71–80 of 227 posts
I feel like a baller remembering my complex ones for important sites and other mechanisms for simpler sites - it might take a few attempts sometimes but it feels good and I can do it anywhere without requiring additional forms of auth
Passwords suck and we need a per-site password policy that can act like an API. Kind of like a Robots.txt, to declare, "This site needs 8-20 characters, 1 symbol and the URL's for login, reset and forgot password are these URI's."
I don't carry around my smartphone, just a nokia. I hate this approach with a passion. Please just send me a text message, or an email to confirm my login as a second factor to my password, and then trust the IP on user decision. Please don't make me use a smartphone app.
However, this feels more like having your sheep be herded by a fox...
Many here have already mentioned great points retorting this, so I won't beat a dead horse.
I will take the selfish opportunity to mention what my solution is that I'm working on: https://app.SrsPass.com
There's some rudimentary docs with a spec outline for those interested. But to sum it up, I share the same fears as others here of one device being some ultimate honey pot, or even worse, losing everything I have due to corruption or losing a/all devices where your pass vaults are when it comes to traditional managers. (Mind you, this coming from someone that runs RAID-Z3 NAS in multiple offsites).
Basically to keep it simple, I required the following aspects
- Available-source or Open-source (duh)
- Accessible on just about any device with a cpu, arm/x86 etc
- Vaultless & as stateless as possible
- No cloud, works completely offline
- Uses modern cryptography with sufficiently strong parameters
- Requires only one password to memorize
- Has uncrackable generated passwords (aka not feasible to crack in a long time period such as with 128 bits of entropy).
I believe SrsPass to meet all those aspects already. That is not to say that there aren't more features being worked on (the workboard is essentially public), however, I think you'd be hard pressed to find a more secure (when you build & run yourself) and accessible password manager than it.
Am I the only person who loathes this form of 2FA? I have this on my eBay account and it never works. I click the "Approve" button, and it fails to send so I can't login. I would prefer to just use my 2FA TOTP app, which has yet to fail me! My work has the same sort of setup, they expect you to install the "Microsoft Authenticator" app (no TOTP supported) and click approve in that. But how have we increased safety wh…
Apparently not, but it's always worked for me. Two things, though: 1) sites should support multiple methods of 2FA. I don't understand why many only let you have one. If I drop my phone in the toilet, I want to have a FIDO token enrolled as backup. 2) some of these implementations, like Google's, are proprietary. I want something universal and standards-based so we're not dependent on a different app for every service we use.
> But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app? I'm basically alt-tab'ing and clicking a different button, not really an improvement. It should be on a separate device, or something out of Microsoft's control so they can't screw it up.
You're correct, and knowing only what you've told me, I would argue this solution was implemented incorrectly.
Am I the only one who doesn’t want a future without passwords? There are problems with them, of course, but all the alternatives also have serious usability/security issues. And just when we’re starting to get wider 2FA adoption, companies want to get rid of one of the factors. So we’re back to one factor that’s ultimately secured by a device password/passcode anyway. Plus if/when you’re not able to access the device…
As much of a Science Fiction fan I am with "iris logins" and similar, I am also a retro-futurist who appreciates things like punch-number security for secured doors.
I mislike this current 2FA path of security for several reasons, the least of which is what if the email never comes or I don't have a cell phone (let alone a smartphone)? I'm screwed.
Passwords, passcodes, number pads ... seems to be quite more Human than all of this "prove yourself in the name of security theatre" these days.
Earlier quoted context omitted.
>Am I the only person who loathes this form of 2FA? Not in the slightest. I tried to configure TOTP-only and Google effectively tells me to go fuck myself, because they apparently know how to secure my account better than I do.
I've found that if you move away from Gmail (and there are much better providers around), a Google account doesn't contain much. Turn off your history and someone compromising your account can do... what? Search for things you'd like? View your YouTube favorites? Meh.
I’m not crazy about these “consult your phone to log in” things. There’s just so many more moving parts. Sometimes the push notification doesn’t make it through. Other times the acknowledgment from the phone doesn’t make it back. Occasionally my phone is doing updates when I urgently need to log in. I’d love for the “something you have” to be “my laptop.” It has a TPM; we can do this securely. Something like the MBP’…
That said, there's always going to be compromises and annoyances - I've been using MFA for 10+ years, and occasionally something glitches out, but other things (e.g. basic password systems) also sometimes glitch out, and having an account compromised is much, much worse than a minute or two of mild annoyance.
I’m not crazy about these “consult your phone to log in” things. There’s just so many more moving parts. Sometimes the push notification doesn’t make it through. Other times the acknowledgment from the phone doesn’t make it back. Occasionally my phone is doing updates when I urgently need to log in. I’d love for the “something you have” to be “my laptop.” It has a TPM; we can do this securely. Something like the MBP’…
I had a particularly hard time recently due to this when my phone broke and I couldn't replace it for a week or so. It all got figured out in the end, but not being able to access my Google account and all that entails was more of a problem than I expected.
I don't carry around my smartphone, just a nokia. I hate this approach with a passion. Please just send me a text message, or an email to confirm my login as a second factor to my password, and then trust the IP on user decision. Please don't make me use a smartphone app.
SMS 2FA is incredibly insecure. It has a huge attack surface: a stolen SIM card, a MITM attack (SMS is not encrypted, and devices like the Stingray that pretend to be cell towers to gather data are already in widespread use), or good old social engineering to convince a cell provider service rep to port out your number or issue a new SIM card.