I've noticed several services in the past that have blocked someone at the 2FA step (either due to getting to that stage and leaving or attempting and failing), then notified the account owner that a login was attempted. I think we just don't hear about it too often because not everyone who has compromised credentials also has 2FA enabled on their accounts in most publicized hacks
Tell HN: Somebody implemented something I wrote a blog about
121–130 of 253 posts
Re: Tell HN: Somebody implemented something I wrote a blog about
#122Earlier quoted context omitted.
But which 2FA prompt should they receive? If MFA can be configured using myriad choices, should a user be prompted to "Insert security key" or "Input security code" or "Send code to your email/SMS" or "Tap YES on your mobile device"? Since you can't know a priori what the second factor will look like, I'd say it's troublesome to try and present a challenge to every user regardless of their MFA configuration.
Note that this is not universal to all systems. If your 2FA options all require the user to enter a code, you can simply display a "Please enter your 2FA code" dialog without divulging what kind of 2FA the user has.
How would you prevent someone from spamming a user just by knowing their username? Say, if the 2FA is done by SMS, or email.
An attacker brute-forcing the password could flood the user with multiple messages. The usual response is doing a password reset, but that wouldn't work in your system.
I wonder how systems that use magic links handle this.
Re: Tell HN: Somebody implemented something I wrote a blog about
#123Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…
Oh, that's so cool! :-) Could you please write to Whatsapp or Telegram and ask them not to delete the EXIF information from shared images on their platform? I understand that they compress images so they don't take too long to transmit and load, but I think there's a big group of their users (especially for Whatsapp) that use their platform to share family pictures. For this purpose, having the EXIF date (if it's ava…
As a general privacy rule I like stripping this by default. Couldn't you just zip up some images to retain this?
Re: Tell HN: Somebody implemented something I wrote a blog about
#124Earlier quoted context omitted.
tl;dr: The code should verify the user's second factor before the user's password. Consider this, scenario A: 1. When attacker enters a username and bad password. then they receive a bad password error. 2. When attacker enters a username and good password, then they receive a 2FA prompt. And then scenario B: 1. When attacker enters a username and bad password, then they receive a 2FA prompt. 2. When attacker enters a…
But which 2FA prompt should they receive? If MFA can be configured using myriad choices, should a user be prompted to "Insert security key" or "Input security code" or "Send code to your email/SMS" or "Tap YES on your mobile device"? Since you can't know a priori what the second factor will look like, I'd say it's troublesome to try and present a challenge to every user regardless of their MFA configuration.
In my pseudo-code example, we're raising a couple errors, InvalidSecondFactorError and InvalidPasswordError. You could imagine there could be finer grained errors, such as TotpRequiredError or HardwareKeyRequiredError, depending on the user's second factors, which could then propagate down to the UI via specific error codes.
The UI could then use these error codes to display the correct prompt, and then resend the request with the appropriate second factor.
Re: Tell HN: Somebody implemented something I wrote a blog about
#125Earlier quoted context omitted.
Note that this is not universal to all systems. If your 2FA options all require the user to enter a code, you can simply display a "Please enter your 2FA code" dialog without divulging what kind of 2FA the user has.
How would you prevent someone from spamming a user just by knowing their username? Say, if the 2FA is done by SMS, or email. An attacker brute-forcing the password could flood the user with multiple messages. The usual response is doing a password reset, but that wouldn't work in your system. I wonder how systems that use magic links handle this.
Your authentication system should have per-user and per-IP rate limits.
Re: Tell HN: Somebody implemented something I wrote a blog about
#126Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…
Oh, that's so cool! :-) Could you please write to Whatsapp or Telegram and ask them not to delete the EXIF information from shared images on their platform? I understand that they compress images so they don't take too long to transmit and load, but I think there's a big group of their users (especially for Whatsapp) that use their platform to share family pictures. For this purpose, having the EXIF date (if it's ava…
I think the EXIF data is removed because, for the vast majority of people that don't think to remove it, it's a safety risk. Posting a picture of your house? Your kid arriving at their first day of school? Some other location you'd rather a bad person not have info on? Most people don't think to remove that data before posting (and sometimes post directly from their phone camera?)... removing that data removes a lot of risk for them. Leaving it in is only considered a small benefit to a smaller subset of people (comparatively)
Re: Tell HN: Somebody implemented something I wrote a blog about
#127Cool, well done. Hope the idea gets picked up by a few more developers here. If you don't mind I'm just just pasting the URL into a comment to make it a link: https://syslog.ravelin.com/2fa-is-missing-a-key-feature-c781...
The comment is a link in the HTML I am served. However there is no underline which is confusing.
I could be wrong, but I'm fairly sure that wasn't the case originally.
Re: Tell HN: Somebody implemented something I wrote a blog about
#128If any Spotify devs are here, please let me explore and add songs, artists and albums to my library without “hearting” it. I often just want to follow up later by “adding to my library,” and it feels weird to “LOVE” it before ever hearing it. I really feel pain when I hear something terrible that I’ve already “liked” and consider the impacts to my algorithm. Please distinguish between “like” and “save.” A simple “plu…
Now that you opened this forum for Spotify feedback: If I do "like/heart" a few songs and then go to the Radio based on one of them, please don't show the songs I already liked in that Radio. I mean, I already "liked/saved" them, why are they appearing in my discovery phase?
Disagree on that - Radio is not just for discovery but also for easy random playlist creation.
Re: Tell HN: Somebody implemented something I wrote a blog about
#129Re: Tell HN: Somebody implemented something I wrote a blog about
#130> Tell people about things you do that they played a part it- it might just make their day.
Agree so much! I’ve met numerous people, often co-workers, who say “oh I know you I used your blog post”. Wish they’d have shot me a quick email! It’s always a nice surprise when someone reaches out to say thanks.