Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I read the federal government’s Zero-Trust Memo so you don’t have to

bastionzero.com

Post reply on HN
Print view View original

351–360 of 369 posts

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#351

Post by mormegil »

tialaramex wrote: post #300
mormegil wrote: post #271

Earlier quoted context omitted.

I think the FIDO Alliance is already discussing solutions to these use cases. (And also this is a bit circular reasoning, isn’t it? “Why don’t you use the XYZ standard? Because it does not support our use case. So why don’t you cooperate on adding support to the standard? Why? So that you can use the XYZ standard!”) Also, I think there already are extensions supporting some basic forms of this, however, they are not…

Which requirement of PSD2 do you think is so stringent? I have three bank accounts here: One of them (my good bank) has a chiclet keypad physical authenticator which needs these manual codes entering to get a value back that proves I used the authenticator. The large European bank that handles my salary and so on, relies on SMS entirely, I ask to perform a transaction, they send an SMS with a code, I type it into a b…

Oh, I misunderstood. You enter the mentioned code into an authentication calculator which emits the signature code which is then used. Yeah, that probably fulfills the PSD2 requirements, though I agree it's not exactly good UX and very secure for common users. That (well, and mostly the cost) is the reason everyone goes to mobile authentication apps nowadays.

SMS authentication is... well by one reading of PSD2, it's not acceptable. But in real world, it is basically necessary, and not _that_ insecure (if you ignore SIM swapping attacks etc.). The WYSIWYS aspect comes not from the code but from the message text, which is crucial (and per PSD2, should include at least the amount and... receiver? I forgot). But sure, if people don't read or understand the message, it's not ideal...

While FIDO provides better phishing resistance (than SMS, not necessarily than authentication apps), it doesn't protect against transaction modification (e.g. man in the browser) and for people who care about and understand security, it is strictly worse.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#352

Post by unixhero »

staticassertion wrote: post #253
codemac wrote: post #127

Earlier quoted context omitted.

Google does 1, 2, and 3 internally. If you join https://landing.google.com/advancedprotection/ you can get something similar for personal public accounts.

My company is built on GSuite. We use APP and CAA for everything.

What do you guys do?

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#353

Post by mnd999 »

tssva wrote: post #194
mnd999 wrote: post #156

Earlier quoted context omitted.

Bleeding edge or complete fantasy? This is going to be very very expensive and guess who’s going to be paying for it?

As with most OMB memos it is complete fantasy and agencies won't comply by the date, any date close to it or really ever. The answer to the question "who's going to be paying for it?" is nobody which is why it will never actually get done.

Government contractors are expert at getting paid to deliver nothing.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#354

Post by kevlened »

totony wrote: post #344

How do you do MFA without a password? I thought it was "what you know" "what you have" "what you are" etc?

You only need two of the three factors to make it multifactor. A computer with a fingerprint scanner could be enough if it’s implemented properly. It’s something you have (a specific computer with a specific fingerprint scanner) with something you are (the fingerprint). In practice, you also need to know an identifier like an email or username, but those are often considered public.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#355

Post by dathinab »

themacguffinman wrote: post #349
dathinab wrote: post #336

Earlier quoted context omitted.

No, it's starting at the wrong end and not in any relevant way provide an improvement. Checking for an too old & vulnerable is where you start. And then you can consider to maybe also block other stuff. There is nothing inherently less secure about an rooted device. Sure you can make it less secure if you install bad software, but you can also make it more secure. Or you just need to lower the minimal screen brightne…

> There is nothing inherently less secure about an rooted device. This is clearly wrong, rooted devices are much more insecure because they enable low level access to maliciously alter the system. Malware often requires root and will first try to attempt to attain root, which of course isn't necessary if a user has manually unlocked root themselves. > Your claiming it's ok to take the agency from people away to decid…

You having root access doesn't any arbitrary application on your phone has root access. So no. It is not inherently less secure.

If you can't proceed with a normal life after you root you phone you are NOT free to do so but instead get punished when doing so.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#356

Post by hansvm »

dpatterbee wrote: post #164
hansvm wrote: post #137

Earlier quoted context omitted.

Somebody made the front page here a few days ago because they were locked out of Google with no recourse from precisely that kind of check.

I feel like the issue with the post you mention was the absence of recourse rather than the locking out itself.

That definitely exacerbates the issue, but I don't think it's fair to claim that the absence of recourse is the _only_ problem. If you have limited cell service, limited connectivity, or limited time, then the account being locked can be a significant burden that completely blocks whatever opportunity you were trying to take advantage of. Note that the response time even for newsworthy account locking events is still on the order of hours to days.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#357

Post by zajio1am »

mormegil wrote: post #351
tialaramex wrote: post #300

Earlier quoted context omitted.

Which requirement of PSD2 do you think is so stringent? I have three bank accounts here: One of them (my good bank) has a chiclet keypad physical authenticator which needs these manual codes entering to get a value back that proves I used the authenticator. The large European bank that handles my salary and so on, relies on SMS entirely, I ask to perform a transaction, they send an SMS with a code, I type it into a b…

Oh, I misunderstood. You enter the mentioned code into an authentication calculator which emits the signature code which is then used. Yeah, that probably fulfills the PSD2 requirements, though I agree it's not exactly good UX and very secure for common users. That (well, and mostly the cost) is the reason everyone goes to mobile authentication apps nowadays. SMS authentication is... well by one reading of PSD2, it's…

> While FIDO provides better phishing resistance (than SMS, not necessarily than authentication apps), it doesn't protect against transaction modification (e.g. man in the browser) and for people who care about and understand security, it is strictly worse.

'man in the browser' seems like a situation where the user's device is compromised. In that case it is not big stretch that not only browser could be compromised, but also SMS reading app is compromised.

I.e., the reasonable security request should not be security against 'man in the browser', but security against 'user device is compromised'. In that case SMS is worse, as attacker could completely bypass it, while for FIDO it still need to phish the user to press the button.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#358

Post by tialaramex »

mormegil wrote: post #351
tialaramex wrote: post #300

Earlier quoted context omitted.

Which requirement of PSD2 do you think is so stringent? I have three bank accounts here: One of them (my good bank) has a chiclet keypad physical authenticator which needs these manual codes entering to get a value back that proves I used the authenticator. The large European bank that handles my salary and so on, relies on SMS entirely, I ask to perform a transaction, they send an SMS with a code, I type it into a b…

Oh, I misunderstood. You enter the mentioned code into an authentication calculator which emits the signature code which is then used. Yeah, that probably fulfills the PSD2 requirements, though I agree it's not exactly good UX and very secure for common users. That (well, and mostly the cost) is the reason everyone goes to mobile authentication apps nowadays. SMS authentication is... well by one reading of PSD2, it's…

> (than SMS, not necessarily than authentication apps)

Very dubious. The trick to phishing is that humans are easily confused about what's going on, and WebAuthn recruits the browser to fix that completely. Your browser isn't confused, the browser knows it is talking to fakebank.example because that's the DNS name which is its business, even if this looks exactly like the Real Bank web site, perfect to the pixel and even fakes the browser chrome to have a URL bar that says realbank.example as you expected.

I don't see bank authentication apps helping here. It's very easy to accidentally reassure the poor humans everything is fine when they're being robbed, because the authentication part seemed to work.

I'm somebody who really cares about and would like to think they understand security very much, and I don't think it's strictly worse at all.

One of the things banks have an ongoing problem with is insider facilitated crime. Which means secrets are a big problem, because the bank (and thus, crooked staff working for the bank) know those secrets. Most of these PSD2 "compliant" solutions rely on secrets, and so are vulnerable to bank insiders. FIDO avoids that because it doesn't rely on secrets†.

† Technically a typical Security Key has a "secret" key [typically 256-bit AES] baked inside it, but a better word would be symmetric rather than secret, there is no other copy of that symmetric key, so it isn't functionally secret.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#359

Post by themacguffinman »

dathinab wrote: post #355
themacguffinman wrote: post #349

Earlier quoted context omitted.

> There is nothing inherently less secure about an rooted device. This is clearly wrong, rooted devices are much more insecure because they enable low level access to maliciously alter the system. Malware often requires root and will first try to attempt to attain root, which of course isn't necessary if a user has manually unlocked root themselves. > Your claiming it's ok to take the agency from people away to decid…

You having root access doesn't any arbitrary application on your phone has root access. So no. It is not inherently less secure. If you can't proceed with a normal life after you root you phone you are NOT free to do so but instead get punished when doing so.

For the last time, yes it is inherently less secure. You gain root access by disabling/weakening the OS' built-in protections against root access.

> If you can't proceed with a normal life after you root you phone you are NOT free to do so but instead get punished when doing so.

Freedom to root doesn't mean freedom from the consequences of rooting. Banking apps are hardly necessary for a normal life, and neither is rooting.

Post reply on HN