is still valid for another ~10-30 seconds? So... at least you can skip that part.
  - vel0city 3y ago
    Sounds like a good use case for fido authenticators or passkeys.
  - mvdtnz 3y ago
    Have you ever done literally anything that is actually exhausting? Because this.... this is not exhausting.
  - wlesieutre 3y ago
    > see if there's enough time for this code I haven't tried PayPal specifically, but websites will usually still accept the previous code for at least a few seconds after a new one rolls over
  - sratner 3y ago
    Not to disagree with the cumbersome process - just want to point out that TOTP codes are valid for 30 seconds after the "expire" (60 seconds total). So as long as you are able to remember / copy the digits, there is no need to wait for the next code even if you don't have enough time to type it in. It will still work. Tangentially, I really wish authenticator apps continued to show the previous code for 30 seconds so I can continue to refer to it for apps that don't allow copy and paste.
DenisM 3y ago
A simple solution is 2FA unknown/new devices.
asimpletune 3y ago
On Apple devices it's super easy, barely an inconvenience
wolpoli 3y ago
Right now, the web experience for 2FA is very poor compared to using a mobile app. I wish I could just put my phone on an NFC reader when a site requires 2FA, and then all I have to do is to confirm on the phone itself.

chimeracoder 3y ago

> (And yes, 2FA is the only real answer here) It's not the only answer. You can also use tools that detect and reject insecure passwords, integrate with HaveIBeenPwned to force-roll passwords that have been previously compromised, etc. 2FA would solve a lot of the problem, but it's not the only option that could have mitigated this.

lolinder 3y ago
If the passwords are leaked after the user creates their account with your service, you can't go back and re-check their password against HIBP (unless you're inexplicably storing your passwords as plain text or SHA-1). Using HIBP is a partial solution, but not sufficient to prevent a leak like this. Mandatory 2FA is sufficient, but not very user-friendly.
- chimeracoder 3y ago
  > Using HIBP is a partial solution, but not sufficient to prevent a leak like this. I didn't say it was sufficient to prevent this. I said it was another tool that would have mitigated some of this (and which presumably 23&Me did not implement).
- arwineap 3y ago
  You can check against HIBP on login the same as you check on password reset. If password is compromised on HIBP, force a 2FA and a password reset Ideally MFA should be based on the accounts / sessions risk and not mandatory
  - lolinder 3y ago
    That's another step in the right direction, but 23andMe is the kind of service that people create an account for and then don't use for years at a time. Still not a complete solution. And I agree that mandatory 2FA isn't a good answer either. As someone who uses long, random passwords on all websites, I like to be able to choose whether to add 2FA on top.

rpastuszak 3y ago

> 23andMe then claims that poor password practices are responsible for this data leak. My account (now removed) relied on a long, unique, generated password + Apple SSO. I don't see how I could've made my 23andMe account more secure (I'm in the 6mm pool of users, not the original 14k).

dpkonofa 3y ago
You couldn’t but the access they have to your info is limited to only the info you shared with an account that reused their password from another site. If you’re not sharing info with people you don’t know or trust, you’re ok.
deleted 3y ago
[deleted]