9 ms·
Playing with more user-friendly methods for multi-factor authentication
- marc_abonce 1y agoI know that the article is a joke, but the last one is (or was?) actually used by Facebook as a forced mfa when it suspected a correct login to be "suspicious". Of course, it's also a way to force users to tag their contact's photos and train Facebook's face detector by holding your account hostage until you comply, similar to those CAPTCHA street view challenges. Besides, it only works if the attacker is a stranger, if it's an acquaintance (or a very dedicated stalker) then it doesn't work so well anymore.
- BlackFly 1y agoThe problem with multi-factor authentication is its overuse. I would also hate physical keys if every single door I came across required me to unlock it. When you already have so many logins that you start using a password manager, your passwords are already high entropy enough that they don't get brute forced and a leak doesn't compromise your other accounts. TOTP adds challenge response to this, so it is actually a bit better than a password since an interception cannot be reused, but they are both still shared secret and in both cases need to be stored in some other device (password manager vs TOTP code manager). For most logins that don't require real security I just use my password manager for both so it is just a disjoint shared secret approach. Nevertheless, TOTP "increases security" for websites (but not my security specifically) because the shared secret is generated by the website owner so is definitely unique and not reused unlike many other user's passwords. I expect the majority of people are storing their TOTP secrets on the device they are logging in from (their mobile device) and so have single points of vulnerability. So multifactor auth is typically just a disjoint shared secret with a partial challenge. The extra security is just created because the website forces true random shared secret. We could have all this with a single factor.
- _Algernon_ 1y agoWhy couldn't we combine the two? Make TOTP based on a higher-entropy secret with longer generated codes the only factor. This would prevent replay attacks of entered passwords, thus protecting against phishing, and ensure users have safe secrets (since the site generates the secret).
- BlackFly 1y agoThat's my preference. For some things I would be willing to have the increased security of a genuinely separate device.
- pmontra 1y agoThe only 2FA I'm using is the one of my bank, because I must (there are regulations.) I stopped logging in into GitHub since they enforced 2FA on my account. Luckily no current customer of mine is using GitHub. They are on Bitbucket and it does not require 2FA yet. A number of services that I use ask me to enable 2FA. I skip the offer everytime. The worst 2FAs are SMS based: not because of the (in)security of SMSes but because I don't receive SMSes when I'm outside of my country.
- FirmwareBurner 1y ago>because I don't receive SMSes when I'm outside of my country What?! I've never had that issue.
- pmontra 1y agoI never received a SMS from Italy when I was on vacation in Australia in 2019. Apparently my phone contract would allow them but either the phone company did not honor its terms or banks didn't send SMSes to roaming customers. I ended up using Italian payment services that either had their own app or other methods to perform 2FA. I also had an Australian SIM but there were no chances to associate it to my accounts. I guess that it's fair, because a foreign number all of a sudden is a red flag for a stolen account. And nobody sent SMS to me, everybody used WhatsApp or similar services.
- pinoy420 1y ago[dead]
- PeterStuer 1y agoPlease, non of these. Just a QR code with an authenticator app of my choice.
- harwell 1y agoIt’s a joke
- jerjerjer 1y ago> It's incredibly easy to remember your hand. Just ask any of your friends that play poker -- they can surely remember a bad beat. And it's pretty much impossible for an attacker to guess. There's an implication here that users would pick a random hand. I'm sure a set containing all flushes, straights, full houses and four of a kind would account for most of the used passwords.
- zzo38computer 1y agoI would want X.509 client authentication. You can use a passworded private key if wanted (and the server will not need to know your password), and there are other benefits with security and other stuff, compared with the more common 2FA and cookies and that stuff. It also ensures better that the client and server are communicating with each other that they want to rather than someone else that they don't want, then merely using X.509 server authentication only.
- averageRoyalty 1y agoQuite funny. Amusingly, the self-portrait method is effectively the signatures we considered acceptable for financial and legal transactions for many decades - make up a scribble and compare it to a scribble you do previously - if it's close enough and you _seem_ to be the guy, we're good.
- sunrunner 1y ago> make up a scribble and compare it to a scribble you do previously I'll take "Lies that your parents told you about how the world works" for 500, Alex. Serious question though, I thought the whole signature thing was more of a legally binding thing for the signer asserting themselves as X, sort of like checking the "I'm over 18" box. Sort of a "Well we asked you the question, it's not our fault if you lied" type thing.
- j-bos 1y agoI remember opening a bank account and having to sign a specific card that the bank would keep solely to verify my signature on checks.
- lelanthran 1y agoWhen I got my first credit card, circa mid-90s, no one told me I had to sign the bank. Took my brand new card with my brand new girlfriend to a shop and bought something. Handed the clerk my card during payment, she looked at it and said it is not signed so she is not allowed to accept it. I took it back, she gave me a pen, I signed it and gave it back to her. She ran the transaction, got an approved slip, gave me the slip to sign, I signed it and gave it back. She compared the signature on the slip to the signature on the back of the car, and Lo And Behold, They Matched!
- HPsquared 1y agoLike logging in after a password reset.
- FuriouslyAdrift 1y agoA fingerprint locked NFC Yubikey seems to be the preferred with all ages at work. Everyone likes it as long as it is once per login to the computer (which basically means we have to use Edge for everything which is fine). Everyone universally hates passkeys because they never work right.
- Ferret7446 1y agoIt sounds like you're talking about passkeys though? (FIDO2) Or are you using PIV on all of those keys?
- FuriouslyAdrift 1y agoFido2
- esseph 1y agowhisper that Yubikey is holding the passkey data ;)
- 01HNNWZ0MV43FF 1y agoI still don't know what a passkey is, but since Microsoft pushes for it, I assume I'll probably hate it
- esseph 1y agoEverybody is pushing for it, Microsoft is just being dragged along.
- FuriouslyAdrift 1y agoI’m referring to the browser based ‘passkey’ everyone is pushing right now
- BlackFly 1y agoExcept for those whose fingerprints don't work (climbing wears away fingerprints). I have even heard of people struggling to renew their passports because of difficulties getting their fingerprints read.
- 1970-01-01 1y agoThese are such terrible ideas that I expect someone already has one of them on github.
- seplox 1y ago> When I tell people I work on authentication software, I nearly always hear some version of the same story: I hate multifactor authentication. No, really. People hate this stuff. I hate all of the half-cooked non-TOTP MFA methods that I'm forced to use. Just let me use my freaking authenticator app. If you believe that your users prefer (or maybe it's just you?) more databroker-friendly methods, then fine, but please at least provide TOTP as an option.
- riedel 1y agoAt least in Germany all the SMS 2FA has been shut off, but replaced with tons of custom 2FA apps. The security argument is certainly that they can check for 'insecure' devices. But I wonder what the empirical evidence here is and how often (compared to phishing/social engineering) a TOTP token was actually stolen. Worst thing is IMHO Microsoft now which seem to have also shut off the TOTP option and use some other propriatary 2FA scheme now. IMHO banks should simply use FIDO2 HW tokens, but with all that passkey bullshit it becomes unlikely...
- 7bit 1y agoNo it hasn't. How can you make a statement so confident, when obviously you couldn't objectively know?
- thcipriani 1y agoPoker hands would pretty cool for encoding things that you have to recognize quickly; e.g., key fingerprints. If there are 2.5M unique hands then encoding 256 bits of information requires 12(ish) poker hands.
- smokel 1y agoOne aspect I find puzzling is why most two-factor authentication (2FA) applications restrict authentication to only a single valid code at any given time. This constraint inevitably creates a window during which it is inconvenient or impractical to copy the code to another device. Allowing the previous code to remain briefly valid would eliminate this unnecessary delay, enhancing usability without significantly compromising security.
- JamesSwift 1y agoI believe every single 2fa system I've used accepts either the current code or the one directly prior.
- brewdad 1y agoEnte Auth displays the current code and the next code so you can choose whichever best meets the time remaining until the changeover. It’s a nice usability feature.
- fredley 1y agoFWIW 2FAS starts to show you the next code near the end of the window, this is very handy https://2fas.com/ https://2fas.com/
- conradludgate 1y agoHave you actually tried writing a code close to the expiry window? I've definitely submitted codes a few seconds after the expiry and had them still be accepted
- michaelt 1y agoSome users clocks are a minute or two out, so sensible TOTP implementations will actually accept about 5 codes to account for clock error.
- _Algernon_ 1y agoSince totp codes are time based and there is no guarantee that time of the generating device, and the verifying device are exactly identical they usually allow some room for error. You'll probably be fine entering the code before or after for example.
- anteloper 1y agoWhy do we like entropy in auth factors?
- noleary 1y agoImagine two different password strength standards: 1. Just a 4 digit numeric PIN like `1981` 2. A 20 character upper/lower/numeric/special-character password like `qmd1tkf7mwa.PQB0qrz$` -- The PIN has lower entropy and is therefore a lot easier to brute force. I haven't calculated this stuff myself -- I just used Wolfram Alpha -- but it looks like the PIN would take <1 second to brute force, while the 20 character password would take 7.6 * 10^25 years. [1] [2] -- [1] https://www.wolframalpha.com/input?i=password+strength+qmd1tkf7mwa.PQB0qrz%24 https://www.wolframalpha.com/input?i=password+strength+qmd1t... [2] https://www.wolframalpha.com/input?i=password+strength+1981 https://www.wolframalpha.com/input?i=password+strength+1981
- Liftyee 1y agoPedantry warning: I'm not convinced that some of these methods qualify as a second factor of authentication, based on the "something you know, something you have, something you are" model. They're both "something you know", right?
- 542354234235 1y agoThat is actually multifactor. Second factor is just any additional factor.