Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Ten-Factor Authentication Processes

mcsweeneys.net

Post reply on HN
Print view View original

81–90 of 107 posts

Re: The New Ten-Factor Authentication Processes

#81

Post by a-dub »

ketzo wrote: post #47
a-dub wrote: post #32

the problem with mcsweeneys is that it's a humor publication that fails at humor. it's like those sitcoms from the 80s where they had to add laugh tracks because no one actually laughed while watching them. at best it's something for young adults to forward around to try and look sophisticated, but like those young adults, it misses the point entirely by trying much too hard.

There aren't very many things that someone can say that are universally wrong, but "I don't think this is funny and therefore it is failed humor" is probably pretty close

but seriously, it's just not funny. did you read the stupid one about the pumpkins they trot out each year? curse words with serifs, ooh lala.

Re: The New Ten-Factor Authentication Processes

#82

Post by seanwilson »

gwbas1c wrote: post #58
seanwilson wrote: post #50

Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code". 2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mo…

I'd change banks!

Yep, agree with that. UK banks don't usually advertise their log-in UX though so it's a pain being surprised by this and having to switch after going through the long sign up process (usually involves receiving letters by post and multiple sign-up steps over a week).

Re: The New Ten-Factor Authentication Processes

#83

Post by masswerk »

jawns wrote: post #11
quartesixte wrote: post #2

A sign of the times. Seems like our non-technical brethren find 2FA/MFA a burden? McSweeneys’ satire and parodies are rarely in good jest in my experience. This is a criticism of the move towards 2FA/MFA make no doubt about it. The writer, and the editors who let this through, are not happy about this state of affairs. McSweeney’s isn’t a no-name blog or journal either — its name holds sway over those who work in lit…

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix? Digital OTP, like the kind provided by 1Password or Bitwarden, a…

> the security benefits are worth it.

Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration.

(As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)

Re: The New Ten-Factor Authentication Processes

#84

Post by abdel_nasser »

jaza wrote: post #60
abdel_nasser wrote: post #27

my bank insisted that i add a phone number to my account when i called them today. i declined and when pressed briefly explained sim swapping and declined again. a glaring and obvious flaw in the integrity of using a phone number for id verification was not even in the lexicon of this establishment that safeguards nothing less than all of my literal fucking money. they then went on to find that i actually did have a…

Unfortunately people like you (and me), who actually have strong passwords, let alone who understand in any detail what constitutes a strong password, are a tiny minority. They have to design for the lowest common denominator. And even those of us with strong passwords, and a strong understanding of cyber security, are vulnerable to phishing and other attacks, that can be defended against by using MFA. Obviously MFA…

if we had just passwords then there would be far fewer people losing their life savings than with the current system.

Re: The New Ten-Factor Authentication Processes

#85

Post by djbusby »

mjh2539 wrote: post #40
djbusby wrote: post #36

Earlier quoted context omitted.

Plus, grandparents, the group notorious for their tech-skill. I've just taken over all my elder family accounts for internet, TV, phone, etc. Much easier. And all the vendors treat me as HVC cause I'm paying for multiple services on their platforms.

What does HVC mean?

Yea, these three are correct - I use the word Client tho.

Re: The New Ten-Factor Authentication Processes

#86

Post by LargoLasskhyfv »

This is too complicated, and could instead be handled by an intelligent, dynamorphic anal-probe which you sit upon to,

and then have your individual inner patterns recognized.

This could have many other benefits, like corporate approved application of nutrients and drugs by enema,

connection to plumbing to save toilet time, and motivation by dildonic gratification for good work.

It could also give a spine.

Baa! Baa! Baa! Mew!

Re: The New Ten-Factor Authentication Processes

#87

Post by chrismorgan »

55873445216111 wrote: post #68
jiggawatts wrote: post #59

My favourite stupidity is related to self-service password reset questions. You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use. I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right? Well, I was overseas with…

I treat all security questions as if they are just an additional password. I use a password manager and store a random string for each required security question.

Yet even that becomes an social engineering attack vector, if you can talk to a human: “I just put random gibberish in there” is too likely to work.

Re: The New Ten-Factor Authentication Processes

#88

Post by ketzo »

a-dub wrote: post #81
ketzo wrote: post #47

Earlier quoted context omitted.

There aren't very many things that someone can say that are universally wrong, but "I don't think this is funny and therefore it is failed humor" is probably pretty close

but seriously, it's just not funny. did you read the stupid one about the pumpkins they trot out each year? curse words with serifs, ooh lala.

Again: "I don't find this funny" =/= "this is not funny"

Personally, the decorative gourds one always gets me. Different tastes.

Re: The New Ten-Factor Authentication Processes

#89

Post by scrubs »

keitmo wrote: post #38
scrubs wrote: post #10

Ten is a nice round number. Now if it was 11, a nice prime number, well then, that would have been nerdy pretentious. Good job at finding the sweet spot.

The 11th round involves identifying a correct Nigel Tufnel quote from "This Is Spinal Tap".

Damn I wish I thought of that. But, hey, way to go taking care of business!
Post reply on HN