Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is a secure way to allow 2FA resets?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 76 posts

Re: Ask HN: What is a secure way to allow 2FA resets?

#21

Post by dmoy »

hluska wrote: post #14

Honestly, I'd be a liar if I said that I knew. PaulAJ might have the best idea that I've read - force people to test the recovery option. Though sadly, I've never had much luck convincing really smart people to test that mission critical things like backups work, so my inner marketer fears what that kind of friction will do to user retention rates. For me, the central problem always comes down to mobile providers. I'…

> force people to test the recovery option

login.gov at least makes you prove you copied the 2fa backup number... at least on the next screen. So far that's the best I've seen.

After dealing with the shitshow that is the treasury's login, I was pleasantly surprised that login.gov appears to be pretty good. I was literally feeling sick to my stomach when creating a login.gov account in anticipation of more crap, but nope turns out it's fine :)

Re: Ask HN: What is a secure way to allow 2FA resets?

#22

Post by e12e »

rrdharan wrote: post #10
e12e wrote: post #7

You're running up against the issue of identity management. The schiboleth sso technology of colleges and research institutions solved this by letting institutions manage accounts. To reset your login, go to you it department with photo ID and request a reset. Obviously not very convenient . But one approach is to simply let a third party, like Google, do the identity management. Have only third party sso login, and…

I believe Persona is the project you are thinking of: https://en.wikipedia.org/wiki/Mozilla_Persona

Yes, thank you.

Re: Ask HN: What is a secure way to allow 2FA resets?

#23

Post by rzzzt »

segfaultbuserr wrote: post #2

This is the most tricky issue about 2FA: who's going to authenticate the authentication system? From what I've seen in practice, if an account is lost, there are two primary ways for recovery. (A) Secret key. When a user is setting up 2FA for his/her account, the system generates a secret passphrase/QR Code as a crypto key, with instructions for user to write it down or print it out, then store it at a secure locatio…

GitHub has 16 recovery keys which you can print in advance, and use if you don't have your authentication device at hand. They are also retrievable from the account's security page at any time.

https://help.github.com/articles/configuring-two-factor-auth...

Re: Ask HN: What is a secure way to allow 2FA resets?

#25

Post by lclarkmichalek »

rzzzt wrote: post #23
segfaultbuserr wrote: post #2

This is the most tricky issue about 2FA: who's going to authenticate the authentication system? From what I've seen in practice, if an account is lost, there are two primary ways for recovery. (A) Secret key. When a user is setting up 2FA for his/her account, the system generates a secret passphrase/QR Code as a crypto key, with instructions for user to write it down or print it out, then store it at a secure locatio…

GitHub has 16 recovery keys which you can print in advance, and use if you don't have your authentication device at hand. They are also retrievable from the account's security page at any time. https://help.github.com/articles/configuring-two-factor-auth...

They'll also reset it if you have the ssh private key for one of the public keys you've registered on the site

Re: Ask HN: What is a secure way to allow 2FA resets?

#26

Post by segfaultbuserr »

nindalf wrote: post #17
segfaultbuserr wrote: post #2

This is the most tricky issue about 2FA: who's going to authenticate the authentication system? From what I've seen in practice, if an account is lost, there are two primary ways for recovery. (A) Secret key. When a user is setting up 2FA for his/her account, the system generates a secret passphrase/QR Code as a crypto key, with instructions for user to write it down or print it out, then store it at a secure locatio…

A. OP's original problem is that users aren't noting down the secret when they're requested to. B. Manual review works, unless there is a sufficient incentive to break it. Here's an example of PlayStation Network struggling with hackers disabling 2FA via customer support - https://waypoint.vice.com/en_us/article/43ebpd/the-long-weir... C. If a user is resetting 2FA then most likely they've lost the device on which th…

> B. Manual review works, unless there is a sufficient incentive to break it.

In my example, there is a sufficient incentive for an attacker to break into a server though the 2FA loophole, since there are valuable assets hosted on it. This is why my hosting provider requires users to obtain and submit all the paperwork, which must be corresponded to the address in payment information.

I'd summarize the disadvantage of manual review as low-efficiency: as a casual player, I would feel ridiculous that a company requires my utility bills and passport to reset my gaming account. I'm sure a rigorous identity check was not performed your the PSN example. Poor scalability: the number of accounts is much higher in a game than in a professional service like hosting or payment. Humans need to do all the works. And prone to social engineering.

Re: Ask HN: What is a secure way to allow 2FA resets?

#29

Post by DanBC »

SheinhardtWigCo wrote: post #27
monocasa wrote: post #24

Give them FIDO keys. It's built on public/private crypto, so it's not like TOTP where the QR code is the plaintext private key that has to be distributed around like it's candy.

What happens when a user loses their FIDO key?

They use their backup key.

Re: Ask HN: What is a secure way to allow 2FA resets?

#30

Post by Klathmon »

richardwhiuk wrote: post #4

You probably want to request a reset. When a reset is requested, you should then allow a grace period - possibly up to a month for the reset to be cancelled. You should notify the user via email/out of band mechanism that a reset has been requested. On each login you should prompt that the reset is ongoing and that it can be cancelled. Finally after a month, you revoke the 2FA and allow a new device to be activated.…

This is the one that I like the best if manual human review doesn't work for your use case.

Set a reasonable time period (a month seems like really long, I was thinking more along the lines of a week), use every piece of information you have to attempt to alert the user multiple times that a reset is happening (email, text, in-app alerts, etc...), make sure that each "alert" gives the user a one-click way of stopping the reset, and when the reset is successful, delete all information that is easily replaceable (like saved credit cards or addresses, or as much personal information that you can get rid of).

Post reply on HN