Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Ten-Factor Authentication Processes

mcsweeneys.net

Post reply on HN
Print view View original

61–70 of 107 posts

Re: The New Ten-Factor Authentication Processes

#61

Post by msoad »

People who care about user experience hardy ever talk to people who care about security in large organizations. That's how we end up with experiences like this.

Ring (Amazon) made me call them to reset my two-factor app sync. They asked me to send a bill to the address of my home via my email as a proof that this is really me and not just someone who have my password and access to my email. I asked what's the point of this if it's not really me but it's someone who has my password, has access to my email and can go login to the utility company to get a copy of my bill after reseting my password there too? They agent literally said this is the script they have to say and they don't know...

Re: The New Ten-Factor Authentication Processes

#62

Post by airstrike »

jiggawatts wrote: post #59

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use.

> I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right?

But then you have to trust that "somewhere safe" is actually as safe as you think it is.

One alternative is to use them like mnemonic code phrases. So perhaps your answer to "What's your favourite animal?" is not really an animal, but maybe Cthulhu, so as a (somewhat overkill but illustrative) example maybe the answer would be "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn"

Re: The New Ten-Factor Authentication Processes

#64

Post by Macha »

msoad wrote: post #61

People who care about user experience hardy ever talk to people who care about security in large organizations. That's how we end up with experiences like this. Ring (Amazon) made me call them to reset my two-factor app sync. They asked me to send a bill to the address of my home via my email as a proof that this is really me and not just someone who have my password and access to my email. I asked what's the point o…

This is how you come up with security suggestions like "Let's just email the user a one time password on every login" which gets suggested here perennially.

Re: The New Ten-Factor Authentication Processes

#66

Post by Macha »

csteubs wrote: post #22
jawns wrote: post #11

Earlier quoted context omitted.

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix? Digital OTP, like the kind provided by 1Password or Bitwarden, a…

I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.

A push notification is still a context switch so you're really only saving the time to find your authenticator app.

Re: The New Ten-Factor Authentication Processes

#68

Post by 55873445216111 »

jiggawatts wrote: post #59

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

I treat all security questions as if they are just an additional password. I use a password manager and store a random string for each required security question.

Re: The New Ten-Factor Authentication Processes

#69

Post by gjs278 »

colinclerk wrote: post #15

Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…

how about username / password, no rules, and that’s it

Re: The New Ten-Factor Authentication Processes

#70

Post by aetherspawn »

colinclerk wrote: post #30
Wowfunhappy wrote: post #24

Earlier quoted context omitted.

How about you allow me to turn off the second factor if I have a password manager, because I'm way more concerned about loosing my second factor and getting locked out of my account than someone somehow getting into my password manager.

I personally use 1password for authenticator codes - highly recommend if you haven't seen it: https://support.1password.com/one-time-passwords/ Edit: Didn't answer the actual question - it's something we can look into. My instinct is that offering this wouldn't drastically change the security model, as long as we can be confident your password actually came from a secure password manager. Since some password managers…

If someone scrapes your clipboard or records your screen for example, this still adds a second layer of protection.
Post reply on HN