Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is a secure way to allow 2FA resets?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Ask HN: What is a secure way to allow 2FA resets?

#31

Post by xfitm3 »

steventhedev wrote: post #6

Consider the threat model: An adversary takes over the email account, and checks if they reused their password on your site. If they didn't, then they'll try to reset the password, and you should check the second factor before resetting the password. If they did reuse their password, then you should check the second factor on login (assuming it's coming from a previously unrecognized source). At this point, the attac…

A service I use requires me to resubmit my identification every year. Interestingly they do not allow scanned images. It must be a photo of the credential.

In another thread here users reported success in sending Facebook IDs that have been photoshopped.

We first all need to agree on how we will authenticate government IDs before we can trust them.

Re: Ask HN: What is a secure way to allow 2FA resets?

#32

Post by Klathmon »

PaulAJ wrote: post #3

One option would be on the sign-up side: get them to "test" the recovery option. Keep bugging them about it every log-in until they do. This has two advantages: 1: This sends the message that you think it important, which might help them realise it is too. 2: They will have printed the QR code. Putting it somewhere safe is a small additional step.

Even then a backup code like that isn't going to work in all cases.

This is the same issue that electronic/cryptographic voting schemes run into.

You can't in many cases just tell your user "too bad you lost the code", you need a way for a user who has lost everything to get back in.

Shit happens, theft, floods, fires, other natural disasters, etc... And in those cases it's somewhat common for the user to lose their phone (with the 2nd factor app on it), as well as their backup codes.

Sure, a game might be able to get away with saying "sorry, you lost your 2fa and backup, so you are SOL" (the user won't be happy, but it's not the end of the world), but for a bank account? For a utility company? For your email account? Telling the user "so sorry you are fucked" is a very bad thing, and could even be illegal in some cases.

Forcing the user to verify that they printed it out and saved it can help cut down on the number of reset requests, but it won't completely solve the problem. You still need a way for someone who has lost everything to get the account back.

Re: Ask HN: What is a secure way to allow 2FA resets?

#34

Post by 3pt14159 »

Most answers here are things that won't work because people are human and will lose or forget stuff one way or another. What I've seen that works quite well is to have a user list a number of email accounts that they trust to vouch for them. If they lose their 2FA and 2FA backup then they can do an email reset, but only if n of m of their friends authorize it and only after a delay of some kind (24 hours, say). Now an attacker needs to figure out what the likely friendlies are, pop multiple email accounts, and the delay gives enough time for someone to notice something and lock the account down.

Re: Ask HN: What is a secure way to allow 2FA resets?

#35

Post by naravara »

nindalf wrote: post #17
segfaultbuserr wrote: post #2

This is the most tricky issue about 2FA: who's going to authenticate the authentication system? From what I've seen in practice, if an account is lost, there are two primary ways for recovery. (A) Secret key. When a user is setting up 2FA for his/her account, the system generates a secret passphrase/QR Code as a crypto key, with instructions for user to write it down or print it out, then store it at a secure locatio…

A. OP's original problem is that users aren't noting down the secret when they're requested to. B. Manual review works, unless there is a sufficient incentive to break it. Here's an example of PlayStation Network struggling with hackers disabling 2FA via customer support - https://waypoint.vice.com/en_us/article/43ebpd/the-long-weir... C. If a user is resetting 2FA then most likely they've lost the device on which th…

>D. Reset via email is the most commonly used one. It's scalable, unlike manual review. Less secure, arguably.

What's the argument that it's not any less secure? That seems like a pretty obvious conclusion to me.

Re: Ask HN: What is a secure way to allow 2FA resets?

#36

Post by arama471 »

Put a timer on the reset - Allow them to start the reset process, but make it so it takes a while (At least a few days), and during that time make sure any successfully logged in person on that account sees large warnings that someone is resetting their 2FA. This ensures that whoever actually owns the account can react in time to stop a takeover, at the cost of making the reset process kindda painful.

Re: Ask HN: What is a secure way to allow 2FA resets?

#38

Post by totallyashill »

naravara wrote: post #35
nindalf wrote: post #17

Earlier quoted context omitted.

A. OP's original problem is that users aren't noting down the secret when they're requested to. B. Manual review works, unless there is a sufficient incentive to break it. Here's an example of PlayStation Network struggling with hackers disabling 2FA via customer support - https://waypoint.vice.com/en_us/article/43ebpd/the-long-weir... C. If a user is resetting 2FA then most likely they've lost the device on which th…

>D. Reset via email is the most commonly used one. It's scalable, unlike manual review. Less secure, arguably. What's the argument that it's not any less secure? That seems like a pretty obvious conclusion to me.

Password reuse and 2FA enforcement.

Although, we at HN are the shining tier of amazingness (/s), most people will use the same password across as many accounts as they can, or use some dirivation of the password.

The bigger issue is that plenty of people don't enable 2FA onto their emails as it's never really suggested by the providers, some just don't support it, and the fear of getting locked out of something so central.

It's better than SMS 2nd Factor though.

Re: Ask HN: What is a secure way to allow 2FA resets?

#39

Post by naravara »

Klathmon wrote: post #32
PaulAJ wrote: post #3

One option would be on the sign-up side: get them to "test" the recovery option. Keep bugging them about it every log-in until they do. This has two advantages: 1: This sends the message that you think it important, which might help them realise it is too. 2: They will have printed the QR code. Putting it somewhere safe is a small additional step.

Even then a backup code like that isn't going to work in all cases. This is the same issue that electronic/cryptographic voting schemes run into. You can't in many cases just tell your user "too bad you lost the code", you need a way for a user who has lost everything to get back in. Shit happens, theft, floods, fires, other natural disasters, etc... And in those cases it's somewhat common for the user to lose their…

>Shit happens, theft, floods, fires, other natural disasters, etc... And in those cases it's somewhat common for the user to lose their phone (with the 2nd factor app on it), as well as their backup codes. >Sure, a game might be able to get away with saying "sorry, you lost your 2fa and backup, so you are SOL" (the user won't be happy, but it's not the end of the world), but for a bank account? For a utility company? For your email account? Telling the user "so sorry you are fucked" is a very bad thing, and could even be illegal in some cases.

In some cases you might be able to get away with using waiting periods. You can establish like a month or so and ask them to re-request after that with a recovery code you give them when they first make a request.

If nobody accesses the account in that time, you can have a bit more confidence that the request is legitimate and the account owner really has lost their credentials. And then when they re-request with their recovery code that's the authorization to start the reset.

In some cases you could tide them over with a temporary account that has limited privileges for the duration of the waiting period that can be merged back into the original account once its unlocked. You could probably even do some analysis behavior in the temp account to see how well it matches up with points of contact, frequency of use, word choice, location, etc. on the main account.

I wouldn't trust that for a bank or a primary email, you really need to verify identity for that. But for a utility company it might be ok.

Re: Ask HN: What is a secure way to allow 2FA resets?

#40

Post by miketery »

I've been pondering a trusted network using shamir secret sharing for this case - where you can rely on other parties to hold the secret key and call on them. For example, origin player loses 2FA to system A, origin player calls out to their immediate backup personnel (origin player sets limit of how many are required to recover secret). Each backup personnel can say OK - sending partial to system A, once enough have been sent the secret is recovered. Complex, and time in-detriment, and still prone to failure or breach of trust.
Post reply on HN