101–110 of 128 posts
So is the takeaway that we should all disable SMS-based options for receiving 2FA codes, because it weakens your 2FA to the level of your (non-2FA) cell phone account? I think when I enabled iCloud 2FA it included 2 channels for communication with my phone: one as a named iOS device (where the OS handles receiving and displaying codes), and another as just its phone number. Is that for SMS? Why would they even do tha…
Earlier quoted context omitted.
A mobile carrier's identity verification could be augmented by asking questions about who you called recently. Remote identity verification over the internet is not solved perfectly, but FIDO's U2F is pretty good. Hardware tokens cost money which most people won't buy, which is one problem. To prevent getting locked out you have to buy (and the service has to support) multiple hardware tokens, but that protects again…
> Hardware tokens cost money All your excellent examples will dwarf mine, but I'll still tell it as a very cheap medium: When I was at Fortis Luxembourg, the bank gave me a passive token: A card with a few dozen digits on it. At each login it would request 3 of those along with the password. The key point of this is, it never transmitted the full key over the wire. So someone who intercepted the communication could n…
I'm baffled. In Germany, the chipTAN method [1] [2] is pretty standard, which uses the bank card as a cryptographic element. And usually, German IT seems to be years behind the industry standard (e.g. I don't know a popular German e-mail provider that offers 2FA.)
[Edit] This is the best thing about chipTAN: Even if the computer is subverted by a trojan, or if a man-in-the-middle attack occurs, the TAN generated is only valid for the transaction confirmed by the user on the screen of the TAN generator, therefore modifying a transaction retroactively would cause the TAN to be invalid. [/Edit]
[1] In action: https://www.youtube.com/watch?v=5gyBC9irTsM&t=41s
[2] https://en.wikipedia.org/wiki/Transaction_authentication_num...
So is the takeaway that we should all disable SMS-based options for receiving 2FA codes, because it weakens your 2FA to the level of your (non-2FA) cell phone account? I think when I enabled iCloud 2FA it included 2 channels for communication with my phone: one as a named iOS device (where the OS handles receiving and displaying codes), and another as just its phone number. Is that for SMS? Why would they even do tha…
Yes. Not everyone using a Mac has an iOS device.
Earlier quoted context omitted.
Yes. Not everyone using a Mac has an iOS device.
Also, what happens when your iOS device gets lost or stolen?
Earlier quoted context omitted.
I thought that would be an answer, but then if your phone is stolen and they get in, couldn't they simply invalidate your 2fa codes too? Mind you, it's probably the best idea.
Put a strong password on the phone. Not just a PIN. Touch ID makes that practical now.
This article brings up a question about protecting email addresses that I'm hoping a HN reader can answer. I have a unique email address for PayPal--different from my normal email address--that I want to keep secret. The problem is that every time I make a purchase, the merchant gets this email address (in addition to the normal email address I gave to the merchant). I know that merchants get it because I get junk ma…
Disable SMS for 2-step and SMS for password resets and use a 2-step mobile app. https://support.google.com/accounts/answer/1066447
https://accounts.google.com/b/0/SmsAuthSettings?LoginInterst...
AND
https://security.google.com/settings/security/contactinfo?pl...
Earlier quoted context omitted.
I thought that would be an answer, but then if your phone is stolen and they get in, couldn't they simply invalidate your 2fa codes too? Mind you, it's probably the best idea.
Simply stealing your phone isn't enough. They also need to know your password change 2-step settings.
This article brings up a question about protecting email addresses that I'm hoping a HN reader can answer. I have a unique email address for PayPal--different from my normal email address--that I want to keep secret. The problem is that every time I make a purchase, the merchant gets this email address (in addition to the normal email address I gave to the merchant). I know that merchants get it because I get junk ma…
You can right-click the page in Firefox and choose "view page info", then on the security tab you can see if it's paypal, see the certificate, etc.. Someone could hijack right-click, it's going to be a bit of effort though. I think in FF shift+rightMouseClick overrides normal right-click to give you the browser menu, but probably that's capturable by the site too.
Ctrl+I is the shortcut, but I don't think it handles frames.
Earlier quoted context omitted.
> Hardware tokens cost money All your excellent examples will dwarf mine, but I'll still tell it as a very cheap medium: When I was at Fortis Luxembourg, the bank gave me a passive token: A card with a few dozen digits on it. At each login it would request 3 of those along with the password. The key point of this is, it never transmitted the full key over the wire. So someone who intercepted the communication could n…
> Security? The best I ever had from banks. I'm baffled. In Germany, the chipTAN method [1] [2] is pretty standard, which uses the bank card as a cryptographic element. And usually, German IT seems to be years behind the industry standard (e.g. I don't know a popular German e-mail provider that offers 2FA.) [Edit] This is the best thing about chipTAN: Even if the computer is subverted by a trojan, or if a man-in-the-…
Pretty clever. On my chipTAN (Belgium, ING) I have to enter the number by hand (part of the account# of recipient, amount).
On the positive side mine does ask for a PIN before generating the TAN, so is probably a bit more secure (balanced with a wear of the keys on the TAN generator, of course - so it is arguable which one is better)