Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Ten-Factor Authentication Processes

mcsweeneys.net

Post reply on HN
Print view View original

21–30 of 107 posts

Re: The New Ten-Factor Authentication Processes

#21

Post by whynotminot »

mcny wrote: post #9
ketzo wrote: post #5

Earlier quoted context omitted.

I don't think there's quite as much malice as you seem to read into it. Yeah, 2FA is kind of annoying, particularly when you don't have a real concrete understanding of the reasons why it's important. It's a funny frame device to float a couple different satirical ideas. I'm sure faculty members – and most people – understand that 2FA is a necessary minor annoyance.

» I don't think there's quite as much malice as you seem to read into it. Requiring signing into my Microsoft account (with two step authentication code) every twenty four hours on a company laptop you control is obnoxious. You should educate and empower your employees, not treat them as the weak link in your armor.

It’s naive to not treat them like the weak link though, because they really are. No amount of education (that is routinely ignored) is enough to actually change that.

Re: The New Ten-Factor Authentication Processes

#22

Post by csteubs »

jawns wrote: post #11
quartesixte wrote: post #2

A sign of the times. Seems like our non-technical brethren find 2FA/MFA a burden? McSweeneys’ satire and parodies are rarely in good jest in my experience. This is a criticism of the move towards 2FA/MFA make no doubt about it. The writer, and the editors who let this through, are not happy about this state of affairs. McSweeney’s isn’t a no-name blog or journal either — its name holds sway over those who work in lit…

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix? Digital OTP, like the kind provided by 1Password or Bitwarden, a…

I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.

Re: The New Ten-Factor Authentication Processes

#23

Post by whynotminot »

quartesixte wrote: post #2

A sign of the times. Seems like our non-technical brethren find 2FA/MFA a burden? McSweeneys’ satire and parodies are rarely in good jest in my experience. This is a criticism of the move towards 2FA/MFA make no doubt about it. The writer, and the editors who let this through, are not happy about this state of affairs. McSweeney’s isn’t a no-name blog or journal either — its name holds sway over those who work in lit…

Not just non-technical. It’s a huge burden.

Not to mention the pain when said factor is lost. I just replaced a broken phone, and having to login in everywhere that previously required an Authenticator has not been fun.

Re: The New Ten-Factor Authentication Processes

#24

Post by Wowfunhappy »

colinclerk wrote: post #15

Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…

How about you allow me to turn off the second factor if I have a password manager, because I'm way more concerned about loosing my second factor and getting locked out of my account than someone somehow getting into my password manager.

Re: The New Ten-Factor Authentication Processes

#25

Post by koolba »

> While the system verifies that your definition is sufficiently accurate, please report to campus police, where you’ll undergo a very brief body cavity search. For security reasons, we cannot tell you what we’re looking for. This is about digital safety.

This was a fantastic read. Kudos to whoever put it together.

Re: The New Ten-Factor Authentication Processes

#27

Post by abdel_nasser »

my bank insisted that i add a phone number to my account when i called them today. i declined and when pressed briefly explained sim swapping and declined again. a glaring and obvious flaw in the integrity of using a phone number for id verification was not even in the lexicon of this establishment that safeguards nothing less than all of my literal fucking money. they then went on to find that i actually did have a phone number on record and that it is authorized for identity verification and also that i have never even heard of this phone number! im still dealing with it.

its amazing to think that not just this but the entire mountain of bullshit could be avoided with simple passwords. it should be an option offered by every service for a user to deactivate all authorization methods besides one very strong password and perhaps a backup password. we should at least have the option.

Re: The New Ten-Factor Authentication Processes

#28

Post by pjbeam »

mcny wrote: post #9
ketzo wrote: post #5

Earlier quoted context omitted.

I don't think there's quite as much malice as you seem to read into it. Yeah, 2FA is kind of annoying, particularly when you don't have a real concrete understanding of the reasons why it's important. It's a funny frame device to float a couple different satirical ideas. I'm sure faculty members – and most people – understand that 2FA is a necessary minor annoyance.

» I don't think there's quite as much malice as you seem to read into it. Requiring signing into my Microsoft account (with two step authentication code) every twenty four hours on a company laptop you control is obnoxious. You should educate and empower your employees, not treat them as the weak link in your armor.

I hear you, it is obnoxious, and probably not the best solution. That said the employees absolutely are weak spots in the armor.

Re: The New Ten-Factor Authentication Processes

#29

Post by micromacrofoot »

quartesixte wrote: post #2

A sign of the times. Seems like our non-technical brethren find 2FA/MFA a burden? McSweeneys’ satire and parodies are rarely in good jest in my experience. This is a criticism of the move towards 2FA/MFA make no doubt about it. The writer, and the editors who let this through, are not happy about this state of affairs. McSweeney’s isn’t a no-name blog or journal either — its name holds sway over those who work in lit…

2FA is by definition an additional burden.

Re: The New Ten-Factor Authentication Processes

#30

Post by colinclerk »

Wowfunhappy wrote: post #24
colinclerk wrote: post #15

Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…

How about you allow me to turn off the second factor if I have a password manager, because I'm way more concerned about loosing my second factor and getting locked out of my account than someone somehow getting into my password manager.

I personally use 1password for authenticator codes - highly recommend if you haven't seen it: https://support.1password.com/one-time-passwords/

Edit: Didn't answer the actual question - it's something we can look into. My instinct is that offering this wouldn't drastically change the security model, as long as we can be confident your password actually came from a secure password manager. Since some password managers (like 1password) are very strongly tied to devices, I think your ability to retrieve a password from it is a reasonable proxy for a possession factor.

It's definitely something I'd want to read more literature on before building. That's just my instinct, and I'm half expecting someone on HN to share the attack I'm forgetting :)

Post reply on HN