3 ms·
I can't help but think maybe this is similar to having only the login screen https, but the rest of the site http with the auth cookie being passed around in cl
by taf2 13y ago
I can't help but think maybe this is similar to having only the login screen https, but the rest of the site http with the auth cookie being passed around in clear text... Initially, we thought we were being more secure because we secured the transfer of the password to the website, but in reality the auth cookie is just as important.
In the case of typical 2 factor authentication via phone - if I can reset your password via a code being sent to your phone, then you've lowered the security of your password from maybe an 8 digit password to a 4 digit numeric pin...
Of course, I would need to know your phone number, which may be difficult to guess?
- uxp 13y agoBasic 2 factor authentication doesn't even cover the scope of password resets, so the idea that 2FA is flawed when used in conjunction with cellular networks is a terribly unthought out argument. If any service uses a token reset code sent to a phone as SMS or voice message, then that service is using a flawed password reset mechanism using the idea that cellular networks are highly insecure, regardless if it's also using 2FA. _Any_ single authentication mechanism over cellular networks is flawed using the same logic. 2FA, arguably, is more secure over cellular networks because it requires an authentication mechanism (the password) that is not transmitted over SMS/voice cellular in a plain format (assuming the authentication itself is sent over TLS/SSL).
- taf2 13y agogreat points, clearly i was misunderstanding, the reset mechanics i was describing are clearly a very bad idea and not 2 factor. thanks!