Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

211–220 of 269 posts

Re: That's not how 2FA works

#211

Post by bigiain »

dathinab wrote: post #146
rdiddly wrote: post #125

Earlier quoted context omitted.

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

Not all 2nd Factor solutions allow stealing the 2nd factor. Mainly U2F incorporates the domain and (should) only work if an TLS connection with a valid certificate for given domain is used. Furthermore it uses a key exchange. This means: - The attacker needs a valid certificate for the applications login domain, which wrt. web security is normally assumed to not be possible but tbh. might be possible in case of an st…

> Not all 2nd Factor solutions allow stealing the 2nd factor.

The second half of the article goes into detail about the shortcomings of U2F (using "Yubikeys" as it's terminology)

Re: That's not how 2FA works

#212

Post by MrStonedOne »

rstuart4133 wrote: post #202
MrStonedOne wrote: post #82

Earlier quoted context omitted.

Until keys become cloneable they will never gain popularity. Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of ke…

I don't think cloneable is a good idea. If some 3rd party clones your token and uses it to commit a crime there is no way to prove that happened. There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This s…

> Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day.

Yes, clonable tokens. Exactly.

When people ask for clonable tokens. This is an acceptable solution.

(But skip the bank vault. This is for avg Joe, not Jeff bezos. The closest safe will do)

Re: That's not how 2FA works

#213

Post by Macha »

fastball wrote: post #204
iso1210 wrote: post #68

Earlier quoted context omitted.

I just did an ingonito search for "!g ETA", I got 3 results on the screen CanadianTravel - ETA Ad·www.canadaonlineapplication.org/ CanadianTravel - ETA Ad·www.canadatravelvisa.com/ CanadaETA - for UK citiziens - canadian-etavisas.com Ad·www.canadian-etavisas.com/ Which all look the same, and seem to charge $99 for the 'service' of filling in a form the Canadian government charges $7 for. After that there is a wikipag…

So.... not a scam, in that you get exactly what you pay for. And certainly not phishing, which this article was talking about.

How is this not a scam? The company is just presenting their form to ask for the same information, relaying it to the government, and charging you $90 for the privilege.

Re: That's not how 2FA works

#214

Post by dmurray »

bigiain wrote: post #211
dathinab wrote: post #146

Earlier quoted context omitted.

Not all 2nd Factor solutions allow stealing the 2nd factor. Mainly U2F incorporates the domain and (should) only work if an TLS connection with a valid certificate for given domain is used. Furthermore it uses a key exchange. This means: - The attacker needs a valid certificate for the applications login domain, which wrt. web security is normally assumed to not be possible but tbh. might be possible in case of an st…

> Not all 2nd Factor solutions allow stealing the 2nd factor. The second half of the article goes into detail about the shortcomings of U2F (using "Yubikeys" as it's terminology)

The article's first and most prominent criticism is that it costs at least $30-$60, which might be a barrier to mass adoption but for most HN readers is not a serious reason not to use it.

Re: That's not how 2FA works

#215

Post by CamJN »

cutemonster wrote: post #182
8ytecoder wrote: post #139

Earlier quoted context omitted.

If it’s a website which supports API key or any token of sorts (without expiry or long expiry), they could do some real damage even if they can’t use the 2FA again. Another thing would be to disable 2FA. All they have to do to achieve this is to use the phished credentials to immediately login with the original site, trigger 2FA and then show a field to capture it and pass along. Then capture all the cookies. The bes…

Any such password manager you like? Didn't know they could do domain matching

Not the person you asked, but: 1Password which I like, and Lastpass which I don't, both do domain matching in the browser extension. All iOS password managers that integrate into the system do domain matching as well.

Re: That's not how 2FA works

#216

Post by howlgarnish »

Fake 2FA works if it's stateless, eg entering a code from Authy or a physical token.

However, stateful 2FA like sending an SMS to your phone, or popping up a notification on your banking app is much harder to spoof, and would have protected the user here.

Re: That's not how 2FA works

#217

Post by mapgrep »

All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth.

It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to shipping and integrating this stuff by default. Suddenly you’ll own 3 or 4 yubikey equivalents without buying any special auth devices.

25 years into the web and our login tools remain pretty barbaric. Maybe in 25 years we’ll have it sorted out. But change is coming. Call it 2fa, webauthn, whatever - regardless of the details username/password auth (on its own) is dead.

Re: That's not how 2FA works

#218

Post by staticassertion »

The criticism of YubiKey seems kind of unfair. For one thing, it doesn't actually explicitly state that they totally address the major issues in the article.

Instead it's "in theory" and "can help". No, it totally addresses the issue of phishing your 2FA token and it does so in practice.

The pricepoint mentioned is over twice what the cheapest Yubikey is - $24.99 [0]. The author states the "average" cost is £50 and "there are a few around £30". Again, 24.99USD for USB + NFC yubikeys that support U2F/webauthn.

'usability' and 'convenience' are the same thing but split into two points, which give the impression that there's a whole other issue, but it's really the same thing.

> Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time

So for TOTP it's install the app, configure it, find the setting on the website, enable it. So Yubikey adds the one additional step of "buy it", all of the others are the same for all other forms of 2FA. "Press the button at the right time" come on... as opposed to "find the TOTP and type it in on time" ?

The 24.99 USB Yubikey also supports NFC, so like, "has USB or NFC" is the requirement - I'm seriously struggling to think of a device that doesn't meet this requirement.

The author states that leaving the yubikey in the laptop increases risk. I find this to be a mixing of threat models personally - we've solved credential phishing with the 2FA token, but now you're talking about a threat where the attacker has unfettered physical access? I just don't see why that's relevant, sorry.

And for support, I think it's important to note that most sites are not sensitive. But a couple of important sites are. The most important is probably email, since email is effectively an auth mechanism for most other sites via account recovery. So just by protecting email you're protecting every other site. That's really important.

IMO,

Yes, Yubikeys should get cheaper. I certainly hope they do. At my company I give every employee 2 Yubikeys and they are theirs to keep - they're free to use them for personal accounts. I hope more companies do this in the future, essentially distributed U2F to the workforce.

But, otherwise, I really think that the benefits are being drastically undersold and I think that the criticisms are really not particularly fair.

[0] https://www.yubico.com/product/security-key-nfc-by-yubico/

Re: That's not how 2FA works

#219

Post by folmar »

bostik wrote: post #170
valvar wrote: post #115

Earlier quoted context omitted.

While this is possible, it does require significantly more effort on the part of the attacker and there are many more points of failure. So I'm guessing most phishing sites don't actually do that, even though of course some do.

Phishing has been commoditised, the criminals don't write their own pages anymore. In fact the phishing toolkits have been doing TOTP passthrough/relay for a few years now. For the attacker, it's a nice feature: victim could be using SMS, authenticator app or even an out-of-band delivered token book - they are all captured and passed along equally well. U2F and FIDO2 with hardware keys are the only realistic safeguar…

German banking has ubiquitous qr-mediated second channel - the authenticator (app or physical device) reads a qr code, shows the transaction details on screen and if they match user types back a code from the app (which is based on qr content).

Re: That's not how 2FA works

#220

Post by folmar »

md_ wrote: post #36
edent wrote: post #22

Earlier quoted context omitted.

I think that's a fair comment. It would be great to see more device come with built in support for this.

Platform support isn't exactly the problem. Apple, Microsoft, and Android all support WebAuth ( https://blog.mozilla.org/security/2019/03/19/passwordless-we... , https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-... , https://docs.microsoft.com/en-us/windows/security/identity-p... , https://developers.google.com/identity/fido/android/native-a... ), so most (??) users are in fact covered. eBay, for example,…

One form of securing fallback mechanism is to include a long delay, some 2 days, between reset request and execution. It surely does not fit all use cases, but should be good for a lot of less critical stuff.
Post reply on HN