I'm surprised more websites aren't taking advantage of TouchId. It's so easy for people to use.
Even login.gov supports it!
https://www.slashgear.com/chrome-is-adding-touch-id-and-fing...
SMS is not 2FA-secure
191–200 of 379 posts
Re: SMS is not 2FA-secure
#192When my gf lived in Malaysia, she added her phone number to FB and forgot about it. Years later, after having moved back to Vietnam, the number was recycled and someone was able to use that number to gain access to her FB account and reset the password.
Getting access back to her account took a bunch of steps, including adding her current number.
The interface for FB really makes it seem like you might lose access to your account if you don't provide them with your number. Even better is that FB exposes a small list of your friends (and the total count) of everyone who has given them their phone number.
tl;dr: Don't add your phone number to FB.
Re: SMS is not 2FA-secure
#193Earlier quoted context omitted.
Yes, that is exactly what I want. Life should be much more difficult without the TOTP and backup codes, so much that it takes a great deal of resources to get around it, if at all possible. Maybe even providing heavy documentation such as a Facetime call with various proof so that fraudulent actors are sufficiently deterred.
Dude. If somebody wants into your account specifically, they’ll get into it. 2FA, specifically SMS based 2FA, is really about the provider getting mass compromised because people recycle their password across all their sites. It great for keeping people using scripted attacks against a huge list of accounts. It isn’t really to keep people specifically after your account out. If somebody wants your shit and specifical…
> If somebody wants your shit and specifically your shit.... they’ll get it...
How? I don't think Brian Krebs has been hacked, even though he's extremely targeted by hackers (his site is literally the benchmark for performing DDOS attacks on).
Re: SMS is not 2FA-secure
#194Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…
Use Authy instead of Google Authenticator. Problem solved. RFC 4226 doesn't specify that you can't have shared devices.
Re: SMS is not 2FA-secure
#195I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Because with 99.99% certainty the person that needs to unlock the account is me, and not an attacker. Even with a dozen backup yubikeys and spare codes written down I’d still be much more likely to lock myself out than be attacked. If it’s one thing I have learned the hard way it’s that the most dangerous per…
Yup, I have the same misgivings. I hate getting locked out, but at the same time, I'm pretty paranoid and want secure passwords, don't leave copies of them around.
So I've been working on a backup plan. Current incarnation is to use a simple Go cli tool with Shamir's secret sharing algo to break a password into N/M shards. The user can then do whatever they please with the shards, give some to their family, friends, attorney, make a pirate map, get an rfid chip, anything you want.
Re: SMS is not 2FA-secure
#196Earlier quoted context omitted.
So how SHOULD this problem be solved? How should account recovery work?
Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.
Photo ID seems like enough, no?
Re: SMS is not 2FA-secure
#197Earlier quoted context omitted.
So how SHOULD this problem be solved? How should account recovery work?
Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.
What if you are abroad?
My debit card was recently blocked and I had to wait until I went back, walked in the bank and show my face and ID.
Re: SMS is not 2FA-secure
#198Earlier quoted context omitted.
My brain isn't working right now... Can you tell me why something like google authenticator could not be executed as a website? Does it have to be an app? Just wondering if there could be an easier non installed version that was always available. Apologies if it's a really silly question!
TOTP has a secret which is basically the seed of the calculation. The security basically comes from that secret being only on the phone you have and not being copyable. Moving it to the server removes that proximity. At least thats how i see it, but you could do it very easily server side if you wanted with equivalent security loss.
Having the secret only exist on a single phone is the most secure, but keeping a backup of the secret for recovery if you lose the phone only lowers security a negligible amount if you are careful about it.
If it is an account you set up from home, probably the simplest thing to do is print the setup page before you scan the QR code for the secret. Even better, print the page, and then scan that QR code from the printout. Then store the printout where you keep other important papers (e.g., mine would go in my fire proof safe).
Another possibility is to scan the code on two devices. I scan on both my iPhone and my iPad. Nearly all realistic scenarios that involve me losing both of those at near the same time also involve me dying.
Re: SMS is not 2FA-secure
#199My understanding is that you don't even need to do a SIM swap, because the SS7 signaling system is insecure. SIM Swap is likely the easiest way as wage-slave employees are quite pliable to bribes[0]. But if you want to be even more anonymous, you can apparently re-route texts remotely [1]. 0: https://www.nbcbayarea.com/news/local/mans-1m-life-savings-s... 1: https://www.kaspersky.com/blog/ss7-hacked/25529/ I thought…
I am pretty sure this is how they got Bezos' texts. All you need to do is register a CLEC and then you can get your official hookup to SS7. My experience isn't with messaging but I'd imagine if you bid* to deliver messages to a certain area much lower than other carriers, you can target people. * Bidding doesn't happen in real time, but you can tell carriers your "rates" so to speak.
I'm just amazed he was stupid enough to not understand that his texts, messages and devices are compromised.
Re: SMS is not 2FA-secure
#200Earlier quoted context omitted.
So how SHOULD this problem be solved? How should account recovery work?
Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.
I meant for the services currently relying on SMS for account recovery... for example, how should you recover your gmail account if you lose access?