3 ms·

As 2FA is becoming more standard, can't we provide a 2FA entry to be used by two individuals rather than just being provided to computers?

gs17 2y ago
I'm pretty sure you could do something with TOTP yourself, Keepass allows you to make arbitrary ones.
halJordan 2y ago
The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself your iphone shouldn't believe it is your grandson. Your answer already exists in almost every "E2EE" app. How many times does a person even access their convo partner's Safety Number/Security Code let alone verify it out of band?
- gruez 2y ago
  >The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself [...] Hardware level attestation isn't even required, and would only marginally increase security. Phones are already heavily locked down. If you're in a position to extract from app data, you're probably in a position to compromise the chat app itself, rendering any attestation pointless.
  - GauntletWizard 2y ago
    The nice thing about hardware attestation is that the app might be compromised, but only for a few versions. That's enough to pop your private key stored on disc, and to impersonate you for a short while, but then control is returned to you. You might not even notice, if it's detected by the apps security managers at all. On the flip side, the most common form of a compromise is going to be untrustworthy apps, because for some reason people still use WhatsApp
- llamaimperative 2y ago
  "I'm calling from a jail in Mexico, they took away my phone"
nonrandomstring 2y ago
How would individuals use that? There are no end of methods using devices to exchange challenge response sequences, but in practical security we have to deal with real people in real contexts. It's why encryption took 30 years to get traction. Passwords already make sense even to a primary school child. From TFA: > It's interesting that, in this new age of high-tech AI identity fraud, this ancient invention—a special word or phrase known to few—can still prove so useful. There are reasons that passwords remain and probably always will be a superior technology [0], and why adding more layers of "solutions" like biometrics and multi-factors actually just increases the attack surface. [0] https://cybershow.uk/blog/posts/secrets https://cybershow.uk/blog/posts/secrets
- deleted 2y ago
  [deleted]
- LinuxBender 2y ago
  It starts at home and is not used until required. When I was a child I was taught to say "I love you" on the phone or in person if I was under duress. We had similar processes in the military that were also taught in person or existed in a binder next to the phone. Say one phrase and everything is dandy. Say another phrase and they send in the cavalry.
  - nonrandomstring 2y ago
    You're lucky to have good carers. I wonder how many parents or organisations think to give this training? Haven't read the FBI guidance yet, but it seems they're suggesting we start teaching this outside of professional scope, to everyone. I think that's a jolly good idea and will be thinking of how to build it into civic cybersecurity syllabus. Duress signals and a challenge-response for identification are different beasts, but if we're going to teach people verbal signalling to thwart generative scams then may as well teach the whole gamut of craft.
pedalpete 2y ago
It seems all the responses I'm seeing here are thinking this would be technically handled behind the scenes. I mean literally, we both open our phones, what is the number that is linking the 2FA between our two devices. Voice authentication of a rotating password.

gs17 2y ago

I'm pretty sure you could do something with TOTP yourself, Keepass allows you to make arbitrary ones.

halJordan 2y ago

The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself your iphone shouldn't believe it is your grandson. Your answer already exists in almost every "E2EE" app. How many times does a person even access their convo partner's Safety Number/Security Code let alone verify it out of band?

gruez 2y ago
>The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself [...] Hardware level attestation isn't even required, and would only marginally increase security. Phones are already heavily locked down. If you're in a position to extract from app data, you're probably in a position to compromise the chat app itself, rendering any attestation pointless.
- GauntletWizard 2y ago
  The nice thing about hardware attestation is that the app might be compromised, but only for a few versions. That's enough to pop your private key stored on disc, and to impersonate you for a short while, but then control is returned to you. You might not even notice, if it's detected by the apps security managers at all. On the flip side, the most common form of a compromise is going to be untrustworthy apps, because for some reason people still use WhatsApp
llamaimperative 2y ago
"I'm calling from a jail in Mexico, they took away my phone"

nonrandomstring 2y ago

How would individuals use that? There are no end of methods using devices to exchange challenge response sequences, but in practical security we have to deal with real people in real contexts. It's why encryption took 30 years to get traction. Passwords already make sense even to a primary school child. From TFA: > It's interesting that, in this new age of high-tech AI identity fraud, this ancient invention—a special word or phrase known to few—can still prove so useful. There are reasons that passwords remain and probably always will be a superior technology [0], and why adding more layers of "solutions" like biometrics and multi-factors actually just increases the attack surface. [0] https://cybershow.uk/blog/posts/secrets https://cybershow.uk/blog/posts/secrets

deleted 2y ago
[deleted]
LinuxBender 2y ago
It starts at home and is not used until required. When I was a child I was taught to say "I love you" on the phone or in person if I was under duress. We had similar processes in the military that were also taught in person or existed in a binder next to the phone. Say one phrase and everything is dandy. Say another phrase and they send in the cavalry.
- nonrandomstring 2y ago
  You're lucky to have good carers. I wonder how many parents or organisations think to give this training? Haven't read the FBI guidance yet, but it seems they're suggesting we start teaching this outside of professional scope, to everyone. I think that's a jolly good idea and will be thinking of how to build it into civic cybersecurity syllabus. Duress signals and a challenge-response for identification are different beasts, but if we're going to teach people verbal signalling to thwart generative scams then may as well teach the whole gamut of craft.

pedalpete 2y ago

It seems all the responses I'm seeing here are thinking this would be technically handled behind the scenes. I mean literally, we both open our phones, what is the number that is linking the 2FA between our two devices. Voice authentication of a rotating password.