Show HN: Generate shared 2FA codes for your entire team
1–10 of 43 posts
Re: Show HN: Generate shared 2FA codes for your entire team
#2I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.
Re: Show HN: Generate shared 2FA codes for your entire team
#3Interesting approach with Slack. This works differently and without Slack:
https://blog.saaspass.com/sharing-authenticator-codes-with-t...
Re: Show HN: Generate shared 2FA codes for your entire team
#4I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.
The use case seems to be to bypass any value provided in using 2FA in the first place...
Re: Show HN: Generate shared 2FA codes for your entire team
#5I can see the use case in this (even though it entirely defeats the purpose of 2FA) but one glaring omission I see on the homepage screenshots is the lack of an audit log. I supposed I could trust others with one-time codes, but I'd like to verify that nobody is doing anything funky (e.g. a disgruntled employee or a compromised account) in a quick who-did-what-when dashboard, maybe even with a notification when someone is requesting a lot of codes.
If access requests are actually being logged, the audit dashboard deserves a place on the home page in my opinion.
Re: Show HN: Generate shared 2FA codes for your entire team
#6I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.
The use case seems to be to bypass any value provided in using 2FA in the first place...
I'm not sure I agree with that. There's a lot of different values provided by 2FA which this preserves:
- secrets are not static, unlike passwords, reducing risks from logging/monitoring code or certain types of keyloggers (especially hardware keyloggers)
- secrets cannot be human-generated and are known to be high-entropy (password managers can also effectively ensure this)
- secrets cannot be shared across multiple websites (password managers can also effectively ensure this)
- you can revoke access to someone's future ability to authenticate without having to change passwords
Depending on exactly how you choose to implement it (namely, how you choose to set up Slack logins/SSO), you might also get
- login effectively requires attestation of identity that are independent of "knows a secret," such as "has a certain physical object" or "is coming in from a particular network" or "passes certain behavior checks/hueristics"
You don't get
- long-term secrets cannot be stolen by malware because they are fixed in a physical object
- the 2FA mechanism is capable of authenticating only to the specific website, eliminating phishing risks (password managers can also effectively ensure this)
but if you're not using a hardware code generator (and possibly not even that, see also the RSA seed breach) or a WebAuthn device, you aren't getting those anyway.
Re: Show HN: Generate shared 2FA codes for your entire team
#7Why?
Re: Show HN: Generate shared 2FA codes for your entire team
#8Why not just share the seed for the 2fa with close team members... you have to back it up anyway.
Re: Show HN: Generate shared 2FA codes for your entire team
#9I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.
What if a trusted employee is reusing the same password everywhere including slack?
Re: Show HN: Generate shared 2FA codes for your entire team
#10I get the use case, but I just can’t get behind using software like this for security reasons. It’s too easy to add users to slack, leading to accidentally exposing secrets.
One conscious decision made when building this was not to blast 2FA codes inside some channel where potentially anyone can see them, which would indeed be pretty bad when users are constantly being added to your Slack workspace.
Instead, codes are fetched by explicitly using the slash command and only users who are granted access to them can see them. So if a new person joins your team and types `/tfa` into the box, they won't see anything because nobody has given them access to any codes.
Does that make sense?