6 ms·

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less o

by suresk 14y ago

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less of an annoyance. About a month ago, one of my credit card accounts got hacked and was used to send money to someone else - the number itself wasn't compromised, it was the actual account. No doubt, the attackers tried to login and change my email password, but had to settle on the next best thing - spamming my email address with hundreds of emails per minute in an attempt to cover up the emails sent by my CC company. Fortunately, the spamming wasn't very sophisticated and it only took me 30 seconds to filter it all to trash. I was on the phone with my credit card company within 10 minutes of the attack, which mitigated some of the damage. I'm sure at some point weaknesses will be found in the 2-factor auth solution, but for now, it feels almost mandatory for important email accounts.

irq 14y ago
2-factor auth has been cracked before [1] and will be again until there is a standard on how to implement it. With implementations differing between companies, a cracker can play one org's weakness off another org. Like in this case, using the freely-available trailing 4 digit CC code from Amazon to get into Apple. If both companies agreed to a standard that made it obvious such practices were non-compliant, this wouldn't have happened. 1: http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app http://blog.cloudflare.com/post-mortem-todays-attack-apparen...
- spacemanaki 14y ago
  > 2-factor auth has been cracked before I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. The linked breach was likely due to a social engineering attack on phone company support staff. Yes, it's concerning, and something Google and the phone companies should be investigating, but no, 2-factor auth wasn't "cracked." Someone who's more informed than I, is there really a weakness in smart-phone based two factor authentication if you choose NOT to use the SMS or voice based backup, out-of-band authentication option? I'm pretty sure that is an optional feature of Google's 2-factor auth, with printed backup codes being the alternative.
  - adgar 14y ago
    > I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. FUD will never go away. Don't let it get to you.
  - rdl 14y ago
    Given your iCloud account and/or root on the PC paired to your iPhone, I think it would be possible to compromise your Google Authenticator app. At the limit, jailbreak the connected phone, but I think it could be done more simply (all you need to do is run the Authenticator app and see the screen within 60 seconds, which should be possible from a connected, paired Mac). On Android, way way easier, due to lack of secure device storage. Just get a copy of the disk image and then you've got the seed too. It's still better than a password, but not as good as an actually secure independent factor. Sadly the SecurID sucks.
    - adgar 14y ago
      You're talking way past the problem that's being solved by Authenticator. If your device is physically compromised with 2-factor auth you need to change your password, end of story. There's no point in discussing how the system holds up to a scenario the system is not intended to address. Password reset is assumed if you lose your damn smartphone. When someone steals your credit card, you just cancel the card and move on with your life. You don't call the credit card's data protection technology a failure. And changing your iCloud/Google/really any password is an orders-of-magnitude better user experience than canceling a credit card. > It's still better than a password, but not as good as an actually secure independent factor. Companies like Google have real, statistically significant data on how much 2-factor auth reduces account compromise. Your claims to the contrary seem to be rooted in an academic (at best) perception of weakness in the technology.
      - rdl 14y ago
        The problem with Authenticator is that it is usually paired to a personal computer, on a personal phone (or a phone used for everything; the BYOD trend is a lot bigger with phones than computers). If your work accounts use Authenticator, even on relatively secure machines, compromising your personal laptop becomes enough to compromise the phone and thus work accounts, even if the personal laptop isn't used for those accounts. This is a bigger problem with the iPhone due to iTunes -- people pair with a machine which has a lot of music, may be used for general downloading, shared in a family, etc. The attack can be done by pwning your personal computer, waiting for you to connect your iPhone via wifi or cable to it, and then remote-proxying the display on your phone to the attacker via the compromised personal computer. This would all be undetectable to the user. Even a bad two factor system is better than passwords from a large service provider's perspective. Two factor using a phone isn't as secure as fully independent two factor for enterprise use. Add to this that many high security environments don't allow phones, or that people carry only a single device (phone or maybe phone+tablet, often), and the "phone as two factor" becomes a lot less useful. The big problem is having to carry multiple tokens, the cost of physical tokens (including replacement/management costs), and that no one makes a decent physical token at present. iOS + some kind of "secure device-local mode" for the OS (which couldn't be remote-accessed for display, and which doesn't get pushed in backups (keystore-like), would make something like Authenticator much closer to a physical token in security. The funny thing is WP8 actually has the tools to build this, and Enterprise (i.e. huge windows deployments with good device management) is the environment where it would be useful.
unfletch 14y ago
"...but had to settle on the next best thing - spamming my email address with hundreds of emails per minute in an attempt to cover up the emails sent by my CC company." Here's an article from just last month about this very technique: https://krebsonsecurity.com/2012/07/cyberheist-smokescreen-email-phone-sms-floods/ https://krebsonsecurity.com/2012/07/cyberheist-smokescreen-e... Flooding someone's inbox (or telephone) is now available as a very affordable a la carte service.
cubicle67 14y ago
the weakness with 2-factor auth is that almost all of us with a smartphone use that phone for email. And that phone is the same one google sends the sms to...
- adgar 14y ago
  Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.
  - deleted 14y ago
    [deleted]
  - drgath 14y ago
    On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options: * Use a backup code. Learn more * Send to your backup phone number ending in ## * I cannot access any of my phones Learn more I presume option #2 is the one cubicle67 is referring to. So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...
    - adgar 14y ago
      > So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr... If someone gets your wallet, they can use your credit cards to gain access to your credit. You cancel the credit cards. Move on with your life. Your phone already matters as much as your wallet now - that's just reality. Secure your phone as best you can. Use full-disk encryption wherever backups are stored. Don't give your phone to people you can't trust. Change your password if you lose it or it gets stolen. Move on. These are tools to solve problems, not shrines to worship.
    - tytso 14y ago
      > So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr... Only if they also know your password. That's why it's called "two factor authentication". Simply compromising your password is not enough. They also have to capture your phone. Now, if you're stupid enough to write your password on the back of your phone.... you deserve everything that's coming to you.
ghshephard 14y ago
I've been using google two-factor auth for the better part of a year now, and the annoyance comes down to, once every 30 days or so, having to take 5 extra seconds during login to enter a code sent to my cell phone. I can't _think_ of anything less of a hassle.
- landr0id 14y ago
  Google has actually made it even less of a hassle by instead trusting a computer forever instead of having the session last 30 days [1]. This can be seen two ways though: less of a hassle for the user, and less secure. I wonder why Google doesn't give the option for the session lasting 30 days or forever. [1] http://i.imgur.com/A9Wu5.png http://i.imgur.com/A9Wu5.png
  - graeme 14y ago
    That's horrible. It was already very easy, I don't see the need.
    - rdl 14y ago
      You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.
      - evanmoran 14y ago
        http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines
        zalew 14y ago
        so if someone wants access to all your passwords, he just needs to compromise your dropbox.

by suresk 14y ago

irq 14y ago

2-factor auth has been cracked before [1] and will be again until there is a standard on how to implement it. With implementations differing between companies, a cracker can play one org's weakness off another org. Like in this case, using the freely-available trailing 4 digit CC code from Amazon to get into Apple. If both companies agreed to a standard that made it obvious such practices were non-compliant, this wouldn't have happened. 1: http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app http://blog.cloudflare.com/post-mortem-todays-attack-apparen...

spacemanaki 14y ago
> 2-factor auth has been cracked before I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. The linked breach was likely due to a social engineering attack on phone company support staff. Yes, it's concerning, and something Google and the phone companies should be investigating, but no, 2-factor auth wasn't "cracked." Someone who's more informed than I, is there really a weakness in smart-phone based two factor authentication if you choose NOT to use the SMS or voice based backup, out-of-band authentication option? I'm pretty sure that is an optional feature of Google's 2-factor auth, with printed backup codes being the alternative.
- adgar 14y ago
  > I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. FUD will never go away. Don't let it get to you.
- rdl 14y ago
  Given your iCloud account and/or root on the PC paired to your iPhone, I think it would be possible to compromise your Google Authenticator app. At the limit, jailbreak the connected phone, but I think it could be done more simply (all you need to do is run the Authenticator app and see the screen within 60 seconds, which should be possible from a connected, paired Mac). On Android, way way easier, due to lack of secure device storage. Just get a copy of the disk image and then you've got the seed too. It's still better than a password, but not as good as an actually secure independent factor. Sadly the SecurID sucks.
  - adgar 14y ago
    You're talking way past the problem that's being solved by Authenticator. If your device is physically compromised with 2-factor auth you need to change your password, end of story. There's no point in discussing how the system holds up to a scenario the system is not intended to address. Password reset is assumed if you lose your damn smartphone. When someone steals your credit card, you just cancel the card and move on with your life. You don't call the credit card's data protection technology a failure. And changing your iCloud/Google/really any password is an orders-of-magnitude better user experience than canceling a credit card. > It's still better than a password, but not as good as an actually secure independent factor. Companies like Google have real, statistically significant data on how much 2-factor auth reduces account compromise. Your claims to the contrary seem to be rooted in an academic (at best) perception of weakness in the technology.
    - rdl 14y ago
      The problem with Authenticator is that it is usually paired to a personal computer, on a personal phone (or a phone used for everything; the BYOD trend is a lot bigger with phones than computers). If your work accounts use Authenticator, even on relatively secure machines, compromising your personal laptop becomes enough to compromise the phone and thus work accounts, even if the personal laptop isn't used for those accounts. This is a bigger problem with the iPhone due to iTunes -- people pair with a machine which has a lot of music, may be used for general downloading, shared in a family, etc. The attack can be done by pwning your personal computer, waiting for you to connect your iPhone via wifi or cable to it, and then remote-proxying the display on your phone to the attacker via the compromised personal computer. This would all be undetectable to the user. Even a bad two factor system is better than passwords from a large service provider's perspective. Two factor using a phone isn't as secure as fully independent two factor for enterprise use. Add to this that many high security environments don't allow phones, or that people carry only a single device (phone or maybe phone+tablet, often), and the "phone as two factor" becomes a lot less useful. The big problem is having to carry multiple tokens, the cost of physical tokens (including replacement/management costs), and that no one makes a decent physical token at present. iOS + some kind of "secure device-local mode" for the OS (which couldn't be remote-accessed for display, and which doesn't get pushed in backups (keystore-like), would make something like Authenticator much closer to a physical token in security. The funny thing is WP8 actually has the tools to build this, and Enterprise (i.e. huge windows deployments with good device management) is the environment where it would be useful.

unfletch 14y ago

"...but had to settle on the next best thing - spamming my email address with hundreds of emails per minute in an attempt to cover up the emails sent by my CC company." Here's an article from just last month about this very technique: https://krebsonsecurity.com/2012/07/cyberheist-smokescreen-email-phone-sms-floods/ https://krebsonsecurity.com/2012/07/cyberheist-smokescreen-e... Flooding someone's inbox (or telephone) is now available as a very affordable a la carte service.

cubicle67 14y ago

the weakness with 2-factor auth is that almost all of us with a smartphone use that phone for email. And that phone is the same one google sends the sms to...

adgar 14y ago
Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.
- deleted 14y ago
  [deleted]
- drgath 14y ago
  On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options: * Use a backup code. Learn more * Send to your backup phone number ending in ## * I cannot access any of my phones Learn more I presume option #2 is the one cubicle67 is referring to. So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...
  - adgar 14y ago
    > So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr... If someone gets your wallet, they can use your credit cards to gain access to your credit. You cancel the credit cards. Move on with your life. Your phone already matters as much as your wallet now - that's just reality. Secure your phone as best you can. Use full-disk encryption wherever backups are stored. Don't give your phone to people you can't trust. Change your password if you lose it or it gets stolen. Move on. These are tools to solve problems, not shrines to worship.
  - tytso 14y ago
    > So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr... Only if they also know your password. That's why it's called "two factor authentication". Simply compromising your password is not enough. They also have to capture your phone. Now, if you're stupid enough to write your password on the back of your phone.... you deserve everything that's coming to you.

ghshephard 14y ago

I've been using google two-factor auth for the better part of a year now, and the annoyance comes down to, once every 30 days or so, having to take 5 extra seconds during login to enter a code sent to my cell phone. I can't _think_ of anything less of a hassle.

landr0id 14y ago
Google has actually made it even less of a hassle by instead trusting a computer forever instead of having the session last 30 days [1]. This can be seen two ways though: less of a hassle for the user, and less secure. I wonder why Google doesn't give the option for the session lasting 30 days or forever. [1] http://i.imgur.com/A9Wu5.png http://i.imgur.com/A9Wu5.png
- graeme 14y ago
  That's horrible. It was already very easy, I don't see the need.
  - rdl 14y ago
    You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.
    - evanmoran 14y ago
      http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines
      - zalew 14y ago
        so if someone wants access to all your passwords, he just needs to compromise your dropbox.