Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two-factor authentication is a mess

theverge.com

Post reply on HN
Print view View original

71–80 of 112 posts

Re: Two-factor authentication is a mess

#71

Post by desdiv »

kroeckx wrote: post #65
jmuguy wrote: post #29

It drives me nuts when sites insist on using SMS or Authy instead of TOTP for 2FA. I get that some users might not be sophisticated or motivated enough to setup TOTP but when somewhere like Cloudflare insists on ONLY using Authy it makes me want to look elsewhere for service. I've spoken to AT&T numerous times to see what extra steps I can take to secure my account against any changes. So far all that's led to is an…

There are other companies like Google that first require you to set it up over SMS before they allow you to add a security token.

They do that to prevent account farming. Google is one of the very few companies that refuses to accept my VoIP DID number for 2FA, because they know it's not a "real" number. A wise move, considering that SMS-capable DID numbers only cost a few dimes when you buy in bulk.

They're not insisting on 2FA-by-SMS since you can immediately disable it after you prove that you own a valid phone number and thus is much less likely to be a spammer.

Re: Two-factor authentication is a mess

#73

Post by hoorayimhelping »

>At the same time, it’s proven difficult to kill off particular types of two-factor even after they’re shown to be insecure. The National Institute of Standards and Technology quietly withdrew support for SMS-based two-factor in August, pointing to the risk of interception or spoofing, but tech companies have been slow to respond. If anything, services are relying more on SMS as Twitter and PayPal look to tie accounts more closely to phone numbers. It’s less secure, but easier to use. As long as it’s two-factor, few account holders know the difference.

Is perfect the enemy of better here? I would think that having a second factor is probably orders of magnitude more secure than not having one, even if it's a hijackable medium like sms.

Re: Two-factor authentication is a mess

#74

Post by koolba »

bpicolo wrote: post #69
koolba wrote: post #55

Earlier quoted context omitted.

It's not that they don't care. It's that $CARE_AMOUNT That formula would immediately shift if a high profile website registered on Namecheap encounters an SMS hijacking.

TOTP codes are straightforward to bootstrap. It's not rocket science.

At scale the cost of implementing a feature as wide ranging as 2FA is well beyond the tech cost. A basic TOTP implementation can be coded from scratch in an afternoon[1].

The real cost is testing to make sure a code change like this doesn't break existing users and estimating the additional support overhead of dealing with users that lose their two-factor devices.

[1] Seriously the RFC is very straightforward and readable: https://tools.ietf.org/html/rfc6238

Re: Two-factor authentication is a mess

#75

Post by jshelly »

StavrosK wrote: post #30
jmuguy wrote: post #29

It drives me nuts when sites insist on using SMS or Authy instead of TOTP for 2FA. I get that some users might not be sophisticated or motivated enough to setup TOTP but when somewhere like Cloudflare insists on ONLY using Authy it makes me want to look elsewhere for service. I've spoken to AT&T numerous times to see what extra steps I can take to secure my account against any changes. So far all that's led to is an…

I just consider them as not supporting 2FA. I'm looking at you, Namecheap. My domain registrar not having two-factor authentication in 2017 is preposterous.

A quick question for someone who knows little about 2FA. If I were to use my Google Voice account as the SMS number does that make it any more secure since it's not tied to a SIM card?

Re: Two-factor authentication is a mess

#76

Post by desdiv »

dublinben wrote: post #66
xref wrote: post #64

Namecheap is still the big one that only supports SMS 2FA for me. It has apparently been a big engineering project to add TOTP support so they've delayed it for many (4+) years. They did recently blog they were pausing all other development to add TOTP support but there has been no progress update and their initial promise of "in 60 days" has since passed... https://blog.namecheap.com/authy-based-2-factor-authenticat…

I've just moved my domains to porkbun.com instead, since they support TOTP and have equivalent or better prices.

I just buy my domain from AWS since I'm already using them for hosting. One less account to deal with and one less attack surface.

Re: Two-factor authentication is a mess

#77

Post by ibgib »

I'm looking forward to more genuine MFA. For my site, I'm experimenting with the ability to identify yourself with as many email address identities as you want (in the future the plan is to add more types including oauth, sms, etc.). If you're a regular person, you can just use one. If you're cagey, maybe two or three. Straight up paranoid, how about 10?

The point is that you are basically using an extensible claims-based approach to identity to create "aggregate identities". In the case of a beginner user, it just looks like "my account". More advanced users can add more security as necessary.

Re: Two-factor authentication is a mess

#79

Post by saltyshake »

pmlnr wrote: post #42
imron wrote: post #36

Earlier quoted context omitted.

What annoys me most about using SMS for 2FA is that it's useless if you ever travel to another country and don't have global roaming enabled.

SMS receiving is free everywhere, it has nothing to do with data roaming and generic roaming - available on the network - has been free since I had a mobile phone (~17 years). Doesn't make it a the best option though.

What ? Definitely no true if you travel cross continents.

Re: Two-factor authentication is a mess

#80

Post by Sargos »

ibgib wrote: post #77

I'm looking forward to more genuine MFA. For my site, I'm experimenting with the ability to identify yourself with as many email address identities as you want (in the future the plan is to add more types including oauth, sms, etc.). If you're a regular person, you can just use one. If you're cagey, maybe two or three. Straight up paranoid, how about 10? The point is that you are basically using an extensible claims-…

So instead of hacking 1 email/account they would just hack 2 or 3? I don't think that is adding any real security as those accounts would still just be protected by regular passwords. It makes it a tad bit harder for a hacker but not prohibitively so, because if they got the credentials to your first account then the others are probably not too much harder.

The real power of 2FA is having the code generated by you, the human, via your hardware device or software physically controlled by you and not another automated machine.

Post reply on HN