My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…
The New Ten-Factor Authentication Processes
71–80 of 107 posts
Re: The New Ten-Factor Authentication Processes
#72Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code". 2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mo…
One time I signed up on a site with 'Sign in with Google'. Months later, I wanted to delete my account, but the deletion process required I enter my account's password, which obviously I was never prompted to set up. The site wouldn't let me do a 'Forgot password' to set a password, so the account was impossible to delete.
Re: The New Ten-Factor Authentication Processes
#73My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…
But it isn't as bad as those "identify which of these loans you might have used" to identify you or as bad as silently truncating a password on input (both of which I've seen). Still, pretty darn bad. Don't surprise your users!
Speaking additional factors, I wrote up a piece about all the different kinds of factors[0] and when you might use them. But NIST has the canonical list[1] as far as I'm concerned (section 5).
0: https://fusionauth.io/learn/expert-advice/authentication/mul...
1: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Re: The New Ten-Factor Authentication Processes
#74My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…
I can create my own question in a way that a specific answer will immediately come to mind if I'm ever asked in the future, without any need to look anything up, and that cannot be answered by googling me. How about if you let me choose the question? "No, we are security experts who have given you three excellent options to choose from. Choose one."
Re: The New Ten-Factor Authentication Processes
#75Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…
I am willing to stipulate that magic links are better in this way.
That is, provided they are of reasonable length. Say, 32 characters or less beyond the domain name itself ?
You can't predict what device, or interface, or mail client one will receive these links on. You also can't predict how they will interface with the link (or resend or process it).
The 300+ character hash links I sometimes see are really lazy and clueless.
Re: The New Ten-Factor Authentication Processes
#76Earlier quoted context omitted.
I personally use 1password for authenticator codes - highly recommend if you haven't seen it: https://support.1password.com/one-time-passwords/ Edit: Didn't answer the actual question - it's something we can look into. My instinct is that offering this wouldn't drastically change the security model, as long as we can be confident your password actually came from a secure password manager. Since some password managers…
If someone scrapes your clipboard or records your screen for example, this still adds a second layer of protection.
Re: The New Ten-Factor Authentication Processes
#77My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…
> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. > I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? But then you have to trust that "somewhere safe" is actually as safe as you think it is. One alter…
I'd go further than that and use stuff like that for actual passwords, but with a twist.
Using that sort of thing for such questions is good, but take something you know well, like a song lyric or line from a poem and then change it subtly. For example:
Forty score and eleventy years ago, our
foremothers brought forth a new abomination.
Since you're the one making this stuff up, it's easy to remember, both for passwords and for those "secret" questions.Those are pretty much endless in possibility too:
In the town where babby formed, there lived a
gal who mailed some trees.
Ask not what who has done it in your country.
Ask which Lulu can do it with you.
And on and on. The only real requirement is that you know whatever it is you're adapting well. Whether that be song lyrics, movie lines, poesy, etc.I prefer song lyrics myself, since they're usually easier to remember, and when presented with the need to recall it as a password/"secret" question, the modifications made come right back.
I imagine that wouldn't work for everyone, but it works well for me, and would also work for others.
Good luck!
Re: The New Ten-Factor Authentication Processes
#78Re: The New Ten-Factor Authentication Processes
#79When the security department suggests another thing, to protest sounds like you want things be less safe simply because it's annoying. But some of things add only a little bit of security, or address a scenario that is highly unlikely, but you pay for it every day, day after day, with a dozen irritations that peck at you.
Security is a continuum. I could always imagine something more to add: "Lock the screen after 10 minutes? Why not 5? Why not 2?" So the security team seems to have their way until the users are almost driven crazy but not quite.
Re: The New Ten-Factor Authentication Processes
#80My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…
> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. > I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? But then you have to trust that "somewhere safe" is actually as safe as you think it is. One alter…