4 ms·

Totally not my field of expertise, but maybe some like “an attacker knows all usernames, and can therefore try an attack where they attempt to log into all of t

Totally not my field of expertise, but maybe some like “an attacker knows all usernames, and can therefore try an attack where they attempt to log into all of the accounts in parallel with the TOTP ‘000000’” yields a high enough chance of hitting one or more accounts that happen to have this TOTP at this very moment?

est 2y ago
it's about same chance of trying to login all usernames with password 123456 no? An easy counter-measure would be blocking consecutive TOTP logins of the same or similar codes.
- dmurray 2y ago
  It doesn't really matter if the codes are the same. The attacker has a 1 in 1 million chance of guessing right, assuming 6-digit codes. This isn't acceptable for most applications.
  - est 2y ago
    > a 1 in 1 million chance of guessing right That's assuming there's no throttle of login requests and all authentication were made under one minute against one single user.
    - croes 2y ago
      Yes, could easily be limited to 3 attempts per 30 seconds, so people could fix typos.
    - jsnell 2y ago
      No, it is assuming neither of those things. Each independent attempt pretty obviously has those odds, no matter how many accounts and how much time they're spread over. Your suggested countermeasure does not do anything to change those odds. I think you're misreading "1 in 1 million" as "1 million in 1 million".
      - est 2y ago
        > Your suggested countermeasure does not do anything to change those odds. Actually it does change. Even if you hit the exact correct TOTP code, the system still deny your login because of throttle rules and you can't tell on the client side.
        jsnell 2y ago
        But that's not what you suggested first, and what dmurray objected to: > An easy counter-measure would be blocking consecutive TOTP logins of the same or similar codes. Which was in response to this attack: > therefore try an attack where they attempt to log into all of the accounts in parallel with the TOTP ‘000000’ That class of attack is a legitimate threat. Your proposed mitigation (quoted above, not some other mitigation) cannot work. That's because the attacker does not actually need to try consecutive or similar codes, it'll work exaclty as well with random codes. That you later changed to talking about a totally different attack (of trying a lot of codes on a single account) and a different mitigation (rate limiting of attempts on a single account) is irrelevant to that discussion.
        est 2y ago
        there's a difference between: 1. hack into any account then call it a win 2. hack into a specific target account for a win idk man. Maybe for some systems #1 is important. The goal is to replace passwords. So TOTP is is about as secure as, if not better than logins that requires 6 digit PIN, no?
        jsnell 2y ago
        I agree there is a difference between the two. The discussion was about #1, you got called out on your incorrect statements about it, and rather than admit the mistake you're pretending you were talking about #2 all along. 1 absolutely is important for real systems. Think of the account system for Google, Facebook, Steam, etc. Those accounts will have real value to an attacker even if you're only getting a random account. And no, TOTP is not as secure as a password specifically for a single-factor use case. It's brute-forceable in a way that passwords aren't, in a way that can't be fixed without a lot of collateral damage, and in a way that a high risk user can't even protect themselves against with better password hygiene[0]. A 6-digit TOTP is a decent second factor, but a horrible single factor. [0] The attack you described of trying out the password 123456 on all users is called password spraying. (Obviously you'd just not use that, but the top 100 to top 1000 passwords). But that's an attack that single users can guard against, and that systems can mitigate with basically no collateral damage. The mitigations for a TOTP-spraying attack would need to be quite draconian.
- toast0 2y ago
  In similar systems I built, 123456 is never a system selected OTP. It gets guessed too often, if it was generated, we would never know if the user got the code or just guessed.
remram 2y ago
Why is that better than trying many TOTP codes against one user?
- jsnell 2y ago
  Because you can have a rate limit on attempts against one user. You can't have an effective rate limit on attempts against all users in aggregate. Or rather, you could have one, but the consequence is that a brute-force attack would cause all legitimate users to also be blocked by the rate limit.
  - remram 2y ago
    Obviously you just rate-limit per client IP. A rate limit strategy should limit the rate of the attacker not the victim. Rate-limiting per email address is just a DoS vector, anyone can prevent a legitimate user from logging in.

est 2y ago

it's about same chance of trying to login all usernames with password 123456 no? An easy counter-measure would be blocking consecutive TOTP logins of the same or similar codes.

dmurray 2y ago
It doesn't really matter if the codes are the same. The attacker has a 1 in 1 million chance of guessing right, assuming 6-digit codes. This isn't acceptable for most applications.
- est 2y ago
  > a 1 in 1 million chance of guessing right That's assuming there's no throttle of login requests and all authentication were made under one minute against one single user.
  - croes 2y ago
    Yes, could easily be limited to 3 attempts per 30 seconds, so people could fix typos.
  - jsnell 2y ago
    No, it is assuming neither of those things. Each independent attempt pretty obviously has those odds, no matter how many accounts and how much time they're spread over. Your suggested countermeasure does not do anything to change those odds. I think you're misreading "1 in 1 million" as "1 million in 1 million".
    - est 2y ago
      > Your suggested countermeasure does not do anything to change those odds. Actually it does change. Even if you hit the exact correct TOTP code, the system still deny your login because of throttle rules and you can't tell on the client side.
      - jsnell 2y ago
        But that's not what you suggested first, and what dmurray objected to: > An easy counter-measure would be blocking consecutive TOTP logins of the same or similar codes. Which was in response to this attack: > therefore try an attack where they attempt to log into all of the accounts in parallel with the TOTP ‘000000’ That class of attack is a legitimate threat. Your proposed mitigation (quoted above, not some other mitigation) cannot work. That's because the attacker does not actually need to try consecutive or similar codes, it'll work exaclty as well with random codes. That you later changed to talking about a totally different attack (of trying a lot of codes on a single account) and a different mitigation (rate limiting of attempts on a single account) is irrelevant to that discussion.
        est 2y ago
        there's a difference between: 1. hack into any account then call it a win 2. hack into a specific target account for a win idk man. Maybe for some systems #1 is important. The goal is to replace passwords. So TOTP is is about as secure as, if not better than logins that requires 6 digit PIN, no?
        jsnell 2y ago
        I agree there is a difference between the two. The discussion was about #1, you got called out on your incorrect statements about it, and rather than admit the mistake you're pretending you were talking about #2 all along. 1 absolutely is important for real systems. Think of the account system for Google, Facebook, Steam, etc. Those accounts will have real value to an attacker even if you're only getting a random account. And no, TOTP is not as secure as a password specifically for a single-factor use case. It's brute-forceable in a way that passwords aren't, in a way that can't be fixed without a lot of collateral damage, and in a way that a high risk user can't even protect themselves against with better password hygiene[0]. A 6-digit TOTP is a decent second factor, but a horrible single factor. [0] The attack you described of trying out the password 123456 on all users is called password spraying. (Obviously you'd just not use that, but the top 100 to top 1000 passwords). But that's an attack that single users can guard against, and that systems can mitigate with basically no collateral damage. The mitigations for a TOTP-spraying attack would need to be quite draconian.
toast0 2y ago
In similar systems I built, 123456 is never a system selected OTP. It gets guessed too often, if it was generated, we would never know if the user got the code or just guessed.

remram 2y ago

Why is that better than trying many TOTP codes against one user?

jsnell 2y ago
Because you can have a rate limit on attempts against one user. You can't have an effective rate limit on attempts against all users in aggregate. Or rather, you could have one, but the consequence is that a brute-force attack would cause all legitimate users to also be blocked by the rate limit.
- remram 2y ago
  Obviously you just rate-limit per client IP. A rate limit strategy should limit the rate of the attacker not the victim. Rate-limiting per email address is just a DoS vector, anyone can prevent a legitimate user from logging in.