DontDuo: Bypass 2FA with DTMF Tones

#1

Post by _wldu » Wed, Sep 11, 2019, 1:17 AM UTC

DontDuo: Bypass 2FA with DTMF Tones
dontduo.com

Re: DontDuo: Bypass 2FA with DTMF Tones

#2

Post by warhorse10_9 » Wed, Sep 11, 2019, 2:23 AM UTC

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

Re: DontDuo: Bypass 2FA with DTMF Tones

#3

Post by w8rbt » Wed, Sep 11, 2019, 2:26 AM UTC

warhorse10_9 wrote: post #2

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

I think the point is that relying on phone calls and DTMF tones for two factor authentication is trivial to bypass. Anyone can record DTMF tones in a voicemail message and forward calls to that number.

Re: DontDuo: Bypass 2FA with DTMF Tones

#4

Post by ars » Wed, Sep 11, 2019, 2:32 AM UTC

I'm very confused about what this is.

Duo as in Google's Duo video calling? There's 2FA on that? I've never seen any.

Or is there some other Duo it's referring to?

Re: DontDuo: Bypass 2FA with DTMF Tones

#5

Post by closeparen » Wed, Sep 11, 2019, 2:32 AM UTC

warhorse10_9 wrote: post #2

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

To prove to you that PSTN based 2FA is never a reasonable idea.

Re: DontDuo: Bypass 2FA with DTMF Tones

#6

Post by amingilani » Wed, Sep 11, 2019, 2:34 AM UTC

warhorse10_9 wrote: post #2

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

Those are strong words for a service that claims to save 3 frustrating hours a month. Let it be, it's how capitalism works — solving needs, no matter how tiny.

Pretty sure a dev made this for themself and decided to share

Re: DontDuo: Bypass 2FA with DTMF Tones

#7

Post by amanzi » Wed, Sep 11, 2019, 2:36 AM UTC

ars wrote: post #4

I'm very confused about what this is. Duo as in Google's Duo video calling? There's 2FA on that? I've never seen any. Or is there some other Duo it's referring to?

I assume this is referring to Duo Security, owned by Cisco: https://duo.com/

Re: DontDuo: Bypass 2FA with DTMF Tones

#8

Post by markstos » Wed, Sep 11, 2019, 2:44 AM UTC

Or instead of handing over your second factor authentication to a startup web service, you could buy a Yubikey, leave it on your keyring or plugged into your laptop and just touch it.

Some Yubikey models also store the secrets that generate the frustrating 6 character TOTP codes. A pairing a Yubikey with a desktop app, you can copy/paste the codes instead of the error-prone process of manually re-typing them.

Re: DontDuo: Bypass 2FA with DTMF Tones

#9

Post by Spivak » Wed, Sep 11, 2019, 2:45 AM UTC

w8rbt wrote: post #3

warhorse10_9 wrote: post #2

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

I think the point is that relying on phone calls and DTMF tones for two factor authentication is trivial to bypass. Anyone can record DTMF tones in a voicemail message and forward calls to that number.

This is brilliant! BRB gonna set that up right now.

2FA is one of those things that is nice when you want it but a huge PITA when it’s forced on you.

Re: DontDuo: Bypass 2FA with DTMF Tones

#10

Post by Spivak » Wed, Sep 11, 2019, 2:47 AM UTC

warhorse10_9 wrote: post #2

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

I mean it’s really no different than a password manager that stores both your password and your OTP key.