Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Somebody implemented something I wrote a blog about

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 253 posts

Re: Tell HN: Somebody implemented something I wrote a blog about

#21

Post by runlevel1 »

xwx wrote: post #16
Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

If I've understood the linked post, the login panel doesn't have to behave or look different if someone gets the username and password right. You could still show everyone the 2FA input. It's suggesting that if the username and password are right but 2FA isn't the system should let the account owner know.

Correct. The blog suggests letting them know out-of-band, like via email, not in the login flow.

Re: Tell HN: Somebody implemented something I wrote a blog about

#22

Post by medevacs »

Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

I'm under the impression you misread the original blog post, which by the way does not really do a very good job in terms of explaining how this should be implemented.

IMHO, the idea is not to display the info about wrong 2FA code on the login page but to use a separate channel to inform the account owner about this recent, failed login attempt. So, no info on the login page of the website (adversary would still not know that they have a good password but wrong 2FA) but e.g. an email, a text message, a push notification, etc. with this info. I would certainly like to know that someone, somewhere is trying to login to my account and that this adversary is in possession of my actual password.

Re: Tell HN: Somebody implemented something I wrote a blog about

#23

Post by Rygian »

xwx wrote: post #16
Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

If I've understood the linked post, the login panel doesn't have to behave or look different if someone gets the username and password right. You could still show everyone the 2FA input. It's suggesting that if the username and password are right but 2FA isn't the system should let the account owner know.

I have read the linked post too quickly before sending my initial comment. Indeed, a back-channel notification to the legitimate account owner is probably a good idea.

On the other hand, disclosing to the attacker that they got the password right is not acceptable.

Re: Tell HN: Somebody implemented something I wrote a blog about

#24

Post by Rygian »

DangitBobby wrote: post #10
Rygian wrote: post #7

I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…

I don't know of anyone who does 2FA this way.

My employer does it for products requiring PCI certification. Our PCI auditor recommends it even though it's not a formal requirement of PCI v3.

Re: Tell HN: Somebody implemented something I wrote a blog about

#26

Post by soco »

rexfuzzle wrote: post #12
Ayesh wrote: post #9

The Iceland NIC does this ( https://www.isnic.is/en/site/login ). Customer support burden when the lose the 2FA key is solved by adding a hefty fee (around €100) to recover it. No webauthn support yet though.

Interesting- I think that is the first time I've seen password and 2FA code on the same page. Guess that means you may not know if your password or 2FA code is incorrect depending on the error page

Or the login process should just go ahead and ask the 2FA either way - and just fail you in the end without explaining why. And then notify only behind the scenes via mail that the password was correct but the 2fa wrong. That would be the way to handle it. I'd receive such notifications from time to time - I mix up the 2FA accounts sometimes, other times I'm slow typing and it expires - but I can live with that little extra email.

Re: Tell HN: Somebody implemented something I wrote a blog about

#28

Post by spiffytech »

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding.

I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted.

At the time I was using Opera, so I wrote in to their customer support suggesting that the prompt appear after the new page loaded. I never heard back, but a couple months later their next major release implemented exactly that behavior. A few months after that, every other browser followed suit.

I can't have been the only one bothered by the existing behavior, but given how long browsers had worked that way before I wrote in, I like to tell myself that the timing wasn't a coincidence, and that my little suggestion rippled out into a change that made a small thing better for the whole world :)

Re: Tell HN: Somebody implemented something I wrote a blog about

#29

Post by Lendal »

As 2FA adoption spreads, the possibility increases that someone could be using 2FA but not know the rule about not reusing a password. This feature improves the spread of that gospel. It seizes the opportunity to impress an abstract concept to the technically-challenged in a way that is no longer abstract. I like it.

Re: Tell HN: Somebody implemented something I wrote a blog about

#30

Post by NKosmatos »

Bravo!!! Such a simple (and more secure) change to the way 2FA works. This should be the standard and also mandatory in many similar cases. Good for you and for sharing this improvement, that’s the mentality all of us should have. Reminds me on how Volvo shared the 3 point safety belt patent with everyone else so as to make all cars safer, instead of keeping it to themselves I order to profit [ https://www.forbes.com/sites/douglasbell/2019/08/13/60-years... ].
Post reply on HN