Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What I Learned After I Published My Twitter Password

blogs.wsj.com

Post reply on HN
Print view View original

21–30 of 39 posts

Re: What I Learned After I Published My Twitter Password

#21

Post by chimeracoder »

kylequest wrote: post #16
tyilo wrote: post #13

Earlier quoted context omitted.

Have you tried Authy? How does Duo Mobile compare to that?

Authy is much more complicated to setup compared to Duo. In my TFA app experiments quite a few people had problems with the setup process (failing to complete it in several cases). They were pretty technical people too, which says a lot about Authy's usability...

There are also a lot of security concerns about Authy that were raised a while back. If you read the comments, it doesn't instill a lot of confidence in the team to implement a secure platform of this sort[0].

Unfortunately, security is one of the few areas in which 90% isn't "good enough" - all you need is one point of failure for an entire system to get compromised.

[0] https://news.ycombinator.com/item?id=4921684

Re: What I Learned After I Published My Twitter Password

#23

Post by parfe »

sehrope wrote: post #6
iLoch wrote: post #2

I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline…

> So if your Twitter password happens to be the same as your ATT password, you're out of luck. Why would you have both passwords be the same? That makes no sense. All passwords should be different. > I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure. TOTP based two-factor auth ( e.g. Google Authent…

>Why would you have both passwords be the same? That makes no sense.

Sure it does. With only one password you are less likely to forget how to log in to an account. It makes perfect sense.

>All passwords should be different.

And eat veggies with every meal. And properly hydrate throughout the day. And get 40 minutes of moderate cardio at least three times a week. And call your mother more. And floss daily.

You can't expect all the people to follow the "best" advice all the time.

Re: What I Learned After I Published My Twitter Password

#24

Post by x1798DE »

danso wrote: post #20
x1798DE wrote: post #11

Earlier quoted context omitted.

>So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff. The flaw is side-channel data leakage about the authentication process and about the user data - they're revealing private information to someone who has not successfully authenticated. Just because the guy published his password doesn't mean it's n…

OK, I see that the flaw was that the phone number was revealed to a user when, after installing the Twitter for iPhone app, wanted to specify that the code be sent via text to a phone number...And the Twitter app reminds the user -- who again, has successfully entered the password -- what number the message goes to. So, if you're thinking, what kind of dumbass would need to be reminded what phone the code was going t…

The threat model isn't "what if someone tells everyone their username and password", it's "What if someone gets your username and password". I think most of the time people have one number they connect to, and everything else will be fringe cases. If you're worried they'll forget what phone number it's sent to, you can do the same thing you do with other verification/reset loops - "Enter your e-mail address and we'll send you an e-mail with the phone number you used". It might not always be the best authentication method, but at this point almost all authentication falls back to "I control the e-mail address that I controlled when I started the account" at this point anyway.

Plus, at the very least you could just reveal the last 2 digits of the phone number upon request. That's still side-channel data leakage, but at least it's much more contained.

Re: What I Learned After I Published My Twitter Password

#26

Post by kryptiskt »

tabrischen wrote: post #25

How does SMS based 2FA work when you're overseas? Will you still be able to receive it and will it incur international charges?

It should work, but some networks are really bad at delivering messages, dropping them or delaying them by hours.

As for charges, that may be a problem. But I have never seen international charges of over a dollar for a simple text. But I haven't been to really exotic locations.

I still use SMS for the second factor, it's way less secure, but I have it mostly to protect against opportunistic attacks, and having the second factor bound to a device that I will lose or kill with 100% certainty isn't a great solution for me.

Re: What I Learned After I Published My Twitter Password

#27

Post by ef4 »

rcaught wrote: post #15
x1798DE wrote: post #7

I think this is just illustrating precisely the point of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises you , and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than…

> a world where everyone carries around a cheap hardware authentication module There are moves towards such a future with U2F / UAF (Fido) and Yubikeys (a U2F version is meant to be released this year). I know it won't roll out exactly as planned, but I'm still excited by the tech.

Yeah, U2F is exciting. It has a lot of weight behind it, and I can't wait to try out the new Yubikey implementation.

We move closer to the day when I can buy embedded authentication hardware in the form of a ring, and I can make endless jokes about One Ring to Rule Them All.

Re: What I Learned After I Published My Twitter Password

#28

Post by lotsofcows »

x1798DE wrote: post #7

I think this is just illustrating precisely the point of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises you , and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than…

"a world where everyone carries around a cheap hardware authentication module"

You mean you don't have ssh-agent and Google Authenticator on your mobile 'phone?

Re: What I Learned After I Published My Twitter Password

#30

Post by oddevan »

orbifold wrote: post #18

I think two factor authentification is just an excuse to confirm your real identity, as it is much harder to obtain a fake phone number compared to a fake email address. I bet internally someone using two factor authentification is seen as more valuable to advertisers, since the phone number can probably be tied to a credit card record and other information collected by banks and other large real world companies. To…

And to the last 5% that use the "Log in with Twitter" buttons in order to avoid creating another (probably weak) password, 2-factor is invaluable since it protects not just our twitter network but any accounts that it has been linked to.
Post reply on HN