Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

That's not how 2FA works

shkspr.mobi

Post reply on HN
Print view View original

221–230 of 269 posts

Re: That's not how 2FA works

#221

Post by girvo »

dmurray wrote: post #214
bigiain wrote: post #211

Earlier quoted context omitted.

> Not all 2nd Factor solutions allow stealing the 2nd factor. The second half of the article goes into detail about the shortcomings of U2F (using "Yubikeys" as it's terminology)

The article's first and most prominent criticism is that it costs at least $30-$60, which might be a barrier to mass adoption but for most HN readers is not a serious reason not to use it.

I own two (one as a backup in my safe in case I lose this one. They all have the same TOTP stuff and setup in every service side by side where possible), to agree with you. Though it’ll be lovely when your iPhone can be a U2F key through their hardware security chips and some OS support, if I’m dreaming out loud.

Re: That's not how 2FA works

#222

Post by snarf21 »

mapgrep wrote: post #217

All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth. It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to…

Yeah. It is mostly about integrating and standards. Private keys in the secure enclave already does everything Yubikey does. All phones already have it. The OSes just need to support FIDO and then we don't need passwords anymore (assuming a passcode lock on device). Essentially everyone would have 3FA (something you know, something you have and something you are)

Re: That's not how 2FA works

#223

Post by [deleted] »

mapgrep wrote: post #217

All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth. It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to…

[deleted]

Re: That's not how 2FA works

#224

Post by m463 »

mapgrep wrote: post #217

All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth. It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to…

Why don't we just skip to 4fa, now.

(though it might be tough for chimeras who have 2 sets of dna)

Re: That's not how 2FA works

#225

Post by TacticalCoder »

Although I agree that 2FA like Google Auth/Authy/etc. doesn't authentify the site, I'd like to comment on this:

> Then the fake site uses your real token and logs in as you. > > Game Over.

Depending on how the site's security work, it's not totally game over. I've seen sites, optionally (you still have to turn the feature on), requiring a 72 hours delay before any setup change is taken into account (like, say, a password change). During this time a warning is sent by email and you can at any time during these 72 hours, unilaterally, prevent the change from happening.

So it may be "game over" in that the attacker can login and see all you account/activity/data (which, yes, is really bad) but it's not totally "game over" as in it doesn't mean "logged out of your account" (unless the attacker also compromised your email ofc, but now we're talking about something else).

Re: That's not how 2FA works

#226

Post by cbsmith »

scott00 wrote: post #193
cbsmith wrote: post #145

Earlier quoted context omitted.

Having two keys, one of which you keep in a secure place, seems pretty simple and intuitive to me.

What does your workflow look like when you set up new credentials?

You need both of the devices when you set it up. That is one thing they are working on fixing, and is easily the biggest hassle of the whole thing.

Re: That's not how 2FA works

#227

Post by TacticalCoder »

cortesoft wrote: post #192
shawnz wrote: post #109

Earlier quoted context omitted.

The attacker could proxy the 2FA request from the real site using the password you enter and therefore you wouldn't be protected.

Right, they could have access to your account, but not full access. A good website will ask for 2FA again if a user tries to do something destructive (like change password, email, or disable 2FA). They wouldn’t be able to do those things.

> A good website will ask for 2FA again if a user tries to do something destructive (like change password, email, or disable 2FA). They wouldn’t be able to do those things.

The page mocking the login page where you need to answer the 2FA will simply phish your 2FA then, after a little delay pretending there's some lag, would say "wrong code, please try again". Now the person enters a second 2FA (which, due to the delay, would be different than the first one).

As I've just commented in a top-level comment: I've seen sites using a 72 hours delay before any destructive change can be made, coupled with the sending of an email containing a link allowing to unilaterally prevent the change.

I've also seen sites using two 2FA (TOTP style), one for login, one for any setup/destructive change. And there are sites using both techniques.

It's not 100% foolproof but it's better than "one 2FA phished and it's game over".

Re: That's not how 2FA works

#228

Post by TwoBit »

smoyer wrote: post #136
rdiddly wrote: post #125

Earlier quoted context omitted.

2FA absolutely will protect you from a phishing site using the password it stole. Not if it also steals the 2nd factor. My response would be more like "2FA is good but not for this problem." This problem is about going to the wrong site. The solution is to go only to the right site.

I bought my whole family Yubikeys last Christmas for exactly this reason ... you can't trick someone into a hardware token authentication. Now I tell people to use something with U2F. I find myself using software U2F and include the secret key in my password manager so that I don't need a hardware key from my laptops.

> you can't trick someone into a hardware token authentication.

Since when?

Re: That's not how 2FA works

#229

Post by cutemonster »

CamJN wrote: post #215
cutemonster wrote: post #182

Earlier quoted context omitted.

Any such password manager you like? Didn't know they could do domain matching

Not the person you asked, but: 1Password which I like, and Lastpass which I don't, both do domain matching in the browser extension. All iOS password managers that integrate into the system do domain matching as well.

Thanks,

In addition to that, now I noticed that in the blog post:

> I recommend the open source Bit Warden. A password manager stores your passwords. But it also stores the web address of site’s login page. If you visit githud, the password manager won’t prompt you to use the login details for github

Re: That's not how 2FA works

#230

Post by AnonC »

8ytecoder wrote: post #140
smoyer wrote: post #136

Earlier quoted context omitted.

I bought my whole family Yubikeys last Christmas for exactly this reason ... you can't trick someone into a hardware token authentication. Now I tell people to use something with U2F. I find myself using software U2F and include the secret key in my password manager so that I don't need a hardware key from my laptops.

How many websites allow U2F as the only 2FA? Every website I tied it wanted a backup authentication app added.

Or perhaps worse, they want SMS OTP to be added as a backup. Even with tons of messages telling people not to share OTPs, it still happens through social engineering.
Post reply on HN