When MFA isn't MFA, or how we got phished

Post by hnburnsy » Thu, Sep 14, 2023, 1:58 AM UTC

dvdhsu wrote: post #147

hnburnsy wrote: post #135

Earlier quoted context omitted.

Thanks for all this insight, this is why HN rules. What is your impression of law enforcement, everyone claims to reach out after an attack, but I've never seen follow up of sucessful law enforcement activity resulting in arrests or prosecution. Thanks again.

(May also have to delete this later, but...) Law enforcement is currently attempting to ascertain whether or not the actor is within the US. If it's within the US, I (personally) believe there's a good chance they'll take the case on and presumably with enough digging, will find the attacker. (The people involved seem to be... pretty good.) But if they're outside US (which is actually reasonably high probability, giv…

Post by drx » Thu, Sep 14, 2023, 2:01 AM UTC

tptacek wrote: post #177

We use OTPs extensively at Retool: it’s how we authenticate into Google and Okta, how we authenticate into our internal VPN, and how we authenticate into our own internal instances of Retool They should stop using OTPs. OTPs are obsolete. For the past decade, the industry has been migrating from OTPs to phishing-proof authenticators: U2F, then WebAuthn, and now Passkeys†. The entire motivation for these new 2FA schem…

Post by toast0 » Thu, Sep 14, 2023, 2:10 AM UTC

andersa wrote: post #150

Guvante wrote: post #32

Earlier quoted context omitted.

On the otherhand having your device die means without cloud backup you either lose access or whoever was relying on that 2FA needs to fall back on something else to authenticate you. After all if I can bypass 2FA with my email whether 2FA is backed up to the cloud doesn't matter from a security standpoint. Certainly I would agree with the assertion that opting out for providers of codes would be nice. Even if it is a…

They could do what Authy does. Codes are backed up to the cloud, so you're not completely fucked if the phone is stolen. But the backup is encrypted, and to access it on a replacement device you must enter the backup password.

Post by toast0 » Thu, Sep 14, 2023, 2:19 AM UTC

hn_throwaway_99 wrote: post #85

dotty- wrote: post #62

Earlier quoted context omitted.

> Google Workspace makes it very easy to set up "Advanced Protection" on accounts, in which case it requires using a hardware key as a second factor, instead of a phishable security code. This isn't immediately actionable for every company. I agree Retool should have hardware keys given their business, but at my company with 170 users we just haven't gotten around to figuring out the distribution and adoption of hard…

> What is a company like mine meant to do here to counter this problem? What is hard about mailing everyone a hardware key? I honestly don't see the problem. It's not like you need to track it or anything, people can even use their own hardware keys. 1. Mail everyone a hardware key, or tell them if they already have one of their own they can just use that. 2. Tell them to enroll at https://landing.google.com/advanced…

Post by cottsak » Thu, Sep 14, 2023, 2:24 AM UTC

bawolff wrote: post #64

rolobio wrote: post #22

Very sophisticated attack, I would bet most people would fall for this. I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. I sync my TOTP between devices using an encrypted backup, even if someone got that file they could not use the codes. FIDO2 would go a long way to help with this issue. There is no code to share over the phone. FIDO2 can also detect the domain making th…

> I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. Depends on what you think the purpose is. People talk about TOTP solving all sorts of problems, but in practise the only one it really solves for most setups is people choosing bad passwords or reusing passwords on other insecure sites. Pretty much every other threat model for it is wishful thinking. While i also think th…