Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MTOTP: Wouldn't it be nice if you were the 2FA device?

github.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#81

Post by throwaway132448 »

mindslight wrote: post #80
jrm4 wrote: post #79

So, in my head, once I heard the idea, I started thinking of something WAY different, and maybe its worth considering. I was thinking something like a combination "security question," "captcha" and "secondary identifier" (whatever the thing that google et al do when they tell you to match the picture on your phone to complete the login) I don't know, something like "name the fruits that correspond to your first schoo…

Maybe some type of long physical probe you have to sit on and it generates a hash from the exact shape of your "cavity". Seriously, am I the only one who was happier without any of this "2FA" crap? VPS/Domain/Google with a hardware token is the one narrow scope where I see any value, and even those I could do without. Every other site is just a non-consensual nagging that hassles me when logging in. Bank accounts are…

Unfortunately security theatre is viral, and nobody gets paid saying we should have less of it.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#82

Post by gruez »

crote wrote: post #30
fxj wrote: post #24

Earlier quoted context omitted.

TOTP is also just password + some computation. So where is the difference? There is a lot of security theatre around TOTP with the QR code and then need of an app but you can write a 8 liner in python that does the same when you extract the password out of the QR code. import base64 import hmac import struct import time def totp(key, time_step=30, digits=6, digest='sha1'): key = base64.b32decode(key.upper() + '=' \*…

You are supposed to store the password in a Secure Enclave, which you can only query for the current token value. You are also supposed to immediately destroy the QR code after importing it. As I already mentioned, the fact that people often use it wrong undermines its security, but that doesn't change the intended outcome.

>You are supposed to store the password in a Secure Enclave,

That's at best a retcon, given given that the RFC was first published in 2008

>You are also supposed to immediately destroy the QR code after importing it.

Most TOTP apps support backups/restores, which defeats this.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#83

Post by ACCount37 »

Ferret7446 wrote: post #78
fxj wrote: post #24

Earlier quoted context omitted.

TOTP is also just password + some computation. So where is the difference? There is a lot of security theatre around TOTP with the QR code and then need of an app but you can write a 8 liner in python that does the same when you extract the password out of the QR code. import base64 import hmac import struct import time def totp(key, time_step=30, digits=6, digest='sha1'): key = base64.b32decode(key.upper() + '=' \*…

Exactly, which is why TOTP is "weak". "Real" 2FA like FIDO on a security key makes it much harder.

TOTP is the "good enough" 2FA.

If I managed to intercept a login, a password and a TOTP key from a login session, I can't use them to log in. Simply because TOTP expires too quickly.

That's the attack surface TOTP covers - it makes stealing credentials slightly less trivial by making one of the credentials ephemeral.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#84

Post by susam »

fxj wrote: post #24
crote wrote: post #5

What makes this 2FA? It's "something you know, plus mental labor", which makes it a password. 2FA is "something you have" (or ".. you are", for biometrics): it is supposed to prove that you currently physically posses the single copy of a token. The textbook example is a TOTP stored in a Yubikey. Granted, this has been watered down a lot by the way-too-common practice of storing TOTP secrets in password managers, but…

TOTP is also just password + some computation. So where is the difference? There is a lot of security theatre around TOTP with the QR code and then need of an app but you can write a 8 liner in python that does the same when you extract the password out of the QR code. import base64 import hmac import struct import time def totp(key, time_step=30, digits=6, digest='sha1'): key = base64.b32decode(key.upper() + '=' \*…

Original source of the 8 liner Python code: https://github.com/susam/mintotp/blob/main/mintotp.py

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#85

Post by craftkiller »

gruez wrote: post #82
crote wrote: post #30

Earlier quoted context omitted.

You are supposed to store the password in a Secure Enclave, which you can only query for the current token value. You are also supposed to immediately destroy the QR code after importing it. As I already mentioned, the fact that people often use it wrong undermines its security, but that doesn't change the intended outcome.

>You are supposed to store the password in a Secure Enclave, That's at best a retcon, given given that the RFC was first published in 2008 >You are also supposed to immediately destroy the QR code after importing it. Most TOTP apps support backups/restores, which defeats this.

> That's at best a retcon, given given that the RFC was first published in 2008

How so? Apple didn't invent the idea of a secure enclave. Here is a photo of one such device, similar to one I was issued for work back in ~2011: https://webobjects2.cdw.com/is/image/CDW/1732119

No option to get the secret key out. All you can get out is the final TOTP codes. If anything, having an end-user-programmable "secure enclave" is the only thing that has changed.

I think they probably meant "Secure Enclave" in the same way that people say "band-aid" instead of "adhesive bandage", "velcro" instead of "hook and loop fastener", and "yubikey" instead of "hardware security token".

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#86

Post by moralestapia »

josephg wrote: post #25
crote wrote: post #5

What makes this 2FA? It's "something you know, plus mental labor", which makes it a password. 2FA is "something you have" (or ".. you are", for biometrics): it is supposed to prove that you currently physically posses the single copy of a token. The textbook example is a TOTP stored in a Yubikey. Granted, this has been watered down a lot by the way-too-common practice of storing TOTP secrets in password managers, but…

> 2FA is "something you have" (or ".. you are", for biometrics): it is supposed to prove that you currently physically posses the single copy of a token. The textbook example is a TOTP stored in a Yubikey. No, 2FA means authentication using 2 factors of the following 3 factors: - What you know (eg password) - What you have (eg physical token) - What you are (eg biometrics) You can "be the 2FA" without a token by comb…

This.

GP ignores the conventions of the field.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#87

Post by jrm4 »

mindslight wrote: post #80
jrm4 wrote: post #79

So, in my head, once I heard the idea, I started thinking of something WAY different, and maybe its worth considering. I was thinking something like a combination "security question," "captcha" and "secondary identifier" (whatever the thing that google et al do when they tell you to match the picture on your phone to complete the login) I don't know, something like "name the fruits that correspond to your first schoo…

Maybe some type of long physical probe you have to sit on and it generates a hash from the exact shape of your "cavity". Seriously, am I the only one who was happier without any of this "2FA" crap? VPS/Domain/Google with a hardware token is the one narrow scope where I see any value, and even those I could do without. Every other site is just a non-consensual nagging that hassles me when logging in. Bank accounts are…

As op, yeah I'm actually with you on this.

And at the very least, 2FA should be a much more "openly open standard." Which is to say, just do TOTP everywhere, let people have their initial generating key and be done with it.

I generate mine from my computer when I can, but I'm surrounded by all this magic that implies that something different is going on, e.g. the Duo system which I'm forced to use by my job and doesn't make this sort of thing easy, if possible at all.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#88

Post by perching_aix »

I've been pondering about something like this for a while, nice to see someone who didn't give up after seeing how demanding actual crypto is, like I did.

I now wonder if it's possible to store a random value in one's head without it being eavesdroppable. Humans don't really do random, but it's essential for auth.

Re: MTOTP: Wouldn't it be nice if you were the 2FA device?

#90

Post by chias »

crote wrote: post #5

What makes this 2FA? It's "something you know, plus mental labor", which makes it a password. 2FA is "something you have" (or ".. you are", for biometrics): it is supposed to prove that you currently physically posses the single copy of a token. The textbook example is a TOTP stored in a Yubikey. Granted, this has been watered down a lot by the way-too-common practice of storing TOTP secrets in password managers, but…

> this has been watered down a lot by the way-too-common practice of storing TOTP secrets in password managers

I'm open to discovering I'm wrong here, but I have never understood this line of thinking. Assuming you 2fa into your password manager when you first sign in on your device, it's still 2 factors all the way down.

As you sign into your password manager, the "something you have" is your 2fa device that you use to sign into your password manager (which is obviously not being filled in by your password manager). Subsequent password manager unlocks which don't prompt for your token are still 2fa because the "something you have" is your computer with which you signed into your password manager.

Why is this a problem?

Post reply on HN