251–260 of 291 posts
Does anybody have any work arounds to this should it start happening to a few people?
Earlier quoted context omitted.
TOTP is the one that makes the least sense to me. It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). It also has almost all of the downsides of U2F (a pain in the ass if you lose your device).
TOTP is an improvement over SMS in that identity is not tied to a phone number, which has been proven over and over again to be a terrible indicator of identity.
Earlier quoted context omitted.
If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…
If you have strong generated passwords that are different for each system and you use password manager then you would not need 2FA at all. Well maybe if it is for system that stores your password in plain text but who would be stupid to keep user password in plain text and slap 2FA on top of it. U2F and 2FA came to life just because people are bad at making passwords and remembering them. Making non technical people…
Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.
It's a little mind boggling though. Securing money with a $15/mo phone plan. It's an extremely ghetto phone service. If anyone's to blame, it's Boost Mobile. Cricket Wireless. Pay for a major carrier plan.
Earlier quoted context omitted.
I really wish that web browsers had worked on the UI for generating certificate signing requests and importing certificates and that websites had 2FA via username/password along with client-side TLS certificate for authentication. This is more portable than U2F tokens since client-side certificates are part of the TLS standard and should be supported regardless of the application protocol used. Adding other devices c…
It had it! HTML 5 keygen tag https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke... But Mozilla, and Google double teamed to sink it in W3C to push their own bicycle reinvention attempts, which after 10+ years, multiple incompatible versions, and errata ridden revisions are still not there. https://lists.w3.org/Archives/Public/www-tag/2015Sep/0001.ht... Google needs to be kicked out of W3C
Earlier quoted context omitted.
> Symantec VIP See https://www.reddit.com/r/1Password/comments/8yey6y/how_do_i_... (PITA, I know, but running little auth gateways like this is part-and-parcel of doing security for an org.) > Considering how easily actual factual professional security engineers fall for phishing, I don't believe you. It's almost always the service's fault for being designed in such a way that its real async user interactions are ind…
I do use a similar approach to backup the Symantec secret - but what percentage of users do you think are capable of doing this? 0.1%? > It's hard to train users to not forward TOTP tokens sent to them to someone else, if the real service will text or push-notifies the user their TOTP token "at random" (i.e. because the attacker tried to log in.) But if the service never does that — if you always have to go and fetch…
Earlier quoted context omitted.
I'm glad someone is bringing this up. I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.
I keep an old phone around with a duplicate Authy setup. I also photograph the 2FA code or QR code and print it to a safe place.
This is really great advice.
I do something similar. I have a copy of the recovery codes (where possible) in an encrypted volume with multiple copies. Also printouts. The printouts have saved me once already.
Also, don't underestimate the utility of carrying around an encrypted SD card with things you want to retain access to!
Earlier quoted context omitted.
This is certainly a vulnerability, but it also depends on how you get your TOTP codes. I use Bitwarden's browser extension to get mine, and if the domain is incorrect, the extension won't present me with the code. I think this is a decent level of protection from phishing.
I encourage you, as an exercise at least, to think about what you'll do when it doesn't work. You're sure this is the right web site. But Bitwarden won't fill out the code. What could be wrong? Did the idiots who make this web site change the URL? Now, maybe you're a far above average user and you would calmly determine the exact cause, assuming at every step that the most likely explanation is you're being phished.…
Maybe the Bitwarden extension should warn users when they try to copy/view a TOTP code by searching for a login rather than using a matched entry.
U2F is my preferred method of MFA, but many services don't support it, and there can be practical issues even for the ones that do. For example, some services support U2F in a browser but not in mobile apps.
Earlier quoted context omitted.
I really wish that web browsers had worked on the UI for generating certificate signing requests and importing certificates and that websites had 2FA via username/password along with client-side TLS certificate for authentication. This is more portable than U2F tokens since client-side certificates are part of the TLS standard and should be supported regardless of the application protocol used. Adding other devices c…
It had it! HTML 5 keygen tag https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke... But Mozilla, and Google double teamed to sink it in W3C to push their own bicycle reinvention attempts, which after 10+ years, multiple incompatible versions, and errata ridden revisions are still not there. https://lists.w3.org/Archives/Public/www-tag/2015Sep/0001.ht... Google needs to be kicked out of W3C
That isn't 2FA. That is a single factor recovery process. SIM-swapping only defeats SMS-based 2FA if the attacker also has your password, which is difficult to accomplish if you are using good passwords that are unique.
I had to remove this detail from my original post as it was too long: Boost mobile is negligent and not following industry standards. Their whole security model is based on a 4-digit pin. At first I thought somebody had a script working its way up through all the combinations at the login screen, but I no longer feel that is the case. The fact that at least nine of us had this same issue within days makes me think th…