5 ms·

Sure it is. If your system ever gets keylogged and somebody gets your password you are compromised With MFA even if somebody has your password if they don't ha

Sure it is. If your system ever gets keylogged and somebody gets your password you are compromised With MFA even if somebody has your password if they don't have your physical authenticator too then you're relatively safe.

ndriscoll 3y ago
If you have a keylogger, they can also just take your session cookie/auth tokens or run arbitrary commands while you're logged in. MFA does nothing if you're logging into a service on a compromised device.
- heyoni 3y ago
  Session keys expire and can be scoped to do anything except reset password, export data, etc…that’s why you’ll sometimes be asked to login again on some websites.
  - ndriscoll 3y ago
    If you're on a service on a compromised device, you have effectively logged into a phishing site. They can pop-up that same re-login page on you to authorize whatever action they're doing behind the scenes whenever they need to. They can pretend to be acting wonky with a "your session expired log in again" page, etc. This is part of why MFA just to log in is a bad idea. It's much more sensible if you use it only for sensitive actions (e.g. changing password, authorizing a large transaction, etc.) that the user almost never does. But you need everyone to treat it that way, or users will think it's just normal to be asked to approve all the time.
    - snnn 3y ago
      Some USB keys have a LCD screen on it to prevent that. You can comprise the computer that the key was inserted to, but you cannot comprise the key. If you see the things messages shows up on your computer screen differs from the messages on the key, you reject the auth request.
- mr_mitm 3y ago
  Keyloggers can be physically attached to your keyboard. There could also be a vulnerability in the encryption of wireles keyboards. Certificate-based MFA is also phishing resistant, unlike long, random, unique passwords. There are plenty of scenarios where MFA is more secure than just a strong password.
  - RaisingSpear 3y ago
    But password managers typically don't send keyboard commands to fill in a password, so a physical device would be useless. > There are plenty of scenarios where MFA is more secure than just a strong password. And how realistic are they? Or are they just highly specific scenarios where all the stars must align, and are almost never going to happen?
    - mr_mitm 3y ago
      I don't think phishing is such an obscure scenario. The point is also that you as an individual can make choices and assess risk. As a large service provider, you will always have people who reuse passwords, store them unencrypted, fall for phishing, etc. There is a percentage of users that will get their account compromised because of bad password handling which will cost you, and by enforcing MFA you can decrease that percentage, and if you mandate yubikeys or something similar the percentage will go to zero.
      - RaisingSpear 3y ago
        > I don't think phishing is such an obscure scenario. For a typical person, maybe, but for a tech-minded individual who understands security, data entropy and what /dev/random is? And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. I'm also looking at this from the perspective of an individual, not a service provider, so the activities of the greater percentage of users is of little interest to me.
        mr_mitm 3y ago
throwaway2990 3y ago
Haha yes they do. Everyone stores their 2fa in 1Password so once that’s stolen by a key longer they’re fucked.

ndriscoll 3y ago

If you have a keylogger, they can also just take your session cookie/auth tokens or run arbitrary commands while you're logged in. MFA does nothing if you're logging into a service on a compromised device.

heyoni 3y ago
Session keys expire and can be scoped to do anything except reset password, export data, etc…that’s why you’ll sometimes be asked to login again on some websites.
- ndriscoll 3y ago
  If you're on a service on a compromised device, you have effectively logged into a phishing site. They can pop-up that same re-login page on you to authorize whatever action they're doing behind the scenes whenever they need to. They can pretend to be acting wonky with a "your session expired log in again" page, etc. This is part of why MFA just to log in is a bad idea. It's much more sensible if you use it only for sensitive actions (e.g. changing password, authorizing a large transaction, etc.) that the user almost never does. But you need everyone to treat it that way, or users will think it's just normal to be asked to approve all the time.
  - snnn 3y ago
    Some USB keys have a LCD screen on it to prevent that. You can comprise the computer that the key was inserted to, but you cannot comprise the key. If you see the things messages shows up on your computer screen differs from the messages on the key, you reject the auth request.
mr_mitm 3y ago
Keyloggers can be physically attached to your keyboard. There could also be a vulnerability in the encryption of wireles keyboards. Certificate-based MFA is also phishing resistant, unlike long, random, unique passwords. There are plenty of scenarios where MFA is more secure than just a strong password.
- RaisingSpear 3y ago
  But password managers typically don't send keyboard commands to fill in a password, so a physical device would be useless. > There are plenty of scenarios where MFA is more secure than just a strong password. And how realistic are they? Or are they just highly specific scenarios where all the stars must align, and are almost never going to happen?
  - mr_mitm 3y ago
    I don't think phishing is such an obscure scenario. The point is also that you as an individual can make choices and assess risk. As a large service provider, you will always have people who reuse passwords, store them unencrypted, fall for phishing, etc. There is a percentage of users that will get their account compromised because of bad password handling which will cost you, and by enforcing MFA you can decrease that percentage, and if you mandate yubikeys or something similar the percentage will go to zero.
    - RaisingSpear 3y ago
      > I don't think phishing is such an obscure scenario. For a typical person, maybe, but for a tech-minded individual who understands security, data entropy and what /dev/random is? And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. I'm also looking at this from the perspective of an individual, not a service provider, so the activities of the greater percentage of users is of little interest to me.
      - mr_mitm 3y ago

throwaway2990 3y ago

Haha yes they do. Everyone stores their 2fa in 1Password so once that’s stolen by a key longer they’re fucked.