Domain Matching 2FA • Hacker News Board

Re: Domain Matching 2FA

#11

Post by joskvw » Sat, Jun 10, 2023, 3:14 PM UTC

ImPostingOnHN wrote: post #5

this is done by some darknet sites running tor hidden services on generated onion domains, for similar reasons: https://shufflingbytes.com/posts/ripping-off-professional-cr...

That's a really good post, interesting read. This is similar in some ways but I don't see how their approach protects the user from more advanced attacks (an attacker could still swap the captcha).

Re: Domain Matching 2FA

#12

Post by joskvw » Sat, Jun 10, 2023, 3:30 PM UTC

noja wrote: post #4

How does U2F come into this?

I agree that U2F/webauthn/FIDO2 is superior (in terms of security and in most cases convenience) in basically every way. This is an alternative approach that is less secure than webauthn but a bit more secure than regular number matching or enter this code 2fa.

Re: Domain Matching 2FA

#13

Post by joskvw » Sat, Jun 10, 2023, 3:38 PM UTC

mdg12v wrote: post #7

Does not 2fa mean that user will not be redirected out until verification code is entered? I think article needs more clarification. Can you show where phishing atack is possible in the following scenario?: 1. Open login page 2. Enter credentials (step 1) 3. Enter verification code (step 2) 4. Authenticate, redirect.

If you enter google.com in your browser and login, unless you misspelled the domain and that didn't get flagged by anything, you'll be fine. If a relative that doesn't know much about tech gets a text/email asking them to login to their bank but the site linked is b4nk0f4m3r1c4.com, that phishing site could replay the entered credentials into the real site to login.

Re: Domain Matching 2FA

#14

Post by joskvw » Sat, Jun 10, 2023, 3:42 PM UTC

9dev wrote: post #3

Instead of placing the numbers in the path, why not use a subdomain, e.g. 5678.example.com, and have that routed using a wildcard DNS record, then let users copy-paste the full ~~~domain name~~~ URL?

This is a valid approach, but it might lead to a more complicated setup compared to the alternative approach shown in the article (example.com/5678).

Re: Domain Matching 2FA

#15

Post by joskvw » Sat, Jun 10, 2023, 3:43 PM UTC

adhvaryu wrote: post #9

joskvw wrote: post #2

This is the first blog post I've put on HN. Feedback is appreciated.

Not quite readable on mobile.

My bad, sorry about that.

Re: Domain Matching 2FA

#16

Post by makkesk8 » Sat, Jun 10, 2023, 5:00 PM UTC

Interesting idea. However I do like the approach bankid did using qrcode [1] this does not however match a domain but matches a particular vendor that shows up after you've scanned it and asked to enter your security code. This way you can always verify the vendor is actually the website you are trying to log into.

[1] https://www.bankid.com/en/utvecklare/guider/teknisk-integrat...