2FA two step verification & the obsession with security - Page 1
Forum section: electronics / general

author: jonovid
author_rank: Super Contributor
timestamp: February 12, 2022, 07:20:00 pm
content: recently google ,microsoft and others have started pushing two step verificationsand having an obsession with security.as if it was a big threat to them.as a non-phone owner.Inever askedfor this level of security. Inever askedfor more verificationsits like a door to door salesman selling padlocks but he has the master key.when your front door already has a lock & door-key.salesman is saying you need a padlock too.what ever happened to using your personal profile as verification.URL- known location & known activitys. this has worked for yrs no problem at all until mid 2020then the paranoia started from them.the two step verification USB thumb drive 2FA security key so its it a scameanother bit of hardware to buy, another online financial parasite?just as a phone can also be a financial parasite.what if this 2FA thing locks me out of my own hardware?or if it locks me out of my own online accidents?security is a two way street. it can lock you out of your own abode if it fails to work.my point is the obsession with security is not coming from us users, but google , microsoft & apple Incwho are the paranoid users, that say we want this.

author: tszaboo
author_rank: Super Contributor
timestamp: February 12, 2022, 07:47:54 pm
content: I read a study, that 2FA makes accounts 2x safer.I'm more upset about rules for passwords, that is really getting out of hand.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 12, 2022, 08:03:53 pm
content: 2FA is not new, eg. SIM cards, ATM cards. Password (something you know) is I think a strange concept for security, it can be stolen easily and remotely, without even realizing it has been stolen. Also you cannot memorize so many different passwords, so you will reuse them, making the issue even worse. In a non online world, password might be enough but at the moment it is not. I think the actual issue is how to make 2FA more transparent to user, eg by using biometrics and secure environments in mobile devices.

author: jonovid
author_rank: Super Contributor
timestamp: February 12, 2022, 11:49:27 pm
content: if I need one of themUSB thumb drive 2FA verification keyshow do I know if its trustworthy? they are not free!its a bit like buying a crypto wallet, is the USB thumb drive 2FA inline retailers site trustworthy? will Google , Microsoft & apple Inc find it acceptable.

author: PlainName
author_rank: Super Contributor
timestamp: February 13, 2022, 12:37:26 am
content: QuoteNo kidding. I have to use a system where the password must be >12 characters, contain letters, numbers, caps (but fortunately no punctuation, yet), and can't be one that's been used before. And you get forced to change it every 4 weeks. Sometimes I want to cry.Meanwhile, if I log into Starling bank online it needs the app on my phone to say that's OK, so first I need to authenticate with that app (fingerprint), then it tells the website I am me and the website then shows a QR code which the app then uses the phone camera to verify, and then I am in. It's probably quite secure and, on the whole, preferable to having to stick a debit card into a card reader (neither of which I typically have with me when I want to do online banking).

author: Marco
author_rank: Super Contributor
timestamp: February 13, 2022, 12:51:07 am
content: Quote from: jonovid on February 12, 2022, 11:49:27 pmYubico has been around for 15 years, so you can trust them by reputation. Solokey is open source, so you can trust them by reading the code. Nothing is absolute, but you can pick your poison.

author: sleemanj
author_rank: Super Contributor
timestamp: February 13, 2022, 01:09:10 am
content: TOTP (Time-based One Time Password) is the mechanism by which most 2FA works.Plenty of existing libraries to do it in various languages -even an Arduino can do it. You need a reasonably accurate clock and to be able to do an sha1 hash and that's about the biggest complexity.For your "backup in case something goes wrong", you can print/save/screenshot the QR/text-based key, and just rescan that any time. Sites that use 2FA will also often have one-time-password lists you can generate to use for that purpose, or can email you a one-time-password.Also sites may not require you to use the 2FA all the time, typically only if they see you come from a system that they havn't seen before, like a new user agent, a browser that doesn't have their session cookie, an IP address in a different country, or whatever that makes their system want to be sure it's you.Don't get me wrong, I'm not a total fan of 2FA myself, strong unique passwords are good-enough for almost all purposes. But, for some things, you want just that bit extra and it's not actually that complicated.If you do at some point get a mobile phone, then the 2FAS app works well and has a backup function to your google drive.

author: Monkeh
author_rank: Super Contributor
timestamp: February 13, 2022, 01:21:27 am
content: Quote from: jonovid on February 12, 2022, 07:20:00 pmSpoken like somebody who has never had to deal with having accounts compromised.

author: Someone
author_rank: Super Contributor
timestamp: February 13, 2022, 03:08:33 am
content: Quote from: sleemanj on February 13, 2022, 01:09:10 amExcept, many of the services requiring 2FA actively (and intentionally) work against letting you bring your own solutions:https://github.com/abrasive/mygov-totp-enrollTrying to force you to use their app. Or they only offer TOPT in addition to/after verification by a mobile phone SMS.Quote from: Monkeh on February 13, 2022, 01:21:27 am2FA makes sense for things that are valuable/sensitive, but asking students to 2FA so they can access course material? at some point its just "security" because its little to no cost to the operator, ignoring the costs to the users.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 13, 2022, 07:40:48 am
content: TOTP or HOTP is pretty simple to use and implement, and available in many platforms as mentioned. The issue is there are always some private/secret material involved that has to be kept securely. That was distinguishing it from the hardware solutions like from RSA. Recent mobile devices have secure execution/storage ICs, so this problem is theoretically solved but still up to the developer to implement it correctly because the secure execution area is most of the time not directly open to developers. The industry is/was (I am not working on this topic anymore) moving in challenge-response/signature mechanisms rather than OTP. There FIDO enters the picture and it is I think the main implementation now.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 13, 2022, 07:43:45 am
content: Quote from: jonovid on February 12, 2022, 11:49:27 pmJust get one from a well known company like yubico, I am sure there are many others. Currently all should be based on FIDO, so a certification would be a good indication.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 13, 2022, 07:51:46 am
content: Quote from: Someone on February 13, 2022, 03:08:33 amI understand the point and you have right to some extent. However, it may not matter because on that site to download course material, there can be for example user data so the security of that site is also important. There might not be any sensitive data now, but there might possibly be in the future etc. It is not a bad practice. I 100% agree about the cost to the user. It was becoming quite not seamless in the past, now it is getting simpler (password managers, FIDO, biometrics etc), but there is still some obstacles.

author: alexanderbrevig
author_rank: Frequent Contributor
timestamp: February 13, 2022, 10:49:27 am
content: You should want it.The reason for enforcing rules and why most companies require 2FA is because people absolutely suck at passwords. So much so that the top five most common passwords should make you cringe.Even Trump reused an already absolutely crap password across multiple services. When one got leaked (maga2020!), his Twitter got hacked. This would be mitigated by good password hygiene (which is hard for people) or 2FA which is comparatively easy.

author: magic
author_rank: Super Contributor
timestamp: February 13, 2022, 11:22:29 am
content: And nothing has happened because Trump's twatter got pwnzored.Which is why you sholudn't care when it comes to stupid things.But it's 100% what Monkeh said: the companies themselves don't want do deal with the drama of user getting compromised, so they shove security down their throat.

author: Someone
author_rank: Super Contributor
timestamp: February 13, 2022, 11:26:15 am
content: Quote from: metebalci on February 13, 2022, 07:51:46 amAgree 100% on all you are saying, its a lot of lazy implementation that is the friction here. Extending the example of above, 2FA can easily be required for "higher" access within a system that has levels of sensitive information/control. Plenty of well thought out services already have this in place where you can do the cheap/easy login to go through everyday things but a challenge comes up when you do something unusual or with exposure commensurate to that. That sort of tiered security was in place well before 2FA became a thing, requiring the user to acknowledge/recognise the relative value of their access. Having a single level of login may cheapen the differentiation and will lead back to complacency by users.The OP is probably also put out by the security beingdictatedchosen for them by the service provider. Long gone are the days of setting up an anonymous/throwaway email address with a brand name provider. Many people would be fine with minimal security on their worthless accounts but layers of perceived unnecessary security is pushed as mandatory. Another example, I don't link payment details with webshop accounts for instance but someone who does have their platinum card linked to their account may well want 2FA at some point in that chain (some credit cards are now mandating that).

author: magic
author_rank: Super Contributor
timestamp: February 13, 2022, 11:31:12 am
content: GMail isn't the only "brand name provider".Last time I checked, Microsoft still allowed signups without phone numbers and bullshit like that. You did have to do some captcha thing.

author: madires
author_rank: Super Contributor
timestamp: February 13, 2022, 12:38:14 pm
content: In case you go for a FIDO token get two, one for daily use and the second one as backup token. Register both with each 2FA account. The problem is that you can't copy/backup/restore those tokens. If you have just one and it breaks or you lose it, you will have a lot of fun recovering access to your accounts. Most services support having multiple tokens, but the odd one might only allow a single token. BTW, hardware tokens usually provide higher security than apps on your mobile phone.

author: Marco
author_rank: Super Contributor
timestamp: February 13, 2022, 01:21:17 pm
content: It's a shame FIDO is explicitly designed to prevent cloning, even by the user.I'd really prefer a paper backup of the private key.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 13, 2022, 02:07:40 pm
content: Quote from: sleemanj on February 13, 2022, 01:09:10 amI'd set up google-authenticator in PAM on the raspberry pie. Suddenly one day it didn't accept my TOTP. I had of course forgot to set up ntp on the raspberry that lacks an internal hardware clock and the clock had drifted. But, I waited for half a minute (for the next round of codes) and now it accepted the old code. With ntp it works without problems.

author: tooki
author_rank: Super Contributor
timestamp: February 13, 2022, 02:37:41 pm
content: Quote from: jonovid on February 12, 2022, 07:20:00 pmThe stupid in this post is so strong it hurts.You clearly haven’t put even two seconds of thought or research into what the consequences of a personal security breach can be.The fact that we’re moving everything to 2FA isn’t a show of “paranoia”, but rather a fully justified condemnation of 1FA.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 13, 2022, 03:07:40 pm
content: Quote from: tooki on February 13, 2022, 02:37:41 pmTrue. Users and security experts have demanded of the "big ones" for years to implement 2FA. Part in hope to get rid of utter useless password rules and crappy "security" questions about mother's maiden names etc. In those places where they still have these useless security questions, my mother's maiden name is typically "QJfBG$$NB7Z3MeKd#pNM7f@Tb" or similar.

author: madires
author_rank: Super Contributor
timestamp: February 13, 2022, 03:14:29 pm
content: Not everything! But important services should employ 2FA, e.g. home banking and your main email account (-> password recovery). 2FA isn't anything new, I'm using it for 20+ years.

author: PlainName
author_rank: Super Contributor
timestamp: February 13, 2022, 04:07:18 pm
content: Would you want to do 2FA to get onto EEVBlog?

author: tooki
author_rank: Super Contributor
timestamp: February 13, 2022, 06:37:19 pm
content: Eevblog isn’t the keys to the castle that email accounts, Google logins, and Apple IDs are. It can’t be used to gain access to other sites/services/devices.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 13, 2022, 07:32:29 pm
content: Quote from: dunkemhigh on February 13, 2022, 04:07:18 pmI would have no issue with entering a TOTP code the first time and when changing password, or changing browser/computer and similar situations. But it is true that forums like this don't necessary need that level of security. 2FA or TOTP isn't the answer to everything. However, we still have a big fundamental problem when some people use the same password on eevblog as on other sites. I can't know this, but I'm fairly certain.

author: Someone
author_rank: Super Contributor
timestamp: February 13, 2022, 08:16:56 pm
content: Quote from: magic on February 13, 2022, 11:31:12 amJust checked and it looks like Microsoft backed out their 2FA mandate on outlook/skype for new users, noting that: a) these things have been geolocked and vary country to country, and b) have popped up from time to time as a retroactive requirement (holding accounts "hostage").

author: mansaxel
author_rank: Super Contributor
timestamp: February 13, 2022, 09:11:16 pm
content: Quote from: jukk on February 13, 2022, 07:32:29 pmThis is a very important observation. People are very bad at remembering passwords that are good enough. So once they get one they like, they use it over and over again. And the more important the purpose is, the more likely it is that an old and bad one will be used. Because it is important that it not be forgotten...The first counter-action is password change policies. That does not work; because people will adapt by changing "password01" to "password02".The second counter-action is "fhAHUo98ee0nUU9pmDPV/n8rMxxKj0l"; complicated password policies. That, in itself, just makes the original situation worse. And, "correct battery horse staple".The successful solution must be a hybrid, with multi-factor authentication an important part, because it raises the cost of a compromise to levels only interesting for spear-phishing operations. Trawling, which is what most of us are caught up in, will be completely blocked by multi-factor and a modicum of street smartness.For all those things where MFA is not an option, an unique password isrequired. And since you now will have several hundred accounts (I just counted mine to 220) you need a password manager. And, since you need a password manager, a random password generator is now a sensible thing. Because you can forget the passwords, and therefore make them complex enough to be very expensive to crack.I use "pass" and a small shell script to make passwords -- the one above was made by this.Code:#!/bin/bash## 20 to 40-char password.#case `uname` in"Linux")line=`shuf -i 1-90 -n 1`len=`shuf -i 20-40 -n 1`;;"Darwin")line=`jot -r 1 1 90`len=`jot -r 1 20 40`;;"FreeBSD")line=`jot -r 1 1 90`len=`jot -r 1 20 40`;;esacdd if=/dev/urandom bs=1024 count=2 2>/dev/null|\base64 |\tr -cd '[[:alnum:]].-/_,=' |\fold -w ${len} -b |\sed -n -e "${line}p"## EOF#

author: PlainName
author_rank: Super Contributor
timestamp: February 13, 2022, 09:25:47 pm
content: QuoteI think most people can remember a pretty decent password. The problem is remembering a zillion of the blighters, which leads to repeat use. The stupid passwords, I would bet, are from having to think one up on the spot under pressure to just get the damn registration completed and move on to something useful. Ultimately, it's the same issue as you describe, though.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 13, 2022, 10:34:12 pm
content: So what happened/happens basically is from remembering one or two pins/passwords which was enough in the past (and they might also be protected by another factor as well e.g. banking cards), we moved to a (online world) situation that required us to remember many and complex passwords which is impossible (and also it was impossible to carry another factor for each of them separately), that led to current state of using password managers with integrated or separate 2FA apps doing that job and securing password managers with the other two (something you have + you are) factors. When a system is in place, there is no additional burden neither on site owner nor on user to use this, so it doesnt matter much if a site with less/zero sensitive data e.g. eevblog forum needs 2FA or not. It might even be more troublesome to not use the mainstream methods.

author: Cerebus
author_rank: Super Contributor
timestamp: February 13, 2022, 10:54:00 pm
content: Quote from: tooki on February 13, 2022, 06:37:19 pmIt could cause reputational damage though. If some people's accounts were hacked, the time they have put into building their reputation could be ruined by correct spelling, accurate punctuation, or evidence of cogent thinking.

author: mansaxel
author_rank: Super Contributor
timestamp: February 14, 2022, 03:52:36 am
content: Quote from: dunkemhigh on February 13, 2022, 09:25:47 pmYes. What I do is that I make no effort at even trying to learn the password I set for another site which wants an account. I sometimes make an email address specifically for that site (easy if you are running your own domain) and then autogenerate a password which I stuff into my password repository, and go on. In the loop with verification et c this usually takes minimal extra time.Also, and this is important: Where there are those stupid "personal questions" I strongly suggest people do something like this:Mothers maiden name:qQmnJpQDhA7grA6XMxOE10qqYIkauAQxHFirst pet:Vhg8stsKNa1zHZPVHzf5IfboLPFavourite teacher:mNbMIMOKZTREIhxRBsentZVWNdrKZ1D/9LUIWCAnd, of course keep those well stashed away.Further:If you don't think you can trust a computer with your passwords, thatlittle black book which was bought to keep your poems incan be repurposed. Small black books are very resilient to online low-cost attack, providing they're kept under watchful lock and key. And most of the attacks are made under the assumption that they mustn't cost much at all. Very few of us are being targeted personally.If you can't count on being able to cut 'n paste strings (one of the known limitations of small black books), perhaps using a method like the one made into programherecan be useful. Of course I'd never let a web service generate a password that I'm intent on using (much like my strings above should not be copied verbatim and used!) but instead have my own computer perform the composition. If you can't do that, a set of dice and a book will do. It is imperative that you must remove yourself from the password selection, and let reasonably good randomness work. Dice are OK, if handled well.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 14, 2022, 06:37:24 am
content: Quote from: mansaxel on February 14, 2022, 03:52:36 amI wonder why you dont trust an online pass generator ? I used hotbits for a long time before I start using a password manager which generates on its own.Not sure but I guess it is not that important how you generate a password as long as it is resistant to dictionary attacks and reasonable brute force. The password is not a key, so its entropy does not need to be a certain value, but of course it is easy to generate one like a key, so why not.

author: ejeffrey
author_rank: Super Contributor
timestamp: February 14, 2022, 07:59:27 am
content: Quote from: dunkemhigh on February 13, 2022, 04:07:18 pmI certainly wouldn't object as long as it was implemented well-- multiple security tokens plus recovery codes allowed, working with standard tokens that can be used with multiple services, and only prompting for second factor monthly or on a new sign on. I've been using yubikeys for everything that supports it for 7-8 years, and it's just not a big deal.Poorly implemented 2FA can be annoying but in the same way that crazy password rotation policies are annoying. The fault is with the administrator or whatever misguided standards they have to conform to.

author: magic
author_rank: Super Contributor
timestamp: February 14, 2022, 09:22:28 am
content: Quote from: tooki on February 13, 2022, 02:37:41 pmNo, the real stupid are those who would suffer serious consequences of some shitty web service or their account at a shitty web service getting compromised (read: most of the population these days). IMVHO it's them who clearly haven't put even two seconds of thought into what the consequences of a personal security breach could beIt's all about the old joke:noob's password: Suzy, cause no one could guess his girlfriend's namelamer's password: OHECU*&*(SH34, cause no one could guess this onehacker's password: Suzy, cause script kiddies with dictionaries are not the real danger

author: magic
author_rank: Super Contributor
timestamp: February 14, 2022, 09:25:18 am
content: Quote from: Marco on February 13, 2022, 01:21:17 pmIt's the whole point of those things, though.The attitude is: the user is an untrustworthy idiot guaranteed to fall for a phishing scam. With enough users, it even becomes a solid fact.

author: mansaxel
author_rank: Super Contributor
timestamp: February 14, 2022, 10:20:42 am
content: Quote from: metebalci on February 14, 2022, 06:37:24 amThe risk analysis matrix becomes a lot bigger if you have to extend trust (however small) to the people who clean the room where the computer that hosts the logs from the password generation service lives.Ideally, one should do private key generation on a permanently offline system, and only export data on read-only media, preferably smart cards, which then are used as intended (not only as carriers, but using the compute on-card to sign data using the private key). Since doing that is a major ass-ache, I have settled for using a local random generator on my frequently patched computer, and then storing the passwords encrypted on local disk. I believe this is a trade-off that is reasonable in my situation.

author: richard.cs
author_rank: Super Contributor
timestamp: February 14, 2022, 11:40:43 am
content: Quote from: dunkemhigh on February 13, 2022, 12:37:26 amI had one a few weeks ago where it had some perverse combination of password requirements anddidn't tell you what they were. It would also drop you back a couple of pages if it didn't like your password. It took me 10 minutes to construct a password it would eat, and I still have only a vague idea what the requirements actually are (something along the lines of 3 each of lowercase, uppercase, numbers and symbols, plus a minimum of around 16 characters and some rules around repeated-characters).

author: JohanH
author_rank: Frequent Contributor
timestamp: February 14, 2022, 12:13:20 pm
content: The updated NIST guidelines are going in a sensible direction, with recommendation on reducing complexity, allowing for unicode characters and elimination of expiration:https://stealthbits.com/blog/nist-password-guidelines/(random blog that explains changes in NIST guidelines).Now it will take a couple of decades for companies to follow recommendations. Some seem to be stuck in the 90's. And HARD. With head in the sand.

author: madires
author_rank: Super Contributor
timestamp: February 14, 2022, 02:31:12 pm
content: Quote from: mansaxel on February 13, 2022, 09:11:16 pmI recommend to use an offline pasword manager. They also include a password generator. Just choose the length and the characters types. Very simple and effective. Most password managers support some sort of login automation - also very handy. And don't forget to backup the database and to place a cleartext copy in the safe.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 14, 2022, 02:59:36 pm
content: Quote from: madires on February 14, 2022, 02:31:12 pmI used Keepass variants for many years (on different devices and operating systems). I even used a terminal variant on linux. Now I'm a bit lazy and have moved my private passwords to Bitwarden. It is open source and you can run your own instance. Only stupidity, it doesn't support storing a full PGP private key (have to cut it in half due to size).For 2FA application I use AndOTP. Important is that it supports backup and export of codes, so that you can restore TOTP codes if your device fails.

author: tooki
author_rank: Super Contributor
timestamp: February 14, 2022, 04:31:35 pm
content: Quote from: magic on February 14, 2022, 09:22:28 amSo just forgo all the utility of modern services. Email? Gone. Online storage and backup? Gone. Sync between devices? Gone.And with that, no more applying for jobs online, signing up for government services, or any other of the myriad things that one is now expected to do online, often with no alternative method.Yeah, totally practicable.Besides, the whole point of “forcing” 2FA onto users is precisely because almost no users consider the security ramifications because they aren’t security experts. We cannot expect most people to be computer experts. It’s the experts’ duty to design systems that are inherently secure.

author: PlainName
author_rank: Super Contributor
timestamp: February 14, 2022, 04:45:26 pm
content: But, countering that, security that gets in the way can be worse than poor security because users will try to subvert it.2FA is fine, but it relies on a hardware key that I probably won't have with me sometimes. Like the aforementioned card reader that banks used, all it did was make me use a different bank instead because then I wouldn't have to walk around collecting card and reader before even thinking about logging in just to make a quick check.Now it's assumed everyone has a phone, it's always with them, and it's always the same phone (or, at least, the same number). That's not actually always the case, and as with any other hardware key, if you lose it you're in for a world of hurt.I don't know the solution, but going for max security because you can isn't it.

author: ejeffrey
author_rank: Super Contributor
timestamp: February 14, 2022, 06:34:57 pm
content: Quote from: mansaxel on February 14, 2022, 03:52:36 amYou can go to all of this effort and yet be considerably less secure in the real world that someone who uses a yubikey and their password is their pets name followed by 123. You are also probably less secure than someone who uses a phone app based TOTP with a weak, reused password.I use a password manager to generate strong unique passwords with a securely stored and encrypted database. I recommend the same to anyone who is interested. But 2FA provides much better security for less end-user burden. Again, I strongly recommend yubikey or similar hardware tokens if possible. Once set up they are extremely convenient as well as extremely secure, but failing that a TOTP phone app is pretty good. The main problem with TOTP is that it can be phished just like a password. At least the code is time limited and most implementations require a second code to change your authentication information but hardware tokens eliminate this problem. A lesser problem with TOTP for high security applications is that it is cloneable, but this does have the advantage of making offline backups easier.

author: mansaxel
author_rank: Super Contributor
timestamp: February 14, 2022, 07:06:10 pm
content: Quote from: ejeffrey on February 14, 2022, 06:34:57 pmYes, fully agree, but until everything will do token login properly this is what we need to do. In addition to tokens where they work.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 14, 2022, 08:05:13 pm
content: Quote from: ejeffrey on February 14, 2022, 06:34:57 pmNew phones have similar security hardware as hardware tokens, so eliminating the need for using hardware tokens for many use cases. Also the services are moving from user generated OTP to server triggered probably signature based mechanisms which eliminates the issue with phishing or man in the middle.

author: magic
author_rank: Super Contributor
timestamp: February 14, 2022, 08:08:03 pm
content: Quote from: tooki on February 14, 2022, 04:31:35 pmI have email. Still works without 2FA and admittedly the password isn't Suzy, I know, I'm lame. I try to minimize my exposure to pwnage by being sure to have other means of communication with important people or institutions and of course keeping a local archive of all mail. It would suck to lose the address, but I would rather have that minimal risk than be forcibly locked out without a fucking phone at hand. I'm not a target to anyone who genuinely cares to justify such level of paranoia.I use one service which does use the 2FAD and it's the bank. Arguably a good idea, but because of some stupid EUSSR directive it no longer works with one time passwords sent by snail mail, but requires the fucking phone. Lotta fun if that PoS breaks.Government services? Fun that you ask. Some moron in Poland routinely uses my e-mail address to sign up to various services that don't require e-mail confirmation to start usingand one of them is indeed a government body. I'm still wondering if/how/when to pwn him for maximum lulz

author: metebalci
author_rank: Frequent Contributor
timestamp: February 14, 2022, 08:16:06 pm
content: Quote from: dunkemhigh on February 14, 2022, 04:45:26 pmI always argued that the phone number/SMS OTP is not a proper 2FA. The phone number does not fully belong to you. Mobile operator can connect your number to another SIM without you realizing, there happened fraud cases because of this when SMS OTP started to be used by banks 10+ years ago. It is not a big issue anymore but I still think there is a difference and I prefer to not use it if there is an alternative.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 14, 2022, 08:29:23 pm
content: Quote from: dunkemhigh on February 14, 2022, 04:45:26 pmMost services assume you have a 2FA application of some sort. Some still offer SMS and email as the second factor. In most of the cases, they also offer TOTP that works with any TOTP application. This isn't tied to a phone (but is most commonly used on a phone app), it could be a separate PC (your desktop or a raspberry works fine) or hardware key. If you backup the TOTP keys (encrypted of course), you will not lose anything.

author: Someone
author_rank: Super Contributor
timestamp: February 14, 2022, 09:17:58 pm
content: Quote from: dunkemhigh on February 14, 2022, 04:45:26 pm... the subscriber account is paid up, and they have mobile network coverage.

author: Halcyon
author_rank: Unknown
timestamp: February 14, 2022, 09:35:09 pm
content: Quote from: dunkemhigh on February 13, 2022, 04:07:18 pmMany users are already doing it. It's not such a bad thing.

author: ve7xen
author_rank: Super Contributor
timestamp: February 14, 2022, 09:46:57 pm
content: Quote from: metebalci on February 14, 2022, 08:16:06 pmIt bothers me quite a bit. 'SIM swapping' means this generally just degrades to 'what's your mother's maiden name' type security that the phone company uses to 'secure' your account with them. If even that, since the phone reps tend to be too lazy to bother verifying this. The only difference is that it requires a bit of targeted effort by the attacker, but for high enough value targets, it's totally worth it. And there's plenty of evidence of this actually happening in the real world, it's not like it's a theoretical attack.When it's available it's also *very often* the only method offered. Which is just absurd. It's more costly and more difficult to implement the much less secure SMS-based OTP than standard TOTP, so it just makes no sense at all why at the very least services don't offer both. Especially when it's something high security, like the Canada Revenue Agency that recently started requiring '2FA' but only offer it via SMS. Same with one of my credit cards. It's infuriating because not only is it less secure, it's *much* less convenient.Likewise anyone that tries to force you to use their own authenticator app is. We have standards for this for a reason. The standards mean the friction is lower for users, so they are more likely to use it / use it correctly. Looking at you Steam, I have no reason to have your mobile app installed.As far as forcing it on users, I think it's perfectly reasonable for anything that confers an identity or has economic consequence. It should have come earlier.For real-world identity-tied things like taxes and bank accounts, I am a strong proponent of government-issued key material. We've had the technology for decades, but AFAIK only one country (Estonia) has ever issued such an identity document which is just absurd to me.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 14, 2022, 10:26:21 pm
content: Quote from: ve7xen on February 14, 2022, 09:46:57 pmNaturally this is not easy to do in practice. The cases I know involves identity theft, which is I guess a bigger problem then stealing the phone number. But still I think theoretically it is wrong to assume hardware based (eg TOTP) and SMS based OTP is same.Quote from: ve7xen on February 14, 2022, 09:46:57 pmI think the implementation complexity depends. I tend to think SMS based solution is simpler considering everything. Because the devices change and TOTP or any security tokens are not always migrated to new devices, whereas the phone number does not change, this is a big plus for operations for SMS based solutions.Quote from: ve7xen on February 14, 2022, 09:46:57 pmI think it is converging to standards but it is hard for regulated domains eg financial institutions to quickly adapt.Quote from: ve7xen on February 14, 2022, 09:46:57 pmDont know the worldwide status but there are actually countries other than Estonia providing certificates equivalent to real identity through SIM or card etc. based solutions that can be used for things like accessing bank or e-government services or contract signing so effectively replacing the wet signature.

author: ve7xen
author_rank: Super Contributor
timestamp: February 14, 2022, 10:37:50 pm
content: Quote from: metebalci on February 14, 2022, 10:26:21 pmIt probably varies quite a bit on regional regulations, competence of the phone provider, and the like. But at least in my own non-malicious dealings with the phone company, it seems like it'd be pretty trivial if you know some basic information about the legitimate owner, they barely do anything that could be called 'identity verification' at all. And if you fail you can just call back and try again with a different rep. Eventually you're likely to be successful. There are more than enough anecdotes to demonstrate that it's not good enough.QuoteThere are pros and cons for support considerations and whatnot, but this isn't what I meant by implementation. If you want to do SMS-based OTP, you need to interact with a 3rd-party service to deliver those SMS messages, but all the rest is basically the same, you need to generate key material, produce OTPs and so on just like you would with TOTP. Since there's a 3rd-party integration involved though, I'm considering it more complicated. But I guess you could argue that having to produce your own UI to manage TOTP and recovery codes and the like swings the balance.QuoteI'll give them the benefit of the doubt if they've had a 2FA implementation in place for a long time and it happens to have been based on SMS. Many of these are things that have come online recently though. CRA added their requirement last tax-year. The credit card I complained about added their SMS verification to online transactions and their web app in 2020. The TOTP RFC is more than a decade old at this point, it's not really an acceptable excuse, especially when the SMS way is incredibly weak.Quote from: ve7xen on February 14, 2022, 09:46:57 pmGlad to hear it!

author: mansaxel
author_rank: Super Contributor
timestamp: February 14, 2022, 11:48:25 pm
content: Quote from: ve7xen on February 14, 2022, 09:46:57 pmWith the caveat that it is a separate government-approved entity that issues the ID, I just today used one of my electronic ID's to fetch and store a Covid-19 vaccination certificate from the government agency who deal with this.Increasingly, we can use electronic identification to access services; most government systems require it. I must use it to access my children's school systems, when I file my taxes (which for most people is about as complicated as logging in and saying, "Yes, it's correct" because the tax forms come pre-printed with all collected data here. Unless I've sold stock I can do the same most years.), when I book an appointment for vaccination, and when I log in to pay my bills. Of course online gambling uses it for age checks, and in many online shops showing ID lets them populate shipping address et c and also check if they can invoice you or you need to pay upfront.Quite convenient. But of course could be even better.

author: metebalci
author_rank: Frequent Contributor
timestamp: February 15, 2022, 06:55:12 am
content: Quote from: ve7xen on February 14, 2022, 10:37:50 pmThat is right, you need to use a service provider for sending SMS. This was more difficult in the past but now there are non-operator providers, Twilio etc., which makes the integration (both technical and non-technical) simpler. Sometimes the mobile operators have a different service to be used by banks for OTPs due to security, availability and performance concerns, this may make it a bit more complicated.The key material issue is not the same for both. With SMS OTP, you can just randomly generate a code, keep it and its timestamp in the database, and then check when the user enters it. With TOTP, there is a need to share a symmetric key material because TOTP is generated with a HMAC algorithm, so both generator/user and verifier/service needs to know the secret. Sharing the secret can be as simple as generating/entering some numbers/codes, a QR code, or an online key exchange algorithm. When there is a key material, that has to be kept securely, for example banks may want to use HSM. The same is true for the client side implementation, the key material has to be kept on the device (phone) securely, so the imlementation is not as simple as just keeping any data (however it became simpler in recent years).A service/bank etc. probably already have some SMS service provider integration, so it is pretty simple for them the code this. It probably takes more time to create user documentation for it. TOTP or any such implementation (FIDO etc.) is more complicated, because some things provided by the SIM card and GSM network has to be replicated. Potentially an HSM is involved. Because this is considerable more complex than SMS OTP, the security review will probably take also a longer time.I might be a bit biased, I started worked on these when TOTP/HOTP specs. were still drafts and OTP/2FA was not mainstream, and worked until TOTP/HOTP (there is also OCRA for signing) became mainstream and FIDO appeared. Now, I guess everybody knows more about these, so the implementatin process might be more seamless than I think.

author: PlainName
author_rank: Super Contributor
timestamp: February 15, 2022, 12:42:38 pm
content: One thing highlighted by its absence in this TOTP discussion is that to use it the end user needs to be running either a special product-specific app or generaic authenticator. Not so hot if they are PC users, and the support for user errors is likely to be greater than zero. OTOH, SMS just works and you don't need an iPhone or Android or anything special - a simple decade-old dumb phone will work. Further, the end user isn't in a race to read and type before the pretty short timeout (sods law says they will start with 15 seconds to go).Won't anyone think of thechiuser?

author: metebalci
author_rank: Frequent Contributor
timestamp: February 15, 2022, 01:35:16 pm
content: Quote from: dunkemhigh on February 15, 2022, 12:42:38 pmVery correct, that is another reason why SMS OTP is offered either as alternative or as a fallback method even if there are other mechanisms.About the timeout, SMS OTP also have or must have a timeout. You might have heard there was an Android issue, a trojan was forwarding the SMS OTPs in the background. A timeout eliminates offline man in the middle attacks. The issue is if standard SMS gateways are used to send SMS the time it takes for SMS to reach to the end user cannot be guaranteed I think or it cannot be guaranteed to a low value. That is why some operators offer low latency gateways particularly for this purpose so 60 seconds timeout can still work.

author: mac.6
author_rank: Regular Contributor
timestamp: February 15, 2022, 01:47:21 pm
content: SMS OTP is not secure *at all*SIM theft/hijacking is a thing that is awfully simple and happens everyday:https://arstechnica.com/information-technology/2022/02/police-in-spain-dismantle-a-sim-swapping-ring-that-drained-bank-accounts/

author: metebalci
author_rank: Frequent Contributor
timestamp: February 15, 2022, 01:54:47 pm
content: Quote from: mac.6 on February 15, 2022, 01:47:21 pmWow I didnt know it is still an issue. I remember after this happened (in Turkey, 10+ years ago) they changed the processes and there was a lock period, so you can easily figure out something is going on with your number before bad things happen. On the other hand, if identity theft is involved, this is a much bigger problem.

author: madires
author_rank: Super Contributor
timestamp: February 15, 2022, 02:15:00 pm
content: Quote from: ve7xen on February 14, 2022, 09:46:57 pmThe German ID card offers an eID function for several years now. Before 2017 is was an option, after that it's activated by default.

author: madires
author_rank: Super Contributor
timestamp: February 15, 2022, 02:27:22 pm
content: Quote from: mac.6 on February 15, 2022, 01:47:21 pmIt's not just SIM swapping. There are also many security issues in the SS7 protocol/networks allowing rogue parties to hijack or redirect SMS'. Or some home banking trojan runs on your smart phone.

author: PlainName
author_rank: Super Contributor
timestamp: February 15, 2022, 03:34:38 pm
content: Quote from: madires on February 15, 2022, 02:27:22 pmIt's better than the alternative of not using it, if you won't or can't rely on passwords alone. The big problem with things like SMS is that they aretreatedas infallible, which is one reason why hijacks and similar work so often. Same with biometrics - computer says it's their fingerprint therefore it must be them without question.

author: PlainName
author_rank: Super Contributor
timestamp: February 15, 2022, 03:42:08 pm
content: Sorry, posted before I'd collected my complete thoughtsWhat's happening here, with SMS and the like, is that they are not perfect, and are therefore deemed to be abhorrent to use. The same is said of security by obscurity wherever that crops up. Sure, it's not perfect but by, for instance, moving your POP3 port to 2371 to hide it you disappear off the radar of a lot of opportunistic hacks. SMS isn't perfect, but by using it you've stiffed the opportunistic hacks where a password has been compromised. Taking it further - obtaining the duplicate SIM (or scanning every port) - is extra work that many, many bad guys aren't going to bother with.So, SMS isn't perfect, but it strikes a balance between being wide open and having the user jump through flaming hoops. For many applications, that's fine.

author: Marco
author_rank: Super Contributor
timestamp: February 15, 2022, 03:45:46 pm
content: It's not good enough for crypto gambling/tax evasion at any rate.

author: ejeffrey
author_rank: Super Contributor
timestamp: February 15, 2022, 04:46:07 pm
content: Quote from: dunkemhigh on February 15, 2022, 12:42:38 pmIn my opinion SMS is still OK to support is a method of last resort in low security scenarios. It still prevents against most brute force attacks even if SMS is relatively insecure. It's not perfect but nearly universal and people understand how to use it pretty easily. I just don't think it should be the default.Also, with 2G mostly shut down and 3G scheduled for turn down over the next few years in much of the world the list of phones that can receive SMS but don't have an authenticator app is low, and for sure far less than the reverse: mobile devices able to run a TOTP app but without a cellular connection or with a data-only connection.

author: ve7xen
author_rank: Super Contributor
timestamp: February 15, 2022, 07:42:37 pm
content: Quote from: metebalci on February 15, 2022, 06:55:12 amYeah, I realized I'd overlooked this a while after I posted, but didn't think it was worth an edit. You're coming at this from clearly a different side of the equation than me, but in my experience, any time you have to involve a 3rd party service, the complexity balloons substantially. Things I can keep entirely in-house are easier to manage, easier to (continually) test, and easier to rely on, but that might not be the equation for everyone. I imagine that's especially true if you can 'outsource' most of the certification work and liability.QuoteI'm definitely not a fan of product-specific authenticators. For one, it's annoying. For two, it's a security-critical purpose, and I don't trust random lowest-bid app developers working in a completely different domain to do it properly. NIH is a real problem with security-critical code.Maybe I'm just one of the kids these days, but I think the number of people who have ditched their phone number entirely is higher than the number of people that don't own a device that can run a TOTP authenticator, which is practically any general purpose computing device made in the last 20 years. This forced SMS authentication is one of the things holding us back from ditching our phone service, to be honest. I don't use it for much of anything else.In general though, I think both can be a bit of an accessibility problem, but it is much worse with SMS. Not everyone can afford to maintain consistent access to a cell phone plan, and losing your phone number shouldn't be made such a pain in the ass, e.g. if you move. Tying authentication to a third-party for-pay service really just stinks to me, it's so user-hostile. Even the homeless these days often have access to a device that they use with WiFi etc, it's much more ubiquitous and reasonable to expect that someone own a device that is now quite cheap than pay for a monthly service. Hell, FIDO keys are simple and cheap enough to manufacture that you can practically give them away.

author: PlainName
author_rank: Super Contributor
timestamp: February 15, 2022, 09:43:03 pm
content: QuoteWhich misses the user perspective that they are yet another thing you have to carry around with you and lose. Something on a phone works because everyone has a phone now (at least, those that don't are rare) and typically everyone has their phone with them. Phones score well because the shite cameras in them are better than the really good camera you left at home because you didn't want to carry it around 'just in case'. While keys remain a separate item, and particularly when they are a niche item, they're going to remain least desired method of authenticating.

author: ve7xen
author_rank: Super Contributor
timestamp: February 15, 2022, 09:55:50 pm
content: Quote from: dunkemhigh on February 15, 2022, 09:43:03 pmI was talking specifically about the accessibility issues around assuming everyone has a phone with active (and continuous, or you will lose the number the account is tied to) service. SMS 2FA is getting forced on us for 'critical' things, and it does not address the accessibility issues at all. Yes, it's not ideal to have something else to carry around, and I agree it may not make sense if you own a suitable device, I'm specifically talking about those who don't, and the possibility of support organizations providing them cheap FIDO keys as an alternative to a smartphone. It's much better than expecting them to go to a bank branch or government service centre to have any access to the services at all.Edit: Not to mention the problems that arise if you're outside of cellular service range (particularly if that's your home location) and need to do an auth check. Sometimes if you're very lucky, a POTS fallback is offered, but it's usually to the same number, so it works (sorta) for people who only have a landline, but is useless if you're out of service. Oh and many of these services block 'VoIP' numbers, though like geolocating IPs, detecting that is horribly unreliable since MNP (my main number is an ex-VoIP number that was ported and is now attached to my cellular service - and I've run into this issue with both Steam and Uber). SMS 2FA / tying accounts to mobile service in general is just a horrible solution.

author: Cerebus
author_rank: Super Contributor
timestamp: February 15, 2022, 10:13:02 pm
content: Quote from: dunkemhigh on February 15, 2022, 09:43:03 pmYou do realise that these literally fit onto a keyring don't you? I don't know about you but if I'm out of the house then my keyring is in my pocket complete with the authentication and authorisation tokens for my house and car (mechanical keys) which I'm already obligated to carry and keep track of. Adding another key to the ring hardly increases the burden of responsibility much. Whereas I often deliberately don't always take my phone out with me.

author: Someone
author_rank: Super Contributor
timestamp: February 16, 2022, 12:15:13 am
content: Quote from: dunkemhigh on February 15, 2022, 09:43:03 pmAs the above posters mention, its great that you would prefer something else, and it should be an option to you. Just as not having SMS should be an option to others.Thinking here of people complaining all building have ramps as access, when they would prefer stairs.

author: PlainName
author_rank: Super Contributor
timestamp: February 16, 2022, 01:36:05 am
content: QuoteYes. Doesn't change my PoV.

author: PlainName
author_rank: Super Contributor
timestamp: February 16, 2022, 01:38:56 am
content: QuoteIndeed. I note that Google are quite good about this, giving a choice of authenticator, SMS or selecting one of nine secret numbers.

author: David Hess
author_rank: Super Contributor
timestamp: February 16, 2022, 08:27:38 am
content: Quote from: tszaboo on February 12, 2022, 07:47:54 pmSafer from what, and for who?2FA using a phone protects against a stolen password, and adds an exploit when your phone is compromised. I cannot do anything about my phone being compromised because that is up to the phone company, but I can protect my password.

author: ve7xen
author_rank: Super Contributor
timestamp: February 16, 2022, 06:10:47 pm
content: Quote from: David Hess on February 16, 2022, 08:27:38 amWhat? No, it's called 'two (or multi)-factor authentication' for a reason. You need both to authenticate, so if you protect your password but your phone is compromised, you have the same level of security you do today. If your phone is not compromised, then you have considerably more. Just don't store your password in a text file on your phone.