Live data from Hacker News

The New Ten-Factor Authentication Processes

mcsweeneys.net

71–80 of 107 posts

Re: The New Ten-Factor Authentication Processes

#71

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

The most insane security question I've encountered is on united.com where they have you select your question _and answer_ from a dropdown.

Re: The New Ten-Factor Authentication Processes

#72

Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code". 2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mo…

One time I signed up on a site with 'Sign in with Google'. Months later, I wanted to delete my account, but the deletion process required I enter my account's password, which obviously I was never prompted to set up. The site wouldn't let me do a 'Forgot password' to set a password, so the account was impossible to delete.

It's easy! Just delete your google account, it will automatically invalidate any credential tokens given out to the third party site.

Re: The New Ten-Factor Authentication Processes

#73

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

Using password reset questions are pretty bad as a second factor is pretty bad. It probably came from good intentions. Since you were logging in from an unusual location, the bank flagged the process for a higher level of security. I wonder if they could have used literally anything else to verify you. (My bank also lets me tell them when I'll be abroad, which would have helped with the issue.)

But it isn't as bad as those "identify which of these loans you might have used" to identify you or as bad as silently truncating a password on input (both of which I've seen). Still, pretty darn bad. Don't surprise your users!

Speaking additional factors, I wrote up a piece about all the different kinds of factors[0] and when you might use them. But NIST has the canonical list[1] as far as I'm concerned (section 5).

0: https://fusionauth.io/learn/expert-advice/authentication/mul...

1: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

Re: The New Ten-Factor Authentication Processes

#74

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

That drives me crazy, too: "Choose a password." I choose a very secure password. "Now, in case you (or anyone else) can't recall your password, choose one of the following three personal security questions that any reader of your blog will be able to answer."

I can create my own question in a way that a specific answer will immediately come to mind if I'm ever asked in the future, without any need to look anything up, and that cannot be answered by googling me. How about if you let me choose the question? "No, we are security experts who have given you three excellent options to choose from. Choose one."

Re: The New Ten-Factor Authentication Processes

#75

Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…

"Magic links instead of OTPs for passwordless auth. Overall, magic links are a few seconds faster than OTPs since there's no entry step."

I am willing to stipulate that magic links are better in this way.

That is, provided they are of reasonable length. Say, 32 characters or less beyond the domain name itself ?

You can't predict what device, or interface, or mail client one will receive these links on. You also can't predict how they will interface with the link (or resend or process it).

The 300+ character hash links I sometimes see are really lazy and clueless.

Re: The New Ten-Factor Authentication Processes

#76

Earlier quoted context omitted.

I personally use 1password for authenticator codes - highly recommend if you haven't seen it: https://support.1password.com/one-time-passwords/ Edit: Didn't answer the actual question - it's something we can look into. My instinct is that offering this wouldn't drastically change the security model, as long as we can be confident your password actually came from a secure password manager. Since some password managers…

If someone scrapes your clipboard or records your screen for example, this still adds a second layer of protection.

They can't scrape the clipboard because of autofill, and they can't record the screen because passwords appear as ******.

Re: The New Ten-Factor Authentication Processes

#77

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. > I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? But then you have to trust that "somewhere safe" is actually as safe as you think it is. One alter…

>One alternative is to use them like mnemonic code phrases. So perhaps your answer to "What's your favourite animal?" is not really an animal, but maybe Cthulhu, so maybe the answer would be "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn"

I'd go further than that and use stuff like that for actual passwords, but with a twist.

Using that sort of thing for such questions is good, but take something you know well, like a song lyric or line from a poem and then change it subtly. For example:

   Forty score and eleventy years ago, our 
   foremothers brought forth a new abomination.
Since you're the one making this stuff up, it's easy to remember, both for passwords and for those "secret" questions.

Those are pretty much endless in possibility too:

   In the town where babby formed, there lived a 
   gal who mailed some trees.

   Ask not what who has done it in your country.  
   Ask which Lulu can do it with you.
And on and on. The only real requirement is that you know whatever it is you're adapting well. Whether that be song lyrics, movie lines, poesy, etc.

I prefer song lyrics myself, since they're usually easier to remember, and when presented with the need to recall it as a password/"secret" question, the modifications made come right back.

I imagine that wouldn't work for everyone, but it works well for me, and would also work for others.

Good luck!

Re: The New Ten-Factor Authentication Processes

#79
Has anyone had any luck reasoning with the powers that be, to come up with reasonable security?

When the security department suggests another thing, to protest sounds like you want things be less safe simply because it's annoying. But some of things add only a little bit of security, or address a scenario that is highly unlikely, but you pay for it every day, day after day, with a dozen irritations that peck at you.

Security is a continuum. I could always imagine something more to add: "Lock the screen after 10 minutes? Why not 5? Why not 2?" So the security team seems to have their way until the users are almost driven crazy but not quite.

Re: The New Ten-Factor Authentication Processes

#80

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. > I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? But then you have to trust that "somewhere safe" is actually as safe as you think it is. One alter…

in my experience this inevitably be on form feild where pasting isn't allowed and you cant see what you are typing and will be case sensitive but not inform you of that. and you will get locked out on attempt 3.
Post reply on HN