Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

151–160 of 269 posts

Re: That's not how 2FA works

#151

Post by jeffbee »

proactivesvcs wrote: post #65
Blikkentrekker wrote: post #47

Earlier quoted context omitted.

How can this pass through Google 's quality controls that scam sites can get advertising?

...quality controls? They're paying customers, Google has no incentive to prevent scam sites, which is why the results and adverts are infested with them, and have been for decades.

That is quite incorrect. Google has more incentive than anyone else to deliver only the best results and ads to searchers. Delivering them to scams harms their reputation and would eventually erode the CTR.

Re: That's not how 2FA works

#152

Post by goodpoint »

easterncalculus wrote: post #85
lrvick wrote: post #19

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Al…

Disappointed but not surprised when reading this. To be really honest, I can't remember the last time I read something that criticized so called "techbros" and actually said something reasonable. As for the U2F devices, the idea of just leaving them in, the small yubikeys and all that, seem to just be a bad idea from the get-go.

Found the techbro.

Re: That's not how 2FA works

#153

Post by smokey_circles »

No.

2FA is designed to authenticate that this is you logging in. Wrong off the bat.

The "they just use your login token" is akin to "they just hacked the CIA's database". Just.

I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem where login.signup.domain.com does not match login.domain.com and so users are used to searching.

The bit that completely lost me was the lamenting of convenience with the YubiKey.

Security and convenience are polar opposites.

Coupled with the "tech bros" comment, I am not sure this is in good faith at all

Re: That's not how 2FA works

#154

Post by goodpoint »

Another aspect that people always forget is that 2FA protects only the login process.

Any successful attack against your browser (or any other application on your workstation) allows the attacker use existing and future browsing sessions.

The attacker can simply wait until you log onto your bank account and remotely control your browser.

Re: That's not how 2FA works

#155

Post by as300 »

Correct me if I'm wrong but I've seen oauth implementations that require you to be redirected to the site you're giving credentials for to finish the flow of authentication. Wouldn't this make it a lot easier to determine that you're being phished, if you have to go to a whole different web site that warns you that you are giving external parties access to your credentials?

Re: That's not how 2FA works

#156

Post by anticristi »

Time to implement Password Authenticated Key Exchange, e.g. Secure Remote Password, in the browser?

Here is what I suggest. Let there be a field . Whatever is typed into that field is unavailable to the front-end code. Instead, the browser computes a one-way function of the password, challenge and origin, and makes that available to the front-end.

The devil is in the details, but I'm pretty sure that a robust security analysis could eventually produce a solution that allows any user to type any password in a "super-password" field, and rest assured that the phishers are out.

The next issues would be: - How to prevent "downgrade" attacks, i.e., the user should immediately notice if a legacy password field is used. - How to convince the Internet to adopt this.

Re: That's not how 2FA works

#157

Post by ascar »

pc86 wrote: post #137
rdiddly wrote: post #125

Earlier quoted context omitted.

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

> Not if it also steals the 2nd factor. Sure, but isn't that the point? There's now a second thing they have to steal, and if they only get the first it's pretty worthless, especially if there's monitoring/alerting in place that prompts a password change and/or locks your accounts pre-emptively.

As phishing usually includes impersonating a website and making the victim believe they are giving their credentials to the original service, I think it is implied that most victims would willfully provide their second factor, when asked for it.

So, in case of phishing that's not the point. If you're actively logging in yourself a second factor doesn't prevent the attacker from gaining access.

Re: That's not how 2FA works

#158

Post by paraknight »

smokey_circles wrote: post #153

No. 2FA is designed to authenticate that this is you logging in. Wrong off the bat. The "they just use your login token" is akin to "they just hacked the CIA's database". Just . I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem whe…

> The "they just use your login token" is akin to "they just hacked the CIA's database". Just.

He's saying that they can basically MITM you, which is true. GitHub asks attacker for token, attacker asks you, attacker gives token to GitHub on the spot, presto.

Re: That's not how 2FA works

#159

Post by anticristi »

as300 wrote: post #155

Correct me if I'm wrong but I've seen oauth implementations that require you to be redirected to the site you're giving credentials for to finish the flow of authentication. Wouldn't this make it a lot easier to determine that you're being phished, if you have to go to a whole different web site that warns you that you are giving external parties access to your credentials?

Indeed, using OAuth everywhere would make the success of such an attack less likely. However, I feel strongly about not letting a single organization act as my identity provider. I don't like putting all eggs in the same basket.

Re: That's not how 2FA works

#160

Post by ascar »

valvar wrote: post #115
kube-system wrote: post #110

Earlier quoted context omitted.

> 2FA absolutely will protect you from a phishing site using the password it stole. The author is pointing out that they will steal both the password and your 2FA token.

While this is possible, it does require significantly more effort on the part of the attacker and there are many more points of failure. So I'm guessing most phishing sites don't actually do that, even though of course some do.

If you look at the context of the article, you should assume that phishing attack is sophisticated enough and responding to that attack with "you should use 2FA" is missing the point (which is exactly what the author claims).

2FA (at least the simple OTP variants) don't protect against phishing, they just protect against sloppy phishing attempts.

Post reply on HN