4 ms·

This is compounded by the fact most 2FA implementations are security theater not phishing-resistant, the sole exception being FIDO2/Webauthn (e.g. Yubikeys), an

by fmajid 2y ago

This is compounded by the fact most 2FA implementations are security theater not phishing-resistant, the sole exception being FIDO2/Webauthn (e.g. Yubikeys), and Passkeys, but passkeys are really single-factor authentication. Both FIDO and passkeys have serious usability challenges, though. What's worse, the most common scheme, SMS-based authentication can lead to denial of service, e.g. you are roaming and do not have access to texts, or have your account SIM-jacked as this seems to be very popular way to steal people's cryptocurrencies.

_dain_ 2y ago
>you are roaming and do not have access to texts I truly despise this. It effectively disenfranchises people for living outside of areas with good mobile coverage. Banks or utility payments or parking meters(!) or whatever should not be gated behind cellphone reception. Nevermind people who can't use a phone at all ...
- l72 2y ago
  I don’t have an international phone plan. When I travel overseas I cannot access my bank account and my primary credit card randomly asks for a phone number verification that I cannot update. I tried buying an sms number from twilio so that I could receive 2fa while out of the country but my bank (PNC) would not accept any phone number unless it was from one of the 4 major carriers in the US! My credit card (capital one) seems to have a phone number on file from Mastercard. If I change my phone number in capital one, whenever I get into the Mastercard extra verification, it does not use the updated number. I have no idea how to get Mastercard to update it. I just ended up using a different credit card!
  - fmajid 2y ago
    I moved from the US to the UK. I ported my US mobile number to Twilio, but that service is incredibly unreliable even for basic things like forwarding a call or a SMS. I had another number on Google Voice, and moved all my US accounts to it whenever possible. The great thing about Google Voice is that since Google doesn't believe in humans providing customer service (or more generally in providing customer service, period), there are no gullible CSRs that can be conned or bribed into SIM-swapping you unlike the mobile carriers.
    - throw283727 2y ago
      The bad thing about Google Voice is if Google closes your account then you're screwed.
bradley13 2y ago
This. In theory, passkeys should be great. Sort of an SSH-for-the-masses. Unfortunately, the industry has mangled the implementation, making them basically useless.
- Spivak 2y ago
  I mean they're not totally useless, in the current implementation they just can't replace passwords. I have a bunch of passkeys in my Bitwarden and they function as a "log in bypassing the 2FA screen" button. I get to skip the "we sent a code to your phone/email/butthole" flow.
- dcow 2y ago
  Funny how that always happens. Passkeys were supposed to be great and what you ended up with is platform players abusing their position to push lock in to their own passkey solutions over fair access to arbitrary 3rd party providers. When they do work smoothly they aren’t useless though.
  - gclawes 2y ago
    Android has been surprisingly awesome with cross-platform passkeys (i.e. google lets you use BitWarden/1Password/etc pretty transparently). Anything Apple related is another story... There's some good movement in the linux desktop space I'm excited about: https://github.com/linux-credentials/linux-webauthn-platform-api https://github.com/linux-credentials/linux-webauthn-platform...
    - ziml77 2y ago
      I'm using iOS and Passkeys from 1Password work there too. No problems with any browser on macOS either. On iOS I can even see a list of password & passkey providers, so I can ensure that the Apple one is toggled off (as well as MS Authenticator which can also provide those it seems)
    - dcow 2y ago
      Apple have been the best in my experience. On apple devices all 3rd party passkey providers are shown at the same time in the same UX where you’d choose iCloud (their native provider) Google Android may be good, but Chrome is not doing right yet. Chrome still tries to get you to use itself i stead of delegating to the platform selection box.
autoexec 2y ago
Passkeys can't always protect an account against phishing either (https://cyberpress.org/passkeys-with-aitm-phishing-attacks/ https://cyberpress.org/passkeys-with-aitm-phishing-attacks/) they just make it more difficult for scammers.
- vel0city 2y ago
  The article agrees passkeys can't be phished. They acknowledge they just push users to go through an unnecessary account recovery and then phish those other credentials.

by fmajid 2y ago

_dain_ 2y ago

>you are roaming and do not have access to texts I truly despise this. It effectively disenfranchises people for living outside of areas with good mobile coverage. Banks or utility payments or parking meters(!) or whatever should not be gated behind cellphone reception. Nevermind people who can't use a phone at all ...

l72 2y ago
I don’t have an international phone plan. When I travel overseas I cannot access my bank account and my primary credit card randomly asks for a phone number verification that I cannot update. I tried buying an sms number from twilio so that I could receive 2fa while out of the country but my bank (PNC) would not accept any phone number unless it was from one of the 4 major carriers in the US! My credit card (capital one) seems to have a phone number on file from Mastercard. If I change my phone number in capital one, whenever I get into the Mastercard extra verification, it does not use the updated number. I have no idea how to get Mastercard to update it. I just ended up using a different credit card!
- fmajid 2y ago
  I moved from the US to the UK. I ported my US mobile number to Twilio, but that service is incredibly unreliable even for basic things like forwarding a call or a SMS. I had another number on Google Voice, and moved all my US accounts to it whenever possible. The great thing about Google Voice is that since Google doesn't believe in humans providing customer service (or more generally in providing customer service, period), there are no gullible CSRs that can be conned or bribed into SIM-swapping you unlike the mobile carriers.
  - throw283727 2y ago
    The bad thing about Google Voice is if Google closes your account then you're screwed.

bradley13 2y ago

This. In theory, passkeys should be great. Sort of an SSH-for-the-masses. Unfortunately, the industry has mangled the implementation, making them basically useless.

Spivak 2y ago
I mean they're not totally useless, in the current implementation they just can't replace passwords. I have a bunch of passkeys in my Bitwarden and they function as a "log in bypassing the 2FA screen" button. I get to skip the "we sent a code to your phone/email/butthole" flow.
dcow 2y ago
Funny how that always happens. Passkeys were supposed to be great and what you ended up with is platform players abusing their position to push lock in to their own passkey solutions over fair access to arbitrary 3rd party providers. When they do work smoothly they aren’t useless though.
- gclawes 2y ago
  Android has been surprisingly awesome with cross-platform passkeys (i.e. google lets you use BitWarden/1Password/etc pretty transparently). Anything Apple related is another story... There's some good movement in the linux desktop space I'm excited about: https://github.com/linux-credentials/linux-webauthn-platform-api https://github.com/linux-credentials/linux-webauthn-platform...
  - ziml77 2y ago
    I'm using iOS and Passkeys from 1Password work there too. No problems with any browser on macOS either. On iOS I can even see a list of password & passkey providers, so I can ensure that the Apple one is toggled off (as well as MS Authenticator which can also provide those it seems)
  - dcow 2y ago
    Apple have been the best in my experience. On apple devices all 3rd party passkey providers are shown at the same time in the same UX where you’d choose iCloud (their native provider) Google Android may be good, but Chrome is not doing right yet. Chrome still tries to get you to use itself i stead of delegating to the platform selection box.

autoexec 2y ago

Passkeys can't always protect an account against phishing either (https://cyberpress.org/passkeys-with-aitm-phishing-attacks/ https://cyberpress.org/passkeys-with-aitm-phishing-attacks/) they just make it more difficult for scammers.

vel0city 2y ago
The article agrees passkeys can't be phished. They acknowledge they just push users to go through an unnecessary account recovery and then phish those other credentials.