6 ms·

> Why opposed to MFA? Source code is one of the most important assets in our realm. Because if you don't use weak passwords MFA doesn't add value. I do recomme

by jjav 3y ago

> Why opposed to MFA? Source code is one of the most important assets in our realm. Because if you don't use weak passwords MFA doesn't add value. I do recommend MFA for most people because for most people their password is the name of their dog (which I can look up on social media) followed by "1!" to satisfy the silly number and special character rules. So yes please use MFA. But if your (like my) passwords are 128+bits out of /dev/random, MFA isn't adding value.

samatman 3y ago
The slogan is "something you know and something you have", right? I don't have strong opinions about making it mandatory, but I turned on 2FA for all accounts of importance years ago. I use a password manager, which means everything I "know" could conceivably get popped with one exploit. It's not that much friction to pull out (or find) my phone and authenticate. It only gets annoying when I switch phones, but I have a habit of only doing that every four years or so. You sound like you know what you're doing, that's fine, but I don't think it's true that MFA doesn't add security on average.
- jjav 3y ago
  > It only gets annoying when I switch phones Right. I don't ever want to tie login to a phone because phones are pretty disposable. > I don't think it's true that MFA doesn't add security on average You're right! On average it's better, because most people have bad password and/or reuse them in more than one place. So yes MFA is better. But if your password is already impossible to guess (as 128+ random bits are) then tacking on a few more bytes of entropy (the TOTP seed) doesn't do much.
  - satokema 3y ago
    Those few bits are the difference between a keylogged password holder waltzing in and an automated monitor noticing that someone is failing the token check and locking the account before any damage occurs.
    - StillBored 3y ago
      I think your missing parents point, both are just preshared keys, one has some additional fuzz around it so that the user in theory isn't themselves typing the same second key in all the time, but much of that security is in keeping the second secret in a little keychain device that cannot itself leak the secret. Once people put the seeds in their password managers/phones/etc its just more data to steal. Plus, the server/provider side remains a huge weak point too. And the effort of enrolling/giving the user the initial seed is suspect. This is why the FIDO/hardware passkeys/etc are so much better because is basically hardware enforced two way public key auth, done correctly there isn't any way to leak the private keys and its hard has hell to MITM. Which is why loss of the hw is so catastrophic. Most every other MFA scheme is just a bit of extra theater.
      - jjav 3y ago
        > both are just preshared keys Exactly, that's it. Two parties have a shared secret of, say 16 bytes total, upon which authentication depends. They could have a one byte long password but a 15 byte long shared secret used to compute the MFA code. The password is useless but the MFA seed is unguessable. Maybe have no password at all (zero length) and 16 byte seed. Or go the other way and a 16 byte password and zero seed. In terms of an attacker brute forcing the keyspace, it's always the same, 16 bytes. We're basically saying (and as a generalization, this is true) that the password part is useless since people will just keep using their pets name, so let's put the strenght on the seed side. Fair enough, that's true. But if you're willing to use a strong unique password then there's no real need. (As to keyloggers, that's true, but not very interesting. If my machine is already compromised to the level that it has malicious code running logging all my input, it can steal both the passwords and the TOTP seeds and all the website content and filesystem content and so on. Game's over already.) > This is why the FIDO/hardware passkeys/etc are so much better Technically that's true. But in practice, we now have a few megacorporations trying to own your authentication flow in a way that introduces denial of service possibilities. I must control my authentication access, not cede control of it to a faceless corporation with no reachable support. I'd rather go back to using password123 everywhere.
admax88qqq 3y ago
Sure it is. If your system ever gets keylogged and somebody gets your password you are compromised With MFA even if somebody has your password if they don't have your physical authenticator too then you're relatively safe.
- ndriscoll 3y ago
  If you have a keylogger, they can also just take your session cookie/auth tokens or run arbitrary commands while you're logged in. MFA does nothing if you're logging into a service on a compromised device.
  - heyoni 3y ago
    Session keys expire and can be scoped to do anything except reset password, export data, etc…that’s why you’ll sometimes be asked to login again on some websites.
    - ndriscoll 3y ago
      If you're on a service on a compromised device, you have effectively logged into a phishing site. They can pop-up that same re-login page on you to authorize whatever action they're doing behind the scenes whenever they need to. They can pretend to be acting wonky with a "your session expired log in again" page, etc. This is part of why MFA just to log in is a bad idea. It's much more sensible if you use it only for sensitive actions (e.g. changing password, authorizing a large transaction, etc.) that the user almost never does. But you need everyone to treat it that way, or users will think it's just normal to be asked to approve all the time.
      - snnn 3y ago
        Some USB keys have a LCD screen on it to prevent that. You can comprise the computer that the key was inserted to, but you cannot comprise the key. If you see the things messages shows up on your computer screen differs from the messages on the key, you reject the auth request.
12_throw_away 3y ago
> But if your (like my) passwords are 128+bits out of /dev/random, MFA isn't adding value. no. a second factor of authentication is completely orthogonal to password complexity.
White_Wolf 3y ago
Your password is useless when it comes to hardware keyloggers. We run yearly tests to see if people check for "extra hardware". Needles to say we have a very high failure rate. It's hard to get a software keylooger installed on a corp. machine. It's easy to get physical access to the office or even their homes and install keyloggers all over the place and download the data via BT.
- jjav 3y ago
  > Your password is useless when it comes to hardware keyloggers. You are of course correct. This is where threat modeling comes in. To really say if something is more secure or less secure or a wash, threat modeling needs to be done, carefully considering which threats you want to cover and not cover. I this thread I'm talking from the perspective of an average individual with a personal machine and who is not interesting enough to be targeted by corporate espionage or worse. Thus, the threat of operatives breaking into my house and installing hardware keyloggers on my machines is not part of my threat model. I don't care about that at all, for my personal use. For sensitive company machines or known CxOs and such, yes, but that's a whole different discussion and threat model exercise.
deleted 3y ago
[deleted]

by jjav 3y ago

samatman 3y ago

The slogan is "something you know and something you have", right? I don't have strong opinions about making it mandatory, but I turned on 2FA for all accounts of importance years ago. I use a password manager, which means everything I "know" could conceivably get popped with one exploit. It's not that much friction to pull out (or find) my phone and authenticate. It only gets annoying when I switch phones, but I have a habit of only doing that every four years or so. You sound like you know what you're doing, that's fine, but I don't think it's true that MFA doesn't add security on average.

jjav 3y ago
> It only gets annoying when I switch phones Right. I don't ever want to tie login to a phone because phones are pretty disposable. > I don't think it's true that MFA doesn't add security on average You're right! On average it's better, because most people have bad password and/or reuse them in more than one place. So yes MFA is better. But if your password is already impossible to guess (as 128+ random bits are) then tacking on a few more bytes of entropy (the TOTP seed) doesn't do much.
- satokema 3y ago
  Those few bits are the difference between a keylogged password holder waltzing in and an automated monitor noticing that someone is failing the token check and locking the account before any damage occurs.
  - StillBored 3y ago
    I think your missing parents point, both are just preshared keys, one has some additional fuzz around it so that the user in theory isn't themselves typing the same second key in all the time, but much of that security is in keeping the second secret in a little keychain device that cannot itself leak the secret. Once people put the seeds in their password managers/phones/etc its just more data to steal. Plus, the server/provider side remains a huge weak point too. And the effort of enrolling/giving the user the initial seed is suspect. This is why the FIDO/hardware passkeys/etc are so much better because is basically hardware enforced two way public key auth, done correctly there isn't any way to leak the private keys and its hard has hell to MITM. Which is why loss of the hw is so catastrophic. Most every other MFA scheme is just a bit of extra theater.
    - jjav 3y ago
      > both are just preshared keys Exactly, that's it. Two parties have a shared secret of, say 16 bytes total, upon which authentication depends. They could have a one byte long password but a 15 byte long shared secret used to compute the MFA code. The password is useless but the MFA seed is unguessable. Maybe have no password at all (zero length) and 16 byte seed. Or go the other way and a 16 byte password and zero seed. In terms of an attacker brute forcing the keyspace, it's always the same, 16 bytes. We're basically saying (and as a generalization, this is true) that the password part is useless since people will just keep using their pets name, so let's put the strenght on the seed side. Fair enough, that's true. But if you're willing to use a strong unique password then there's no real need. (As to keyloggers, that's true, but not very interesting. If my machine is already compromised to the level that it has malicious code running logging all my input, it can steal both the passwords and the TOTP seeds and all the website content and filesystem content and so on. Game's over already.) > This is why the FIDO/hardware passkeys/etc are so much better Technically that's true. But in practice, we now have a few megacorporations trying to own your authentication flow in a way that introduces denial of service possibilities. I must control my authentication access, not cede control of it to a faceless corporation with no reachable support. I'd rather go back to using password123 everywhere.

admax88qqq 3y ago

Sure it is. If your system ever gets keylogged and somebody gets your password you are compromised With MFA even if somebody has your password if they don't have your physical authenticator too then you're relatively safe.

ndriscoll 3y ago
If you have a keylogger, they can also just take your session cookie/auth tokens or run arbitrary commands while you're logged in. MFA does nothing if you're logging into a service on a compromised device.
- heyoni 3y ago
  Session keys expire and can be scoped to do anything except reset password, export data, etc…that’s why you’ll sometimes be asked to login again on some websites.
  - ndriscoll 3y ago
    If you're on a service on a compromised device, you have effectively logged into a phishing site. They can pop-up that same re-login page on you to authorize whatever action they're doing behind the scenes whenever they need to. They can pretend to be acting wonky with a "your session expired log in again" page, etc. This is part of why MFA just to log in is a bad idea. It's much more sensible if you use it only for sensitive actions (e.g. changing password, authorizing a large transaction, etc.) that the user almost never does. But you need everyone to treat it that way, or users will think it's just normal to be asked to approve all the time.
    - snnn 3y ago
      Some USB keys have a LCD screen on it to prevent that. You can comprise the computer that the key was inserted to, but you cannot comprise the key. If you see the things messages shows up on your computer screen differs from the messages on the key, you reject the auth request.

12_throw_away 3y ago

> But if your (like my) passwords are 128+bits out of /dev/random, MFA isn't adding value. no. a second factor of authentication is completely orthogonal to password complexity.

White_Wolf 3y ago

Your password is useless when it comes to hardware keyloggers. We run yearly tests to see if people check for "extra hardware". Needles to say we have a very high failure rate. It's hard to get a software keylooger installed on a corp. machine. It's easy to get physical access to the office or even their homes and install keyloggers all over the place and download the data via BT.

jjav 3y ago
> Your password is useless when it comes to hardware keyloggers. You are of course correct. This is where threat modeling comes in. To really say if something is more secure or less secure or a wash, threat modeling needs to be done, carefully considering which threats you want to cover and not cover. I this thread I'm talking from the perspective of an average individual with a personal machine and who is not interesting enough to be targeted by corporate espionage or worse. Thus, the threat of operatives breaking into my house and installing hardware keyloggers on my machines is not part of my threat model. I don't care about that at all, for my personal use. For sensitive company machines or known CxOs and such, yes, but that's a whole different discussion and threat model exercise.

deleted 3y ago

[deleted]