Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

131–140 of 269 posts

Re: That's not how 2FA works

#131

Post by yumraj »

There is another issue, I think, with Cloudflare serving in the middle.

For many websites the Cert is owned by Cloudflare and shows Cloudflare as the Organization and not the website owner. In that case there is no way for me to figure out whether I'm on the actual site or a phished site.

For example see this (it is the Visa opt-out website that was posted a few days ago on HN): https://marketingreportoptout.visa.com/OPTOUT/request.do

Supposedly the above it authentic, but the Cert is showing Cloudflare as the Organization. Now unless the claim is that Cloudflare will never serve phished websites, which I doubt unless Cloudflare is doing a human validation for each client, this is a problem.

Re: That's not how 2FA works

#132

Post by jakelazaroff »

GolDDranks wrote: post #127

Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non-phishing site. The scammer has my password, but is still unable to access the site. How does that not help? Of course if it's a 6-digit code or something, then they are able to stole my it like they did with the password.

I wouldn’t call sending codes by email “true” 2FA, though, since your email address can also be used to reset your password.

Re: That's not how 2FA works

#133

Post by tialaramex »

tommywg7 wrote: post #93

What about certificates? The fake GitHub almost certainly does not have a valid certificate. Isn’t that our one defense against these things?

The problem that a certificate just assures us this is indeed https://githubverification.com/ which it is

This leaves a human to try to make deductions about whether githubverification.com is github.com which is something humans are terrible at, so game over.

If you have WebAuthn then your browser also takes responsibility for only letting you use your github.com credentials on github.com and not even bothering you with any other possibilities that you might think could be safe and are not. That's why WebAuthn prevents phishing.

Re: That's not how 2FA works

#134

Post by nrvn »

I have a question: if a website is clearly involved in phishing how does one report such a website and what is the process of blocking the domain name and chasing the owner?

Re: That's not how 2FA works

#135

Post by invokestatic »

yumraj wrote: post #131

There is another issue, I think, with Cloudflare serving in the middle. For many websites the Cert is owned by Cloudflare and shows Cloudflare as the Organization and not the website owner. In that case there is no way for me to figure out whether I'm on the actual site or a phished site. For example see this (it is the Visa opt-out website that was posted a few days ago on HN): https://marketingreportoptout.visa.com…

This is an issue with any domain-verified TLS certificate, which make up the overwhelming majority of certificates in use. Only CAs which offer organization-verified (OV) or extended-verified (EV) certificates, typically at exorbitant prices, does the TLS certificate attest the publisher of the website.

Re: That's not how 2FA works

#136

Post by smoyer »

rdiddly wrote: post #125
ajross wrote: post #104

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value . Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA wor…

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

I bought my whole family Yubikeys last Christmas for exactly this reason ... you can't trick someone into a hardware token authentication. Now I tell people to use something with U2F. I find myself using software U2F and include the secret key in my password manager so that I don't need a hardware key from my laptops.

Re: That's not how 2FA works

#137

Post by pc86 »

rdiddly wrote: post #125
ajross wrote: post #104

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value . Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA wor…

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

> Not if it also steals the 2nd factor.

Sure, but isn't that the point? There's now a second thing they have to steal, and if they only get the first it's pretty worthless, especially if there's monitoring/alerting in place that prompts a password change and/or locks your accounts pre-emptively.

Re: That's not how 2FA works

#138

Post by yumraj »

invokestatic wrote: post #135
yumraj wrote: post #131

There is another issue, I think, with Cloudflare serving in the middle. For many websites the Cert is owned by Cloudflare and shows Cloudflare as the Organization and not the website owner. In that case there is no way for me to figure out whether I'm on the actual site or a phished site. For example see this (it is the Visa opt-out website that was posted a few days ago on HN): https://marketingreportoptout.visa.com…

This is an issue with any domain-verified TLS certificate, which make up the overwhelming majority of certificates in use. Only CAs which offer organization-verified (OV) or extended-verified (EV) certificates, typically at exorbitant prices, does the TLS certificate attest the publisher of the website.

> Only CAs which offer organization-verified (OV) or extended-verified (EV) certificate, typically at exhorbitant prices, does the TLS certificate attest the publisher of the website.

Even so, I’ll expect financial institutions to have that.

Note: I’m not saying the above is a Cloudflare issue, perhaps someone at Visa was being stingy - I’m just saying it’s an issue and would be bad if that becomes the mainstream.

Re: That's not how 2FA works

#139

Post by 8ytecoder »

ajross wrote: post #104

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value . Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA wor…

If it’s a website which supports API key or any token of sorts (without expiry or long expiry), they could do some real damage even if they can’t use the 2FA again. Another thing would be to disable 2FA.

All they have to do to achieve this is to use the phished credentials to immediately login with the original site, trigger 2FA and then show a field to capture it and pass along. Then capture all the cookies.

The best defense against phishing is to use a password manager that does domain matching.

Re: That's not how 2FA works

#140

Post by 8ytecoder »

smoyer wrote: post #136
rdiddly wrote: post #125

Earlier quoted context omitted.

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

I bought my whole family Yubikeys last Christmas for exactly this reason ... you can't trick someone into a hardware token authentication. Now I tell people to use something with U2F. I find myself using software U2F and include the secret key in my password manager so that I don't need a hardware key from my laptops.

How many websites allow U2F as the only 2FA? Every website I tied it wanted a backup authentication app added.
Post reply on HN