Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bleak picture of two-factor authentication adoption in the wild

elie.net

Post reply on HN
Print view View original

61–70 of 96 posts

Re: The bleak picture of two-factor authentication adoption in the wild

#61

Post by zbentley »

laretluval wrote: post #13

2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users. I would rather be hacked than deal with 2FA.

> 2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users

I'd argue that it's exporting the failures of human psychology, not software security.

Sure, there are some pretty egregiously bad technologies underlying a lot of industry standard encrypted-communication/authentication/identity-management systems (including HTTPS). No argument that the tools and practices on the technical side could be way better.

But even if technical security was executed 100% perfectly, if the inputs to those systems remain usernames and passwords, people will be incredibly vulnerable. It's just too easy to [re]use weak usernames/passwords, too easy to write them down, and too easy to forget them (requiring "forgot password" attack vectors).

I agree with you that MFA is much more inconvenient than traditional U/P authentication. But I don't think it's inconvenient because of a failure in software security; it's inconvenient because it's extra work, and it has to be extra work because, well, people suck at diligence and security.

Re: The bleak picture of two-factor authentication adoption in the wild

#62

Post by jjeaff »

spiritcat wrote: post #7
spydum wrote: post #5

Earlier quoted context omitted.

The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.

Google authentication is great, until it's time to get a new phone.

Google authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.

Re: The bleak picture of two-factor authentication adoption in the wild

#63

Post by quanticle »

bdibs wrote: post #36
quanticle wrote: post #33

Earlier quoted context omitted.

What is the difference between an extra branded physical token and a 2FA app, such as Authy, on your phone?

One requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.

So I need a physical token for each of my bank accounts (3 bank accounts), each of my investment accounts (2 investment accounts), each of my e-mail providers (2 e-mail providers) and one for every other service which might want to offer 2FA. Or, instead of that, I can have one smartphone, which has an app which handles all of those 2FA codes for me. Can you understand why I would prefer the smartphone option?

Re: The bleak picture of two-factor authentication adoption in the wild

#64

Post by peterwwillis »

sethhochberg wrote: post #10
spiritcat wrote: post #7

Earlier quoted context omitted.

Google authentication is great, until it's time to get a new phone.

Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices. Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.

TOTP is old and busted, U2F is the new hotness.

https://en.m.wikipedia.org/wiki/Universal_2nd_Factor

Re: The bleak picture of two-factor authentication adoption in the wild

#65

Post by xte »

quanticle wrote: post #63
bdibs wrote: post #36

Earlier quoted context omitted.

One requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.

So I need a physical token for each of my bank accounts (3 bank accounts), each of my investment accounts (2 investment accounts), each of my e-mail providers (2 e-mail providers) and one for every other service which might want to offer 2FA. Or, instead of that, I can have one smartphone, which has an app which handles all of those 2FA codes for me. Can you understand why I would prefer the smartphone option?

So you also can possibly enjoy having 2FA demolish by a simple smartphones vulnerabilities that perhaps grab both passwords and token in a single action...

We can't trust smartphones/connected devices in general, that's why IMO is better, for safe auth only, use offline stuff.

Re: The bleak picture of two-factor authentication adoption in the wild

#66

Post by SomeHacker44 »

GoMonad wrote: post #58
JofArnold wrote: post #31

Earlier quoted context omitted.

If you have 1Password it supports OTP and thus can be used across devices.

LastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor. YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.

Lastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example.

They refused a refund as well.

Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.

Re: The bleak picture of two-factor authentication adoption in the wild

#67

Post by JulianMorrison »

schaefer wrote: post #3

It completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for second factor authentication (to protect my video game account). Where as I feel I'm still waiting for my bank (actual money) to catch up. they took the easy way out by sms-ing me a second factor authentication key. Even though phone number theft is a known a…

Barclays has the slot-your-card in pin sentry gadgets. Those are quite nifty. They don't need to be personal, because they take their pin from the bank card. So they can just hand them out.

Re: The bleak picture of two-factor authentication adoption in the wild

#68

Post by mmirate »

interfixus wrote: post #50
aasasd wrote: post #48

Earlier quoted context omitted.

So you trust all the services you use to never leak your password. Good luck with that.

Whatever gives you that idea?

The inherent limitations of human memory likely made that person assume you use a single password everywhere. Your response makes me assume that you memorize a unique password for every account.

You do you; but personally, I would rather memorize timeless things like facts and theorems - or at least ephemeral-yet-important things like deadlines, decisions, names+faces, etc. - than memorize a ton of meaningless blobs of entropy.

Re: The bleak picture of two-factor authentication adoption in the wild

#69

Post by aasasd »

interfixus wrote: post #50
aasasd wrote: post #48

Earlier quoted context omitted.

So you trust all the services you use to never leak your password. Good luck with that.

Whatever gives you that idea?

Contrary to what the other person said, I didn't think that you use a single password. Still, when a password is stolen, I prefer to have a second layer of security instead of losing my stuff in that account (and giving the attacker additional data to use against other accounts).

Re: The bleak picture of two-factor authentication adoption in the wild

#70

Post by bubblethink »

jjeaff wrote: post #62
spiritcat wrote: post #7

Earlier quoted context omitted.

Google authentication is great, until it's time to get a new phone.

Google authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.

Do you have a source on this ? I don't think google authenticator backs up by design, and that's good.
Post reply on HN