Two-factor authentication is a mess
theverge.com
Two-factor authentication is a mess
1–10 of 112 posts
Re: Two-factor authentication is a mess
#2One thing I'd like is different levels of authentication based on the importance of the action.
When I bought I house I drained by savings account and my brokerage account. It was scary that I could instantly transfer my life savings, with just a few clicks from the regular online screens I use each day. Such events should have extra authentication and some delays - like I need to take ID to a branch.
Similarly for domains - if someone wants to change some dns settings - 2FA is good enough. If someone wants transfer the domain I'd like a much higher level of proof including physical mail sent to my address and a month-long delay with multiple confirmations. I'm surprised the cut-throat world of registrars don't compete on this.
Re: Two-factor authentication is a mess
#3I lost my 2FA to AWS (my phone broke), now I have to provide:
1) A completed, signed, and notarized Identity Verification Form and Affidavit 2) A photocopy of the AWS account owner’s primary proof of identification, such as a State driver’s license or US passport. (note that I don't live in the US) 3) A photocopy of the AWS account owner’s proof of address matching the address on record (I don't live there anymore)
in order to stop them from billing me every month for resources I don't use.
I lost my MongoLab token as well, now I can only access my database over a connection string.
Now I don't enable 2FA, the chances of me losing my token are higher than the chances of me being hacked. And after 2 or 3 years I don't remember where my backup tokens are so that's not a realistic option
Re: Two-factor authentication is a mess
#4How about 2 passwords instead of 2-factor authentication?
Re: Two-factor authentication is a mess
#5> Avoid: SMS has been at the center of a lot of two-factor hacks, most recently as a way to hijack Telegram accounts in Iran. High-security accounts are already moving away from it, but a frightening number of services still keep it as an option, giving anyone who compromises your carrier account an easy way in.
I feel like this is badly phrased. SMS 2FA is far worse than other types, but still better than no 2FA.
Re: Two-factor authentication is a mess
#6I lost my 2FA to AWS (my phone broke), now I have to provide: 1) A completed, signed, and notarized Identity Verification Form and Affidavit 2) A photocopy of the AWS account owner’s primary proof of identification, such as a State driver’s license or US passport. (note that I don't live in the US) 3) A photocopy of the AWS account owner’s proof of address matching the address on record (I don't live there anymore) i…
This is why properly implemented 2FA provides backup codes when you first set it up.
I'm frankly glad that Amazon are requiring you to go to such lengths to prove your identity to bypass the 2FA and access your account. I think you should appreciate that they're taking the integrity of your account so seriously.
Re: Two-factor authentication is a mess
#7I lost my 2FA to AWS (my phone broke), now I have to provide: 1) A completed, signed, and notarized Identity Verification Form and Affidavit 2) A photocopy of the AWS account owner’s primary proof of identification, such as a State driver’s license or US passport. (note that I don't live in the US) 3) A photocopy of the AWS account owner’s proof of address matching the address on record (I don't live there anymore) i…
I only enable 2FA if it's TOTP or HOTP. In the case of TOTP I save the key (the data in the QR code) in my password manager (KeePass), in the case of HOTP my backup key is in my fireproof safe at home along with other important documents. That's admittedly a small portable box with a carry handle, so easy for a burglar to steal, but it's also easy to get to and I can take it with me if I ever have to evacuate or move.
Re: Two-factor authentication is a mess
#8I lost my 2FA to AWS (my phone broke), now I have to provide: 1) A completed, signed, and notarized Identity Verification Form and Affidavit 2) A photocopy of the AWS account owner’s primary proof of identification, such as a State driver’s license or US passport. (note that I don't live in the US) 3) A photocopy of the AWS account owner’s proof of address matching the address on record (I don't live there anymore) i…
To quote the AWS ManPage[0]:
> We recommend that when you configure a virtual MFA device to use with AWS that you save a copy of the QR code or the secret key in a secure place. That way, if you lose the phone or have to reinstall the MFA software application for any reason, you can reconfigure the app to use the same virtual MFA. This avoids the need to create a new virtual MFA in AWS for the user or root user.
That's the nice thing about TOTP[1] ("Google Authenticator"); a single relatively short string can be backed up to later restore access, or you can even print the QR code on a black & white printer.
[0] http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentia...
[1] https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
Re: Two-factor authentication is a mess
#9> Avoid: SMS has been at the center of a lot of two-factor hacks, most recently as a way to hijack Telegram accounts in Iran. High-security accounts are already moving away from it, but a frightening number of services still keep it as an option, giving anyone who compromises your carrier account an easy way in. I feel like this is badly phrased. SMS 2FA is far worse than other types, but still better than no 2FA.
>> SMS 2FA is far worse than other types, but still better than no 2FA.
It seems like every time I read about how SMS2FA was hacked it was done by some state level power that would've gotten in through some other method. I don't know if that's confirmation bias or actually true, but I think you're right, SMS is better than no 2FA. Just because the NSA etc... can easily break it doesn't mean it's useless right now. (maybe not the case in a year or two?)
Re: Two-factor authentication is a mess
#10One thing I'd like is different levels of authentication based on the importance of the action. When I bought I house I drained by savings account and my brokerage account. It was scary that I could instantly transfer my life savings, with just a few clicks from the regular online screens I use each day. Such events should have extra authentication and some delays - like I need to take ID to a branch. Similarly for d…
>> I'm surprised the cut-throat world of registrars don't compete on this.
How many people go looking for that though? For most people my guess is people go shopping for CHEAP first, EASY second, maybe LOOKS GOOD third, and some where down that list is "much more secure". I hate to say, I rarely go looking for the more secure option of anything.