That's not how 2FA works
shkspr.mobi
That's not how 2FA works
1–10 of 269 posts
Re: That's not how 2FA works
#2> A second factor allows a site to better authenticate you. It does not help you identify the site.
That's correct. On the first visit (or enrolment).
All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
Re: That's not how 2FA works
#3> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
With an email link or a Yubikey it might, but with SMS or an Authenticator app it doesn't add any extra way for me to identify the site.
Re: That's not how 2FA works
#4> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
With an email link or a Yubikey it might, but with SMS or an Authenticator app it doesn't add any extra way for me to identify the site.
Email is not really a 2FA though if it can also be used to reset your password.
Re: That's not how 2FA works
#52FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking
I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably.
Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied.
Certificate based authentication in theory allows both sides to Authenticate the Other.
Re: That's not how 2FA works
#6> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
> All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
I don't understand what you mean. Something about 2FA does this? How?
Re: That's not how 2FA works
#72FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture…
> Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied.
It can, simple as that. Some make it moderately more difficult by showing you, say, 9 pictures and asking you to pick the one that's yours. But, again, dead easy to proxy.
Re: That's not how 2FA works
#8> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
With an email link or a Yubikey it might, but with SMS or an Authenticator app it doesn't add any extra way for me to identify the site.
That's true, I was talking about a Yubikey.
Re: That's not how 2FA works
#92FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture…
That’s a really good idea, we should be asking sites to verify themselves with a second factor. Do you know if that’s in use anywhere?
Re: That's not how 2FA works
#10> The top result on Google is invariably an advert for a scam site.
Um... no?