4 ms·

Keyloggers can be physically attached to your keyboard. There could also be a vulnerability in the encryption of wireles keyboards. Certificate-based MFA is als

Keyloggers can be physically attached to your keyboard. There could also be a vulnerability in the encryption of wireles keyboards. Certificate-based MFA is also phishing resistant, unlike long, random, unique passwords. There are plenty of scenarios where MFA is more secure than just a strong password.

RaisingSpear 3y ago
But password managers typically don't send keyboard commands to fill in a password, so a physical device would be useless. > There are plenty of scenarios where MFA is more secure than just a strong password. And how realistic are they? Or are they just highly specific scenarios where all the stars must align, and are almost never going to happen?
- mr_mitm 3y ago
  I don't think phishing is such an obscure scenario. The point is also that you as an individual can make choices and assess risk. As a large service provider, you will always have people who reuse passwords, store them unencrypted, fall for phishing, etc. There is a percentage of users that will get their account compromised because of bad password handling which will cost you, and by enforcing MFA you can decrease that percentage, and if you mandate yubikeys or something similar the percentage will go to zero.
  - RaisingSpear 3y ago
    > I don't think phishing is such an obscure scenario. For a typical person, maybe, but for a tech-minded individual who understands security, data entropy and what /dev/random is? And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. I'm also looking at this from the perspective of an individual, not a service provider, so the activities of the greater percentage of users is of little interest to me.
    - mr_mitm 3y ago
      > And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. That's why I qualified it with "certificate-based". The private key never leaves the device, ideally a yubikey-type device.
      - RaisingSpear 3y ago
        > That's why I qualified it with "certificate-based". The private key never leaves the device Except that phishing doesn't require the private key - it just needs to echo back the generated token. And even if that isn't possible, what stops it obtaining the session token that's sent back?
        mr_mitm 3y ago
        The phisher will not receive a valid token, though, because you sign something that contains the domain you are authenticating to.
        deleted 3y ago
        [deleted]
        RaisingSpear 3y ago
        The phisher can just pass on whatever you sign, and capture the token the server sends back. Sure, you can probably come up with some non-HTTPS scheme that can address this, but I don't see any site actually doing this, so you're back to the unrealistic scenario.
        mr_mitm 3y ago
        No, because the phisher will get a token that is designated for, say, mircos0ft.com which microsoft.com will not accept. It is signed with the user's private key and the attacker cannot forge a signature without it.
ndriscoll 3y ago
These scenarios are getting into some Mission Impossible level threats. Most people use their phones most of the time now, meaning the MFA device is the same device they're using. Of the people who aren't using a phone, how many are using a laptop with a built in keyboard? It's pretty obvious if you have a USB dongle hanging off your laptop. If you're using a desktop, it's going to be in a relatively secure environment. Bluetooth probably doesn't even reach outside. No one's breaking into my house to plant a keylogger. And a wireless keyboard seems kind of niche for a desktop. It's not going to move, so you're just introducing latency, dropouts, and batteries into a place where they're not needed. Long, random, unique passwords are phishing resistant. I don't know my passwords to most sites. My web browser generates and stores them, and only uses them if it's on the right site. This has been built in functionality for years, and ironically it's sites like banks that are most likely to disable auto fill and require weak, manual passwords.
- mr_mitm 3y ago
  I mean, both can be true at the same time. I have to admit that I only use MFA when I'm forced to, because I also believe my strong passwords are good enough. Yet I can still acknowledge that MFA improves security further and in particular I can see why certain services make it a requirement, because they don't control how their users choose and use their passwords and any user compromise is associated with a real cost, either for them like in the case of credit card companies or banks, or a cost for society, like PyPI, Github, etc.
martinflack 3y ago
These days I wonder about all the cameras in a modern environment and "keylogging" from another device filming the user typing.

RaisingSpear 3y ago

But password managers typically don't send keyboard commands to fill in a password, so a physical device would be useless. > There are plenty of scenarios where MFA is more secure than just a strong password. And how realistic are they? Or are they just highly specific scenarios where all the stars must align, and are almost never going to happen?

mr_mitm 3y ago
I don't think phishing is such an obscure scenario. The point is also that you as an individual can make choices and assess risk. As a large service provider, you will always have people who reuse passwords, store them unencrypted, fall for phishing, etc. There is a percentage of users that will get their account compromised because of bad password handling which will cost you, and by enforcing MFA you can decrease that percentage, and if you mandate yubikeys or something similar the percentage will go to zero.
- RaisingSpear 3y ago
  > I don't think phishing is such an obscure scenario. For a typical person, maybe, but for a tech-minded individual who understands security, data entropy and what /dev/random is? And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. I'm also looking at this from the perspective of an individual, not a service provider, so the activities of the greater percentage of users is of little interest to me.
  - mr_mitm 3y ago
    > And I don't see how MFA stops phishing - it can get you to enter a token like it can get you to enter a password. That's why I qualified it with "certificate-based". The private key never leaves the device, ideally a yubikey-type device.
    - RaisingSpear 3y ago
      > That's why I qualified it with "certificate-based". The private key never leaves the device Except that phishing doesn't require the private key - it just needs to echo back the generated token. And even if that isn't possible, what stops it obtaining the session token that's sent back?
      - mr_mitm 3y ago
        The phisher will not receive a valid token, though, because you sign something that contains the domain you are authenticating to.
        deleted 3y ago
        [deleted]
        RaisingSpear 3y ago
        The phisher can just pass on whatever you sign, and capture the token the server sends back. Sure, you can probably come up with some non-HTTPS scheme that can address this, but I don't see any site actually doing this, so you're back to the unrealistic scenario.
        mr_mitm 3y ago
        No, because the phisher will get a token that is designated for, say, mircos0ft.com which microsoft.com will not accept. It is signed with the user's private key and the attacker cannot forge a signature without it.

ndriscoll 3y ago

These scenarios are getting into some Mission Impossible level threats. Most people use their phones most of the time now, meaning the MFA device is the same device they're using. Of the people who aren't using a phone, how many are using a laptop with a built in keyboard? It's pretty obvious if you have a USB dongle hanging off your laptop. If you're using a desktop, it's going to be in a relatively secure environment. Bluetooth probably doesn't even reach outside. No one's breaking into my house to plant a keylogger. And a wireless keyboard seems kind of niche for a desktop. It's not going to move, so you're just introducing latency, dropouts, and batteries into a place where they're not needed. Long, random, unique passwords are phishing resistant. I don't know my passwords to most sites. My web browser generates and stores them, and only uses them if it's on the right site. This has been built in functionality for years, and ironically it's sites like banks that are most likely to disable auto fill and require weak, manual passwords.

mr_mitm 3y ago
I mean, both can be true at the same time. I have to admit that I only use MFA when I'm forced to, because I also believe my strong passwords are good enough. Yet I can still acknowledge that MFA improves security further and in particular I can see why certain services make it a requirement, because they don't control how their users choose and use their passwords and any user compromise is associated with a real cost, either for them like in the case of credit card companies or banks, or a cost for society, like PyPI, Github, etc.

martinflack 3y ago

These days I wonder about all the cameras in a modern environment and "keylogging" from another device filming the user typing.