Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MTOTP: Wouldn't it be nice if you were the 2FA device?

github.com

Post reply on HN
Print view View original

71–80 of 116 posts

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#71

Post by ulrikrasmussen »

swiftcoder wrote: post #69
ulrikrasmussen wrote: post #33

Earlier quoted context omitted.

No, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier, thus revealing it to eavesdroppers. It is highly non-trivial to clone the knowledge in someone's brain if they never openly communicate the mTOTP secret but only do the computations in their head.

> No, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier This is only true if the verifier lives on your local terminal - otherwise we use an encrypted channel to transmit to the verifier, or do the exactly same type of timed-salted-hash scheme used here to transmit without revealing the password.

The thing is that you are sometimes tricked into giving the password to someone who is posing as the verifier.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#72

Post by ulrikrasmussen »

crote wrote: post #63
ulrikrasmussen wrote: post #33

Earlier quoted context omitted.

No, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier, thus revealing it to eavesdroppers. It is highly non-trivial to clone the knowledge in someone's brain if they never openly communicate the mTOTP secret but only do the computations in their head.

Not true. There are lots of authentication schemes where the plaintext password is never communicated. This becomes rather crucial when the client doesn't know for sure yet what the identity of the other side is. See for example wifi encryption. Cloning the knowledge in someone's brain is fairly easy. You just need a wrench.

Yes, but that is not how passwords work since the protocol for proving knowledge is that you enter it into the HTML form served by the party claiming to be the verifier.

If we are talking rubber-hose cryptography then a physical hardware token is just an insecure as a brain. Most people are not hacked via wrenches.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#73

Post by alt227 »

lazide wrote: post #49
alt227 wrote: post #40

Earlier quoted context omitted.

IMO if it is possible to use a system wrongly which undermines its security, it is already broken.

There is no system which cannot be used wrongly in a way which undermines it’s security.

OP:

> the fact that people often use it wrong undermines its security

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#74

Post by alt227 »

Jean-Papoulos wrote: post #59
alt227 wrote: post #40

Earlier quoted context omitted.

IMO if it is possible to use a system wrongly which undermines its security, it is already broken.

I can chuck a brick at your head. Clearly the brick is broken

Breaks are meant to be built with, not thrown at heads.

If you build with the brick properly you will have a great wall, if you dont then it will fall down. Pretty simple.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#75

Post by lazide »

alt227 wrote: post #73
lazide wrote: post #49

Earlier quoted context omitted.

There is no system which cannot be used wrongly in a way which undermines it’s security.

OP: > the fact that people often use it wrong undermines its security

Yes, that is what I am replying too.

That applies to everything.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#77

Post by EPWN3D »

If you can be tied to a chair and beaten with a rubber hose until you produce the token, it's just a password, albeit one that rotates.

TOTP works because you have to possess the secure device at the time you're authenticating. If you don't have the device, then no amount of time with the rubber hose can make you cough up the required token.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#78

Post by Ferret7446 »

fxj wrote: post #24
crote wrote: post #5

What makes this 2FA? It's "something you know, plus mental labor", which makes it a password. 2FA is "something you have" (or ".. you are", for biometrics): it is supposed to prove that you currently physically posses the single copy of a token. The textbook example is a TOTP stored in a Yubikey. Granted, this has been watered down a lot by the way-too-common practice of storing TOTP secrets in password managers, but…

TOTP is also just password + some computation. So where is the difference? There is a lot of security theatre around TOTP with the QR code and then need of an app but you can write a 8 liner in python that does the same when you extract the password out of the QR code. import base64 import hmac import struct import time def totp(key, time_step=30, digits=6, digest='sha1'): key = base64.b32decode(key.upper() + '=' \*…

Exactly, which is why TOTP is "weak". "Real" 2FA like FIDO on a security key makes it much harder.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#79

Post by jrm4 »

So, in my head, once I heard the idea, I started thinking of something WAY different, and maybe its worth considering. I was thinking something like a combination "security question," "captcha" and "secondary identifier" (whatever the thing that google et al do when they tell you to match the picture on your phone to complete the login)

I don't know, something like "name the fruits that correspond to your first school colors" or similar

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#80

Post by mindslight »

jrm4 wrote: post #79

So, in my head, once I heard the idea, I started thinking of something WAY different, and maybe its worth considering. I was thinking something like a combination "security question," "captcha" and "secondary identifier" (whatever the thing that google et al do when they tell you to match the picture on your phone to complete the login) I don't know, something like "name the fruits that correspond to your first schoo…

Maybe some type of long physical probe you have to sit on and it generates a hash from the exact shape of your "cavity".

Seriously, am I the only one who was happier without any of this "2FA" crap? VPS/Domain/Google with a hardware token is the one narrow scope where I see any value, and even those I could do without. Every other site is just a non-consensual nagging that hassles me when logging in. Bank accounts are the worst, as every bit of friction for checking my balance/transactions actually decreases my security!

Post reply on HN