Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML attributes to improve your users' two factor authentication experience

twilio.com

Post reply on HN
Print view View original

31–40 of 82 posts

Re: HTML attributes to improve your users' two factor authentication experience

#31

Post by jffhn »

ayberk wrote: post #16

These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/

>my main complain is not having username and password fields on the same page :/

This!

Our new Linux login has username and password entry fields in separate (and successive) windows, and they look quite similar.

Since I enter my password much more often (to unlock) than my username, I built up a reflex of entering the password, and the rare times I have to enter my username I often type in the password instead, visible to anyone looking at the screen.

I see this new design as a security issue.

Re: HTML attributes to improve your users' two factor authentication experience

#32

Post by colechristensen »

robbya wrote: post #23
hombre_fatal wrote: post #11

Earlier quoted context omitted.

Nope, not if it introduces common customer support backdoors.

Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA? Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option. Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That w…

The back door is either automatic or human account recovery tools.

These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched.

Phone numbers are very public and easy to steal in ways which are difficult to defend against.

Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how hard would it be for that person to recover and retain access to their accounts and services?

With SMS 2FA someone who knows you personally and has control of your phone number is nearly impossible to escape.

All the adversary has to do is say "oh this was linked to my old number" and account support is super likely to just give access away.

You would have to be somewhat of an opsec expert to escape that hell, and even if you know everything it becomes impossible to defend yourself against the owners of your accounts giving access away.

The only real defense is to never associate your phone number with personal accounts which even then is often not possible.

Re: HTML attributes to improve your users' two factor authentication experience

#33

Post by motohagiography »

Dealing with 2FA ux right now. There is a massive gap between threat intel people, product owners, and end users.

From an identity assurance perspective, SMS is the best available. From an authentication perspective, it's increasingly dodgy.

Reality is telcos have user enrollment almost on par with bank KYC, where everything else has great authN but with user asserted identity.

Critics of SMS are technically correct, but 9/10x I don't think they have had to solve identity in an open or federated environment.

Re: HTML attributes to improve your users' two factor authentication experience

#34

Post by robbya »

colechristensen wrote: post #32
robbya wrote: post #23

Earlier quoted context omitted.

Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA? Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option. Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That w…

The back door is either automatic or human account recovery tools. These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched. Phone numbers are very public and easy to steal in ways which are difficult to defend against. Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how ha…

You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA.

I agree with everything you said about SMS for account recovery.

Account recovery that uses a phone number is weak. There was a paper on HN this week that detailed this.

However, if we are going to compare SMS 2FA (I.E. password plus code sent over SMS) against just password, SMS 2FA wins. In both cases I need to steal your password, the SMS part is an added challenge although it's easier to bypass than many people want.

Given SMS 2FA and any other 2FA option, SMS 2FA loses.

Re: HTML attributes to improve your users' two factor authentication experience

#35

Post by hk__2 »

> For older browsers there is another trick to trigger the numeric keyboard and include a bit of extra validation for free.

A simpler one that the pattern attribute, but more hacky-er, is using input type="tel", which I’ve also seen used for credit card number inputs.

Re: HTML attributes to improve your users' two factor authentication experience

#36

Post by colechristensen »

robbya wrote: post #34
colechristensen wrote: post #32

Earlier quoted context omitted.

The back door is either automatic or human account recovery tools. These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched. Phone numbers are very public and easy to steal in ways which are difficult to defend against. Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how ha…

You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA. I agree with everything you said about SMS for account recovery. Account recovery that uses a phone number is weak. There was a paper on HN this week that detailed this. However, if we are going to compare SMS 2FA (I.E. password plus code sent over SMS) against just password, SMS 2F…

In an idealized sense, sure. But not for a practical situation.

SMS as an authentication factor weakens the security because of all of the additional behaviors associated with the account provider which are inescapable.

Re: HTML attributes to improve your users' two factor authentication experience

#37

Post by robbya »

colechristensen wrote: post #36
robbya wrote: post #34

Earlier quoted context omitted.

You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA. I agree with everything you said about SMS for account recovery. Account recovery that uses a phone number is weak. There was a paper on HN this week that detailed this. However, if we are going to compare SMS 2FA (I.E. password plus code sent over SMS) against just password, SMS 2F…

In an idealized sense, sure. But not for a practical situation. SMS as an authentication factor weakens the security because of all of the additional behaviors associated with the account provider which are inescapable.

Edit: looking again, I see what I missed.

> The only real defense is to never associate your phone number with personal accounts which even then is often not possible.

Yes that's exactly right. If I don't trust a website to not use my phone number as the sole factor for recovery, then I should not use SMS 2FA on that site and I should not add my phone number to any part of my profile. If I know (how?) that the website won't use SMS for recovery, then SMS 2FA is better than nothing.

As a website owner, if I offer SMS 2FA auth and use SMS in isolation for recovery, then I'd want to stop using SMS for recovery. After that, removing SMS 2FA and not offering any second factor would weaken my security. I.E. SMS 2FA is weak but better than nothing. SMS single factor recovery is terrible, fix that ASAP.

Re: HTML attributes to improve your users' two factor authentication experience

#39

Post by robbya »

colechristensen wrote: post #32
robbya wrote: post #23

Earlier quoted context omitted.

Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA? Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option. Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That w…

The back door is either automatic or human account recovery tools. These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched. Phone numbers are very public and easy to steal in ways which are difficult to defend against. Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how ha…

> Imagine someone in a domestic abuse situation

Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think all 2FA can be bypassed with that, if not most of modern cryptography.

https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis

> having their phone taken

Keep in mind that other 2FA methods also are phone based, like TOTP / Google Authenticator. Those also fail if your unlocked phone is taken. SMS is even weaker than those, but still better as a second factor versus nothing.

Re: HTML attributes to improve your users' two factor authentication experience

#40

Post by noodlesUK »

What this write up on 2fa is missing is that rather than using proprietary solutions like authy, we should be moving towards what we’ve now standardised as webauthn. If we had platform authenticators or we had a google/apple first party implementation of something like Krypton, we would be in such a better place security wise.
Post reply on HN