Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is a secure way to allow 2FA resets?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 76 posts

Ask HN: What is a secure way to allow 2FA resets?

#1

Post by tvirelli »

I have 2FA on one of my web apps. Most users are using Google Authenticator which uses TOTP (Time-Based One-Time Password). On first login, we show them a QR code. We instruct them to save a copy of this QR code in the event they get a new phone or want to install a new 2FA app. However, I am running into a situation where users are not doing this. I can easily enough reset their account to show a QR code again on next login, but my question is: What is the safest way to "authenticate" them for a reset? I could do things like send a reset email to the email associated with the account, but I am just wondering what others are doing for situations like this. I want to make sure I am doing it as securely as possible.

Thanks!

Re: Ask HN: What is a secure way to allow 2FA resets?

#2

Post by segfaultbuserr »

This is the most tricky issue about 2FA: who's going to authenticate the authentication system? From what I've seen in practice, if an account is lost, there are two primary ways for recovery.

(A) Secret key. When a user is setting up 2FA for his/her account, the system generates a secret passphrase/QR Code as a crypto key, with instructions for user to write it down or print it out, then store it at a secure location.

(B) Manual review. The policy of a hosting company I use, is that when a 2FA-protected account is lost, the user must submit a national passport and proof of payment to reset the account manually.

And if user wants to add a new device.

(C) Send a challenge to the original device. If the system is in form of an app, it's as easy as showing up a Yes/No warning in the app: someone is adding a new device to your account, do you trust it? This is commonly used for various chat apps.

However, all the methods are not going to work for your use case, as the user wants to bypass the 2FA when setting up a new device... Currently, I don't see a satisfactory solution, otherwise, it effectively opens up a loophole and nullify the advantage of 2FA.

Let's see what other readers are saying.

Re: Ask HN: What is a secure way to allow 2FA resets?

#3

Post by PaulAJ »

One option would be on the sign-up side: get them to "test" the recovery option. Keep bugging them about it every log-in until they do. This has two advantages:

1: This sends the message that you think it important, which might help them realise it is too.

2: They will have printed the QR code. Putting it somewhere safe is a small additional step.

Re: Ask HN: What is a secure way to allow 2FA resets?

#4

Post by richardwhiuk »

You probably want to request a reset.

When a reset is requested, you should then allow a grace period - possibly up to a month for the reset to be cancelled. You should notify the user via email/out of band mechanism that a reset has been requested.

On each login you should prompt that the reset is ongoing and that it can be cancelled.

Finally after a month, you revoke the 2FA and allow a new device to be activated.

Or alternatively/as well, you require that the user sets up a new account. You may allow them to merge this account after the reset has completed.

Fundamentally the question is "if a user took over someone else's account what the impact be?"

On reset, you may want to delete any sensitive recoverable data - e.g. Credit card details or Passport info.

Re: Ask HN: What is a secure way to allow 2FA resets?

#6

Post by steventhedev »

Consider the threat model:

An adversary takes over the email account, and checks if they reused their password on your site. If they didn't, then they'll try to reset the password, and you should check the second factor before resetting the password. If they did reuse their password, then you should check the second factor on login (assuming it's coming from a previously unrecognized source). At this point, the attacker will either give up, or attempt to contact your support channels, impersonating the user.

It's up to you what restrictions you place on your support mechanism for resetting 2FA. I would suggest a combination of the following:

- photo of a currently valid credit card associated with the account

- photo ID with address that matches billing address

- mandatory 7 day delay in the reset

- prove access to the payment method by issuing a payment for some fractional amount and request the amount, then refund it (or don't and keep it as a "security fee")

But no matter what you do, please please please be consistent. Train your entire support staff (if any), keep records of when people talk with you, don't disclose when the last time you talked was, and insist on following a process. If your process fails, see how and improve it.

Re: Ask HN: What is a secure way to allow 2FA resets?

#7

Post by e12e »

You're running up against the issue of identity management. The schiboleth sso technology of colleges and research institutions solved this by letting institutions manage accounts. To reset your login, go to you it department with photo ID and request a reset.

Obviously not very convenient. But one approach is to simply let a third party, like Google, do the identity management. Have only third party sso login, and don't do any identity management - only authorization.

I'm not aware of any frictionless, convenient and secure method. That was the reasoning behind Mozilla's web auth/sso project (I forget the name); access to email equals access to account recovery - so why not just allow proof of email account access be proof of identity?

Re: Ask HN: What is a secure way to allow 2FA resets?

#8

Post by amf12 »

steventhedev wrote: post #6

Consider the threat model: An adversary takes over the email account, and checks if they reused their password on your site. If they didn't, then they'll try to reset the password, and you should check the second factor before resetting the password. If they did reuse their password, then you should check the second factor on login (assuming it's coming from a previously unrecognized source). At this point, the attac…

> photo ID with address that matches billing address

Please don't do this. There are people who move often to not have their current address on their photo id.

Re: Ask HN: What is a secure way to allow 2FA resets?

#9

Post by lozenge »

Don't use email or SMS as it weakens the security to that of their email or - yuck - phone company customer service.

Manual review with proof of ID is the only way. Anything else will just have people not following instructions and requesting manual review anyway.

If anybody asks for higher security you can add a profile option to disallow manual review for their account. This should be visible on the settings screen but I would suggest making them write a request to turn it on. This can then open into a conversation about security if you are interested. And prevents people who don't understand it from turning it on to "increase security".

Re: Ask HN: What is a secure way to allow 2FA resets?

#10

Post by rrdharan »

e12e wrote: post #7

You're running up against the issue of identity management. The schiboleth sso technology of colleges and research institutions solved this by letting institutions manage accounts. To reset your login, go to you it department with photo ID and request a reset. Obviously not very convenient . But one approach is to simply let a third party, like Google, do the identity management. Have only third party sso login, and…

I believe Persona is the project you are thinking of: https://en.wikipedia.org/wiki/Mozilla_Persona
Post reply on HN