Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

121–130 of 269 posts

Re: That's not how 2FA works

#121

Post by dheera »

ajross wrote: post #104

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value . Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA wor…

Also, I'm a big fan of U2F keys including Yubikeys.

I don't use SMS, deprecated it 10 years ago in favor of e-mail, and would never use SMS for 2FA. I still have a virtual SMS number that forwards to my e-mail for the idiot sites that still insist on it.

For most people, SMS is hackable, tied to a single battery-powered device, easy to steal (after which for most people in the default phone configuration the SMS verification codes will happily pop-up on the lock screen without unlocking the phone), and hugely inconvenient if you are in front of a desktop computer all day and have to go find your phone (at home for example I pretty much never have my phone next to me). SMS also famously locks people out of their accounts when they go to another country and have to use a different SIM card. Also, if you have a giant desktop in front of you, it's ridiculous to not use that as your 2FA device. You should NEVER have to pick up a 6" handheld device for 2FA when you have a massive immobile, hard-to-steal device in front of you that in my case is also physically locked down to furniture.

Yubikeys and other U2F keys do exactly this.

The article is wrong about one thing:

"But if you’ve stolen my laptop and the YubiKey is plugged in, then you’ve got the keys to my kingdom."

No. My preferred way to use Yubikeys is to buy one for each immobile device (home/office desktops) that stays plugged in, and ONE mobile key that lives in my wallet. Register all keys with critical services. If any device gets stolen (highly unlikely for the immobile devices, the mobile device is the only one I need to worry about really), go home, log in with another key and remotely disable it.

My main gripe is websites that don't allow multiple Yubikeys. AWS is at the top of my hall of shame.

Re: That's not how 2FA works

#122

Post by guenthert »

tialaramex wrote: post #35
bombcar wrote: post #5

2FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture…

> Honestly don’t see how you can protect against even moderate level spearphishing reasonably. WebAuthn. The article author dismisses it as basically too inconvenient (they apparently keep their Security Key somewhere out of reach and they struggle to remember the complicated user interaction of... pressing a button) But WebAuthn is completely effective against phishing. The closest to plausible attacks are: The bad…

I think the conundrum is that such a device uses either a simple UI (like pressing the button), which then is unable to convey to the user which transaction is to be signed off on (the desktop/laptop/phone might be compromised) or the device has its own display and multiple-choice input that'll be too expensive and cumbersome for all to carry around all the time, everywhere.

Re: That's not how 2FA works

#123

Post by izacus »

aidenn0 wrote: post #99
kps wrote: post #95

Earlier quoted context omitted.

If stealing the computer is enough, someone's seriously screwed up already — it's supposed to be 2FA, not 1FA.

Stealing the computer is usually enough, as a browser cookie serves as proof of authentication all on its own. Some destructive operations require extra auth, but in terms of data exfiltration, stealing a laptop gives you everything you need.

What exactly does that have to do with YubiKeys though? Every time you use one you need to enter password. And you can also immediately revoke it as soon as you notice its stolen.

Re: That's not how 2FA works

#124

Post by tialaramex »

wyager wrote: post #86
tytso wrote: post #55

Earlier quoted context omitted.

If you had used one of the $10 USD Webauthn (aka U2F) tokens, it wouldn't have asked you to install any applications. The "problem" is the expensive Yubikeys that you were whining about has lots of extra functionality that has nothing to do with U2F, and that's what the extra applications are all about. I happen to use a Yubikey because I want that extra functionality, including using it to secure the keys I use for…

OpenSSH >= 8.something natively supports U2F. No need for extra functionality.

However, to use native FIDO the SSH server must accept it (GitHub does not for example)

Whereas if you have RSA keys on the "full fat" Yubikey, they can be used regardless.

Re: That's not how 2FA works

#125

Post by rdiddly »

ajross wrote: post #104

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value . Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA wor…

2FA absolutely will protect you from a phishing site using the password it stole.

Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

Re: That's not how 2FA works

#126

Post by IncRnd »

ahmedalsudani wrote: post #76
edent wrote: post #20

Earlier quoted context omitted.

Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of m…

> may I suggest spending a couple of days volunteering for a local Victim Support charity. Please try being less condescending. Losing the keys, due to whatever reason, means losing one factor. If the user loses the key, the "mugger" still needs to get the users' passwords. 2FA = something you know + something you own. Having one factor compromised should not compromise your accounts if the service you are using is c…

> 2FA = something you know + something you own.

That's not exactly correct. Another factor is something you are, such as a fingerprint or eye. There are three classes of factors from which drawing any two is called 2FA.

There is also a 1.5 factor auth, used for example by many banks, in which there is a server challenge for the very vulnerability stated in the article.

Re: That's not how 2FA works

#127

Post by GolDDranks »

Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non-phishing site. The scammer has my password, but is still unable to access the site. How does that not help?

Of course if it's a 6-digit code or something, then they are able to stole my it like they did with the password.

Re: That's not how 2FA works

#129

Post by dathinab »

I think password managers are the first step you should take and FIDO/U2F hardware keys are the second similar important step.

With that even if your password manager get hacked you still have a secure account as they didn't got the U2F at the same time a password manager is a must have as it's prevents a lot of phishing attacks from even getting any chance and is quite convenient, too.

The problem with hardware keys is that for many people they are not so easy:

- You MUST generate and safely store recovery keys, storing them in your password manager is suboptimal, but better then not having them. (Not having them means potentially losing account access permanently.)

- You often need to enable it.

- You should store it with your keys, which dependent on habit might not be around your PC (in my case they always are in my pocket so :=) ).

- If your site doesn't support U2F/FIDO you might need an additional phone + app, or laptop app to get the numbers out of your key.

So while I think it's a must have for every developer to have a hardware security token lie a Yubikey it's not something I could convince e.g. my Dad or Sisters to use.

Re: That's not how 2FA works

#130

Post by guenthert »

tialaramex wrote: post #102
chungy wrote: post #80

Earlier quoted context omitted.

There are many legitimate situations in which a login domain is changed and a password manager no longer works. So then you manually open the password manager, look for the password, copy+paste, and save the new entry. How can you be completely confident that this isn't an attacker?

Right. One of the good decisions in WebAuthn is that this type of nonsense simply isn't possible. It's designed so that you can't do this. When the big boss absolutely insists that ourcorp.example must rename to xp4ifis.example because of whatever nonsense, there's nothing to argue about, it won't technically work, it can't be done. Like if they decided it would be better branding if up was down, too bad. In almost a…

Not too long Scottrade (2 or 3 't'?) got bought by Ameritrade. All Scottrade accounts are now accessed exclusively under the new domain name.

Recently Ameritrade and Charles Schwab Corp. merged ...

Post reply on HN