Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

31–40 of 269 posts

Re: That's not how 2FA works

#31

Post by _wldu »

PascLeRasc wrote: post #9
bombcar wrote: post #5

2FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture…

That’s a really good idea, we should be asking sites to verify themselves with a second factor. Do you know if that’s in use anywhere?

This is called a site key and was made popular by Bank of America. I'm not sure if they still do it.

https://en.wikipedia.org/wiki/SiteKey

Re: That's not how 2FA works

#32

Post by latopedej »

lrvick wrote: post #19

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Al…

most people have a phone that can leverage webauthn, so you don't even need to buy anything. On top of that, webauthn can be configured to prevent phishing as well

Re: That's not how 2FA works

#33

Post by Ottolay »

edent wrote: post #21
sigmar wrote: post #17

> Buy a device, register it, install the app, What u2f app is this referring to? I've never needed anything more than chrome to use u2f on windows or ubuntu. Also seems weird to complain about setting up an app, when a few sentences before that they recommend installing a password manager...

YubiKey recommended that I install Yubi Auth https://play.google.com/store/apps/details?id=com.yubico.yub... and YubiClip https://play.google.com/store/apps/details?id=com.yubico.yub... Should I not have?

For U2F specifically you don't need apps except support in the browser. The apps you listed are used for other types of functionality provided by the yubikey, like OTP and TOTP.

Re: That's not how 2FA works

#34

Post by edent »

lrvick wrote: post #19

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Al…

Could you let me know where I can buy a well supported WebAuthn key for that price?

Looking at Amazon UK - https://amzn.to/3oWGYe4 - the cheapest appears to be about £30. Unless I want to risk my security to some no-name brand with zero customer support.

When I got my YubiKey, it told me I had to download an Android app to make it work. So, perhaps better documentation is needed?

I'm sorry you didn't like my post, I'll try to do better in future.

Re: That's not how 2FA works

#35

Post by tialaramex »

bombcar wrote: post #5

2FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture…

> Honestly don’t see how you can protect against even moderate level spearphishing reasonably.

WebAuthn. The article author dismisses it as basically too inconvenient (they apparently keep their Security Key somewhere out of reach and they struggle to remember the complicated user interaction of... pressing a button)

But WebAuthn is completely effective against phishing.

The closest to plausible attacks are: The bad guys take over the target servers (no reason to phish you); The bad guys persuade you to physically send them your authentication device (truly not everybody can be helped...); The bad guys persuade you to install software under their control on a general purpose PC (this won't work on a Phone) and then you follow their bad instructions to "use" your authenticator with their software to get them in.

Mutually authenticated TLS is in principle viable, and I have used it in machine-to-machine systems, but the UX is atrocious and it has grave privacy problems.

Re: That's not how 2FA works

#36

Post by md_ »

edent wrote: post #22
md_ wrote: post #16

Mostly agree with a lot of this, but it's a little unfortunate to lump all WebAuthn authenticators together. WebAuthn keys--physical dongles you plug into the USB port--are indeed problematic for the reasons the author notes. (A small--but user-visible--cost; the requirement for a spare USB port of the right form factor; loss.) However, authenticators that are built into the client device (e.g. Apple's support for a…

I think that's a fair comment. It would be great to see more device come with built in support for this.

Platform support isn't exactly the problem.

Apple, Microsoft, and Android all support WebAuth (https://blog.mozilla.org/security/2019/03/19/passwordless-we..., https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-..., https://docs.microsoft.com/en-us/windows/security/identity-p..., https://developers.google.com/identity/fido/android/native-a...), so most (??) users are in fact covered.

eBay, for example, offers a passwordless experience using WebAuthn--so it can be done, even on a major consumer site.

The problem is really that until relying parties can trust that

1. Platforms will backup and restore key material from authenticators 2. Users will figure out how to use those backups (including if they e.g. switch from Mac to Windows)

they will have to provide some fallback. (Realistically, that means "for the foreseeable future.")

This relegates WebAuthn, unfortunately, to a "neat trick"--eBay's "passwordless option"--and not a security guarantee. (Phishers can always downgrade the user to passwords or similar.)

What's needed in the interregnum is probably a way to make that fallback option more secure by, at minimum, conveying to users that it's not _normal_--so that phishing attempts targeting that phishable backup are less likely to succeed.

Unfortunately this requires a lot of good UX design and unilateral action on part of the relying parties, which I think is tough.

Re: That's not how 2FA works

#37

Post by DecoPerson »

lrvick wrote: post #19

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Al…

For the reasons listed in the article and more, Yubikeys and similar devices aren’t likely to ever be popular.

To give future security devices along the same vain a better chance at gaining popularity and being widely adopted (which will hopefully bringing us a more stable, less stressful society), the designs of these new devices must solve or workaround the issues the author describes.

It’s really annoying when individuals such as yourself respond so very negatively and unconstructively while others are trying to discuss the issues with existing designs — an act necessary for us (collectively) to develop new designs.

The author may not provide strong evidence for their claims, but neither do you provide strong evidence (or extensive reasoning) for yours. The net gain here is negligible, expect for showing that contrary opinions exist, but that’s not particularly helpful as for every opinion held it is inevitable that someone holds the polar opposite.

I’m not a moderator, but I ask you to please try to better further the discussion with future comments.

Re: That's not how 2FA works

#38

Post by zimbatm »

hehehaha wrote: post #12

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…

Another issue not mentioned by the author is what happens if the Yubikey is lost or breaks. The story around this type of event is sort of ignored and not understood properly. AFAIK it's not possible to duplicate a key (by design), meaning that the user will have to update all their websites' 2FA (hopefully there is a recovery method available).

Re: That's not how 2FA works

#39

Post by isbvhodnvemrwvn »

edent wrote: post #7
bombcar wrote: post #5

2FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture…

> Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. It can, simple as that. Some make it moderately more difficult by showing you, say, 9 pictures and asking you to pick the one that's yours. But, again, dead easy to proxy.

Others also ask you to put in only some characters of your password, which is even more troubling because at best they hash them in various configurations when you change password, at worst - they keep it in plaintext.

Re: That's not how 2FA works

#40

Post by _wldu »

edent wrote: post #34
lrvick wrote: post #19

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Al…

Could you let me know where I can buy a well supported WebAuthn key for that price? Looking at Amazon UK - https://amzn.to/3oWGYe4 - the cheapest appears to be about £30. Unless I want to risk my security to some no-name brand with zero customer support. When I got my YubiKey, it told me I had to download an Android app to make it work. So, perhaps better documentation is needed? I'm sorry you didn't like my post, I'…

Conor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys:

https://www.kickstarter.com/projects/conorpatrick/solo-the-f...

https://u2fzero.com/

I have a few U2F Zeros and they have been working fine for years. These are simple devices. You don't need to overpay for them.

Edit: Conor was building the U2F Zero tokens for $2.26 USD per unit. Read more here:

https://www.conorpp.com/u2f-zero-year-in-review/

Post reply on HN