Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Somebody implemented something I wrote a blog about

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 253 posts

Re: Tell HN: Somebody implemented something I wrote a blog about

#11

Post by anamexis »

Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

I think the majority of places I use 2FA, the 2FA prompt is on a screen after the password login. This is because the use of 2FA is an account option, so not all accounts will have it active.

Re: Tell HN: Somebody implemented something I wrote a blog about

#12

Post by rexfuzzle »

Ayesh wrote: post #9

The Iceland NIC does this ( https://www.isnic.is/en/site/login ). Customer support burden when the lose the 2FA key is solved by adding a hefty fee (around €100) to recover it. No webauthn support yet though.

Interesting- I think that is the first time I've seen password and 2FA code on the same page. Guess that means you may not know if your password or 2FA code is incorrect depending on the error page

Re: Tell HN: Somebody implemented something I wrote a blog about

#14

Post by rexfuzzle »

DangitBobby wrote: post #10
Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

I don't know of anyone who does 2FA this way.

This was posted above: https://www.isnic.is/en/site/login First time I've seen it too

Re: Tell HN: Somebody implemented something I wrote a blog about

#16

Post by xwx »

Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

If I've understood the linked post, the login panel doesn't have to behave or look different if someone gets the username and password right. You could still show everyone the 2FA input.

It's suggesting that if the username and password are right but 2FA isn't the system should let the account owner know.

Re: Tell HN: Somebody implemented something I wrote a blog about

#17

Post by jstanley »

Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

Unless you're an especially high-value target, I'd rather you gave quicker feedback about whether or not I have remembered my password correctly than you make it impossible to determine whether or not a password is correct without also having to input the 2FA token.
Post reply on HN