Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

11–20 of 269 posts

Re: That's not how 2FA works

#11

Post by brazzy »

jrochkind1 wrote: post #6
Tomte wrote: post #2

> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.

> All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before. I don't understand what you mean. Something about 2FA does this? How?

The U2F protocol (that Yubikey and others use) is based on a cryptographic challenge-response mechanisms, and it includes the domain of the service you're logging into, as supplied by the browser.

The details are complicated, but basically: If you register the key at github.com and later get phished to visit githubverification.com, then the authentication will fail no matter what the phisher does.

Re: That's not how 2FA works

#12

Post by hehehaha »

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error.

I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person versus a completely remote attack. Security isn’t just about attacks. You also need to think about mitigation and recovery following the attack.

Re: That's not how 2FA works

#13

Post by signal11 »

hehehaha wrote: post #12

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…

Also, Bluetooth based keys exist that don’t have to be plugged in.

Re: That's not how 2FA works

#14

Post by edent »

fastball wrote: post #10

> The top result on Google is invariably an advert for a scam site. Um... no?

Try browsing the web without an ad blocker. The top results on Google search are always adverts. And, quite often, they link to scam sites.

There are loads of copycat websites which appear in the top slot - especially for government site. https://www.which.co.uk/consumer-rights/advice/how-to-spot-a...

It's particularly prevalent in the UK, where you see companies proxying legitimate services and charging premium rate for phone calls - https://www.theguardian.com/money/2017/feb/04/beware-call-co...

Re: That's not how 2FA works

#16

Post by md_ »

Mostly agree with a lot of this, but it's a little unfortunate to lump all WebAuthn authenticators together.

WebAuthn keys--physical dongles you plug into the USB port--are indeed problematic for the reasons the author notes. (A small--but user-visible--cost; the requirement for a spare USB port of the right form factor; loss.)

However, authenticators that are built into the client device (e.g. Apple's support for a TouchID-verified WebAuthn authenticator) solve these problems, to varying degrees: the user doesn't see a marginal cost (it's built into the computer!) and doesn't have to worry about loss, USB ports, etc.

The principle challenge with using (as an example) Safari's WebAuthn support is what how the relying party should support loss of the device. (If you lose your Safari--or claim to--how does your bank authenticate you?)

Ultimately, the lost-device--or new-device bootstrapping--problem is currently what stands in the way of a truly secure ecosystem, but with platform providers increasingly supporting WebAuthn, we can at least reduce phishing risk to "phishing of the platform provider credential." Your iCloud password might get stolen, but at least that's the _only_ thing an attacker can steal to gain access to your other accounts.

For most services, delegating authentication (and anti-phishing) to someone like Apple is a big plus.

Re: That's not how 2FA works

#17

Post by sigmar »

> Buy a device, register it, install the app,

What u2f app is this referring to? I've never needed anything more than chrome to use u2f on windows or ubuntu. Also seems weird to complain about setting up an app, when a few sentences before that they recommend installing a password manager...

Re: That's not how 2FA works

#19

Post by lrvick »

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists.

First of all you can get WebAuthn devices for as little as $10 now.

Second, there is no app to configure. You plug it in when it says register and tap it. Done.

Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Also the vast majority of attacks are remote, not IRL.

Fourth: fingerprint or pin authenticated WebAuthn devices exist if your threat model worries about physical access.

IRL attacks are a radically different threat profile.

I can't even with this article.

Re: That's not how 2FA works

#20

Post by edent »

hehehaha wrote: post #12

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…

Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be.

Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone.

Regardless of my opinions on tech, if you think being mugged is "user error" then may I suggest spending a couple of days volunteering for a local Victim Support charity.

Post reply on HN