Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bleak picture of two-factor authentication adoption in the wild

elie.net

Post reply on HN
Print view View original

21–30 of 96 posts

Re: The bleak picture of two-factor authentication adoption in the wild

#21

Post by dev_dull »

seppin wrote: post #19
reconbot wrote: post #2

I was having an argument over 1password's 2fa support not being a second factor. (I don't think it is.) However, it is so much safer than not using 2fa. In similar terms U2F is amazing and keeps you from being phished and has a great challenge/response protocol, if that was implemented in 1password (or browsers themselves thank you!) we'd all be a lot safer than not using it at all. In 2018 I'm using an app to take s…

> (I don't think it is.) If your master password is someone exposed, then nothing really protects you.

Wouldn’t an 2fa device (such as an otp token) actually protect you in this case? They have your password but not your otp generator.

Re: The bleak picture of two-factor authentication adoption in the wild

#22

Post by paraditedc »

So here's how I use 2FA apps:

I have my primary phone with Authy and all the accounts.

I also have a secondary (old) phone in my drawer, which also has Authy installed. Both of them automatically sync the 2FA accounts in my Authy account, which is linked to my email and phone number. In the event that my primary phone is not available, I can switch to my secondary phone quickly.

Is that a good practice? I also plan to get physical keys and do the same when they become more popular.

Re: The bleak picture of two-factor authentication adoption in the wild

#23

Post by Godel_unicode »

spiritcat wrote: post #7
spydum wrote: post #5

Earlier quoted context omitted.

The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.

Google authentication is great, until it's time to get a new phone.

Print out the QR code and store it in a safe.

Re: The bleak picture of two-factor authentication adoption in the wild

#24

Post by Kalium »

paraditedc wrote: post #22

So here's how I use 2FA apps: I have my primary phone with Authy and all the accounts. I also have a secondary (old) phone in my drawer, which also has Authy installed. Both of them automatically sync the 2FA accounts in my Authy account, which is linked to my email and phone number. In the event that my primary phone is not available, I can switch to my secondary phone quickly. Is that a good practice? I also plan t…

Your heavy use of 2FA is a good practice.

That said, linking SMS often allows for SMS to be used to reset passwords. As sim swapping and phone cloning become more common attacks, the level of protection you gain from having SMS available drops. These attacks essentially let someone else receive your texts or calls. I have at least one friend who has been attacked this way.

Re: The bleak picture of two-factor authentication adoption in the wild

#25

Post by witten »

sethhochberg wrote: post #10
spiritcat wrote: post #7

Earlier quoted context omitted.

Google authentication is great, until it's time to get a new phone.

Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices. Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.

Also, check out andOTP on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

Open source and supports backups.

Re: The bleak picture of two-factor authentication adoption in the wild

#26

Post by everybodyknows »

spydum wrote: post #5
schaefer wrote: post #3

It completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for second factor authentication (to protect my video game account). Where as I feel I'm still waiting for my bank (actual money) to catch up. they took the easy way out by sms-ing me a second factor authentication key. Even though phone number theft is a known a…

The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.

Some financial providers offer a 2FA choice at login that includes email. The 2FA email can be directed to an account protected by a hardware key.

Re: The bleak picture of two-factor authentication adoption in the wild

#27

Post by blfr »

u801e wrote: post #17
laretluval wrote: post #13

2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users. I would rather be hacked than deal with 2FA.

The right way to do it is to use client-side TLS certificates in combination with the username and password. Add in a passphrase for the private key and you could have 3FA. All that's really needed is for browser vendors to improve their UI for generating certificate signing requests and importing certificates.

No, the right way is U2F. You touch a dongle and you're in. And there's no way to steal your key without physically getting the dongle.

Re: The bleak picture of two-factor authentication adoption in the wild

#28

Post by lemoncucumber »

I got a new phone recently and was dismayed at how easy it was to reset the 2FA on various accounts. Some fall back to SMS in that case (which has well-documented insecurities), while others allow you to call customer support and reset it without providing too much to prove that you’re the account owner. There has to be a path for people who lose or break their phones with their Authenticator apps, but I’d feel better if it was a little more difficult than it seems to be in most cases.

Re: The bleak picture of two-factor authentication adoption in the wild

#29

Post by seppin »

dev_dull wrote: post #21
seppin wrote: post #19

Earlier quoted context omitted.

> (I don't think it is.) If your master password is someone exposed, then nothing really protects you.

Wouldn’t an 2fa device (such as an otp token) actually protect you in this case? They have your password but not your otp generator.

Yes but to have your MP they'd most likely have rooted your device, they could surely do the same to your mobile.

If they could do one, they can do the other. Just a matter of efforts I guess

Re: The bleak picture of two-factor authentication adoption in the wild

#30

Post by lcabral »

spiritcat wrote: post #7
spydum wrote: post #5

Earlier quoted context omitted.

The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.

Google authentication is great, until it's time to get a new phone.

A while back because of shifting mobiles a lot ( due to repairing my mobile and also having a temporary replacement) I ended up making a rudimentary program to store shows codes and even qrcodes for reading from the mobile working in my Linux terminal. https://github.com/lcabral37/terminalOathApp

It did the work and even today I use it every now and then, instead of pulling out the mobile.

Post reply on HN