Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

blog.opencore.ch

Post reply on HN
Print view View original

21–30 of 64 posts

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#21

Post by didibus »

rkrisztian wrote: post #15

What I missed from the article is the usual: biometric authentication is not secure. https://www.youtube.com/watch?v=tJw2Kf1khlA (Yes, I'm linking YouTube because unlike popular belief, some channels are actually informative, or some make it easy for us to understand the content.) I would never use my fingerprint for authentication, because it's a flawed concept. The problem is, that your fingerprint is not a passwor…

Biometrics are like identification yes. It checks that it's you. Now knowing that it's you, it retrieves a password stored on-device and uses the password for auth.

The auth is using a password still. The password is just indexed on your face or fingerprint ID and only locally, on-device.

That means the attacker would need the device to ever get at the password in the first place. Then they'd need to be able to break into the device. The latter you can argue is easy or hard, depending on perspective, but they'd need both your faceprint or fingerprint, and a reliable way to replicate it that can fool the reader.

If your fingerprint or faceprint leaks to the world. The attacker would still need your physical device, and would still need to find a way to fool the physical reader with a replica of your faceprint or fingerprint.

In that sense, it's more secure than a password.

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#22

Post by hn_throwaway_99 »

deredede wrote: post #10

The article starts with this description of 2FA: > an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more distinct types of evidence (or factors) to an authentication mechanism. and concludes with (emphasis mine): > For the average user, the smartphone has become a single point of failure, where the theft of one device and one p…

Furthermore, these days I enter the passcode on my phone very rarely (Android requires it after restarting the device or after some amount of time) - normally I use biometric authentication.

The linked WSJ article is a bit hyperbolic and typical journalism overreach by calling it an Apple "security vulnerability", which is bullshit IMO. If you watch the interview with the guy in jail, the main method by which he got people's security code is he asked them. That is, he would tell people he had drugs to sell them and wanted to give them info, so he would get their phone and ask them for their code to unlock it.

At least the WSJ report is honest when it says "The biggest loophole: You".

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#23

Post by frollogaston »

Shank wrote: post #12
politelemon wrote: post #11

> Passkeys, particularly when bound to a physical security key And _only_ when bound to a physical security key. Unfortunately by tying into the marketing of passkeys, there is going to be a pervasive assumption that ecosystem/on-device passkeys are just as secure. Overall a good set of points, and I think it highlights the issues with a lot of the lauded 'convenience' factors in the Apple ecosystem.

> Unfortunately by tying into the marketing of passkeys, there is going to be a pervasive assumption that ecosystem/on-device passkeys are just as secure. Passkeys are an improvement over passwords. Security keys have a place for high security applications like enterprise deployments or the security paranoid. Passkeys stored on security keys can be trivially made worse by allowing users to set bad PINs (like 0000). I…

I feel similarly, improvement is better than no improvement. So far the evolution of mainstream auth was just password -> email/sms, the 2FA stuff in between was niche. Most sites just want that to be someone else's job, passkey is a simple and robust way to do that, unlike oauth.

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#24

Post by OutOfHere »

Passkeys seem overrated for three reasons:

(1) Their use of public-key cryptography is not quantum safe (against quantum computing). In contrast, passwords are very much quantum safe.

(2) They are tied to the provider. Why on Earth would I want to have the provider own my passkeys? Why would I want this vendor lock-in for my authentication?

(3) What if I want multiple accounts for a site? Some passkey vendors may support them, while others may not.

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#25

Post by llbbdd »

rkrisztian wrote: post #15

What I missed from the article is the usual: biometric authentication is not secure. https://www.youtube.com/watch?v=tJw2Kf1khlA (Yes, I'm linking YouTube because unlike popular belief, some channels are actually informative, or some make it easy for us to understand the content.) I would never use my fingerprint for authentication, because it's a flawed concept. The problem is, that your fingerprint is not a passwor…

It's a bit of an aside but your disclaimer intrigued me - YouTube is extraordinarily useful and the popular belief is that it is, I'm not sure at all it's anywhere near a popular belief otherwise. It's like defending a television recommendation to watch How It's Made on the basis that there are also less informative shows broadcast on the same medium.

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#26

Post by fsflover »

pxeger1 wrote: post #2

This is not a compelling argument that 2FA is reduced to 1FA. You need either: something you have (phone) and something you are (face), OR something you have (phone) and something you know (passcode). In either case, there are still two factors. For a criminal to perform shoulder surfing and theft, more things must go right for them than to do either individually.

If your phone is compromised, a single password entry gives hackers full access. How is this not 1FA?

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#27

Post by mindslight »

I realize this post is on a .ch domain, but in a US context "2FA" is a complete anti-feature. As a bank customer, the most important thing you can do to secure your account is to promptly check for unauthorized transactions. Anything that increases the friction to regularly logging in thus makes it harder to maintain your own security.

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#28

Post by hn_throwaway_99 »

rkrisztian wrote: post #15

What I missed from the article is the usual: biometric authentication is not secure. https://www.youtube.com/watch?v=tJw2Kf1khlA (Yes, I'm linking YouTube because unlike popular belief, some channels are actually informative, or some make it easy for us to understand the content.) I would never use my fingerprint for authentication, because it's a flawed concept. The problem is, that your fingerprint is not a passwor…

That YouTube video is bad, if not outright wrong.

First of all, like the other commenter said, these days biometrics are rarely used as a key itself (which is how they are often portrayed in old movies). Instead, they are used as a method to gain access to the key. This is quite literally the case with some biometric Yubikeys - the key is the Yubikey, but to get it to work it needs your biometrics. Are you saying it would be better to have a key with no access control at all? Or one with a passcode (just watch the linked WSJ article from TFA - the guy was able to steal data from phones with passcodes, but biometrics would have made that attack vector much more difficult). Phones work pretty much the same way, perhaps the downside being that people often don't consider their phones as something that needs the same level of guarding as an actual key.

And just as importantly, what these kinds of YouTube videos often miss is the old adage "I don't need to outrun the bear - I just need to outrun you." That is, unless you are a particularly high-value target (and you would know if you are), any security that makes you much more difficult to hack than the person using Princess123 as their password means thieves give up and go to the easier target first.

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#29

Post by 2716057 »

deredede wrote: post #10

The article starts with this description of 2FA: > an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more distinct types of evidence (or factors) to an authentication mechanism. and concludes with (emphasis mine): > For the average user, the smartphone has become a single point of failure, where the theft of one device and one p…

The issue I'm having with this sort of "something you own and something you know/are" two-factor authentication is that it has some potential to cause violence - both can be beaten out of you: https://www.citizen.co.za/network-news/lnn/article/banking-a...

Re: The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

#30

Post by frollogaston »

Shank wrote: post #20
sam_lowry_ wrote: post #19

Earlier quoted context omitted.

Passkeys are improvements over passwords in that login/password tuple is replaced by a single string. Everything else, including hardware tokens, is marketing vendor lock-in.

A passkey is not a single string? A passkey is a public private key pair where the private key is never sent to a server and signs things.

Yep. There is still a lock-in issue though, cause passkeys as implemented are hard to transfer across walled gardens. But at least it's not like early TOTP impls which often had no playbook for when you get a new phone even in the same ecosystem.
Post reply on HN