Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

161–170 of 269 posts

Re: That's not how 2FA works

#161

Post by scottLobster »

lisper wrote: post #144
rdiddly wrote: post #125

Earlier quoted context omitted.

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

> The solution is to go only to the right site. i.e. blame the victim. This generalizes to: the solution to user error is for the user not to make errors. So no, that is not the solution.

Actually better education and training is often the only real solution. It isn't "victim blaming" if the situation is at least theoretically within the victim's control. If some random "plumber" that I didn't call for shows up at my house, asking to be let in to replace some of my pipes, and I say "okay", then he robs me, is it victim blaming to say perhaps I should have been more suspicious of strange plumbers randomly showing up at my house to do work?

Re: That's not how 2FA works

#162

Post by sulam »

smokey_circles wrote: post #153

No. 2FA is designed to authenticate that this is you logging in. Wrong off the bat. The "they just use your login token" is akin to "they just hacked the CIA's database". Just . I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem whe…

> 2FA is designed to authenticate that this is you logging in. Wrong off the bat.

Pretty sure you are in agreement with the post here. IOW, 2FA isn't to authenticate the site.

Most of 2FA I use won't help you assuming the credentials I just gave the phishing site are immediately forwarded to the real thing. I will see a login verification, just like I expected, from the site I expected it to come from. Maybe, just maybe, I might notice that the login location is not where I am, for 2FA implementations that tell you that.

Re: That's not how 2FA works

#163

Post by smokey_circles »

paraknight wrote: post #158
smokey_circles wrote: post #153

No. 2FA is designed to authenticate that this is you logging in. Wrong off the bat. The "they just use your login token" is akin to "they just hacked the CIA's database". Just . I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem whe…

> The "they just use your login token" is akin to "they just hacked the CIA's database". Just. He's saying that they can basically MITM you, which is true. GitHub asks attacker for token, attacker asks you, attacker gives token to GitHub on the spot, presto.

Ah, I did overlook that one.

That said: I remain unconvinced that 2FA is a trivial thing to beat. Now we're talking about an active attempt to impersonate you, as opposed to a general catch-all-the-2fa-less-logins

Put another way: If you ran this phishing site, would you focus your time on the logins with 2FA enabled (which if I've understood correctly means you'd have to catch them in the window the token is valid for) or the logins without?

Re: That's not how 2FA works

#164

Post by aidenn0 »

izacus wrote: post #123
aidenn0 wrote: post #99

Earlier quoted context omitted.

Stealing the computer is usually enough, as a browser cookie serves as proof of authentication all on its own. Some destructive operations require extra auth, but in terms of data exfiltration, stealing a laptop gives you everything you need.

What exactly does that have to do with YubiKeys though? Every time you use one you need to enter password. And you can also immediately revoke it as soon as you notice its stolen.

I kind of omitted that part. Having a YubiKey in or not in the laptop won't really affect things (other than the fact that you will need to get into your account somehow without the yubikey if the yubikey is stolen).

Re: That's not how 2FA works

#165

Post by smokey_circles »

sulam wrote: post #162
smokey_circles wrote: post #153

No. 2FA is designed to authenticate that this is you logging in. Wrong off the bat. The "they just use your login token" is akin to "they just hacked the CIA's database". Just . I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem whe…

> 2FA is designed to authenticate that this is you logging in. Wrong off the bat. Pretty sure you are in agreement with the post here. IOW, 2FA isn't to authenticate the site. Most of 2FA I use won't help you assuming the credentials I just gave the phishing site are immediately forwarded to the real thing. I will see a login verification, just like I expected, from the site I expected it to come from. Maybe, just ma…

I might be, I took the article at it's title to mean "2FA does not protect you from your password being leaked"

Re: That's not how 2FA works

#166

Post by unilynx »

m4tthumphrey wrote: post #148

Slightly OT: Odd timing but one of my services sent me a push notification earlier about setting up a "personalised code" which would be included in all emails. I thought this to be a novel way that could _help_ with the email phishing problem, if adopted and implemented properly.

The user still has to notice that the personal code is missing in the phishing emails.

If you could trust users with "always check for this personal code in the emails, ignore emails without it" we could also trust them with "your bank will never email you a login link"

Re: That's not how 2FA works

#167

Post by janwillemb »

+1 for bitwarden as password manager. It did indeed save me a few weeks ago from a phishing attempt. After reporting it to my employer and warning all my colleagues it turned out to be the tech department doing a white hat test to educate the employees :)

Re: That's not how 2FA works

#168

Post by sulam »

dheera wrote: post #121
ajross wrote: post #104

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value . Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA wor…

Also, I'm a big fan of U2F keys including Yubikeys. I don't use SMS, deprecated it 10 years ago in favor of e-mail, and would never use SMS for 2FA. I still have a virtual SMS number that forwards to my e-mail for the idiot sites that still insist on it. For most people, SMS is hackable, tied to a single battery-powered device, easy to steal (after which for most people in the default phone configuration the SMS veri…

I would love to be a fan of Yubikeys, in fact most people would say I _am_ a fan of Yubikeys, I think I have like 10 of them (due to product evolution and always buying a few when I buy one).

Unfortunately most of the sites I use do not have anything to do with them.

Re: That's not how 2FA works

#169

Post by lisper »

scottLobster wrote: post #161
lisper wrote: post #144

Earlier quoted context omitted.

> The solution is to go only to the right site. i.e. blame the victim. This generalizes to: the solution to user error is for the user not to make errors. So no, that is not the solution.

Actually better education and training is often the only real solution. It isn't "victim blaming" if the situation is at least theoretically within the victim's control. If some random "plumber" that I didn't call for shows up at my house, asking to be let in to replace some of my pipes, and I say "okay", then he robs me, is it victim blaming to say perhaps I should have been more suspicious of strange plumbers rando…

> education and training is often the only real solution

No. That is never the real solution. At best it is a necessary evil, but generally resorting to this is a reflection of a failure of imagination.

The reverse authentication problem in particular is easily solved by the right UI design plus some improved infrastructure behind the scenes. Certificate pinning, for example, would help a lot. The hard part is not coming up with a solution, or even implementing it, but convincing everyone to adopt the solution because it doesn't help unless it is widely deployed.

Re: That's not how 2FA works

#170

Post by bostik »

valvar wrote: post #115
kube-system wrote: post #110

Earlier quoted context omitted.

> 2FA absolutely will protect you from a phishing site using the password it stole. The author is pointing out that they will steal both the password and your 2FA token.

While this is possible, it does require significantly more effort on the part of the attacker and there are many more points of failure. So I'm guessing most phishing sites don't actually do that, even though of course some do.

Phishing has been commoditised, the criminals don't write their own pages anymore.

In fact the phishing toolkits have been doing TOTP passthrough/relay for a few years now. For the attacker, it's a nice feature: victim could be using SMS, authenticator app or even an out-of-band delivered token book - they are all captured and passed along equally well.

U2F and FIDO2 with hardware keys are the only realistic safeguards. On the other hand, I do subscribe to the stated problem, because for most people they are a usability snag. The NFC variant has the potential to address this, though: instead of plugging a key in and touching the blinky button, you just wave your keyring next to the device. Too bad NFC readers are not universally available on phones, tablets or laptops.

Post reply on HN