Two factor authentication with phone, is it secure enough? - Page 1
Forum section: electronics / general

author: Zucca
author_rank: Unknown
timestamp: March 10, 2023, 01:31:53 am
content: ....of course nothing is secure enough, and it is just another layer of security.Browser software nowadays offers quite often a feature to save username and password for website logins.I never trusted the above for critical stuff, but I now realize that all my critical logins require a two factor authentication with my phone.Since saving the login data in a browser is a terrible idea on a security point of view, it is sooo practical on the other hand...I am wondering if since I have the two factor authentication active I could safely let FireFox to store and keep my critical logins data...What do you think?

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 01:59:30 am
content: How do you menage passwords now? If it is a small set of passwords for all sites, then this is pretty much worse of all options.Use a real password manager with audited code and implementation. My personal preference is Bitwarden, but there are others. And whatever you do, do not use LastPass.Browser password store is not the best option. Plus it is least portable one.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 10, 2023, 02:07:38 am
content: It's better to use your browser's password manager, and define a different, strong password for each different website/service you use, than to not use its password manager, and since it becomes less convenient, use fewer different passwords. Hands down.Now there are also dedicated password managers, they are more secure than your browser's one until some horrific security hole is found in them. Which will invariably happen sooner or later.Of course two-factor authentication mitigates the problem for critical services.As to copying your stored passwords, it's usually just a matter of copying the corresponding database in your profile, the exact location depends on your browser and OS. It's not rocket science and I've done that successfully before. Of course, synchronizing password lists this way is not practical, so to be used preferably in a single-way fashion.With all that said, I'm not advocating any particular approach here. Just giving a couple thoughts.

author: dobsonr741
author_rank: Frequent Contributor
timestamp: March 10, 2023, 02:08:47 am
content: Well said. Bitwarden, 1Password, to name a few. These password wallets can act as the multi factor authentication token too, super convenient. Use a sufficiently strong password on these wallets. And put proper locking on your phone, in addition.

author: Zucca
author_rank: Unknown
timestamp: March 10, 2023, 04:23:49 am
content: Quote from: ataradov on March 10, 2023, 01:59:30 amA horrible excel file with different password, different username and different email for each website.Everytime I need to open that file it makes me sick, it has become huge and ugly.Bitwarden looks sexy, I will do my homework.

author: golden_labels
author_rank: Super Contributor
timestamp: March 10, 2023, 04:26:38 am
content: “Secure enough” is a meaningless phrase without specifying the threat model.I do not see, how passphrases being managed by the browser is a security concern. Quite opposite: the browser verifies you are actually filling an authentication form from the right domain.(1)That greatly increases difficulty of phishing attacks, but is not being done in any other realistic scenario.2FA is an example of applying the defence in depth principle, which by definition increases security. But it also increases burden. It is up to you to decide, what level of balance between security and comfort you want to choose. No other person can make that decision for you.(1)External password managers may have a similar feature. But it is implemented as an add-on, which brings us back to the same point: the browser.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: March 10, 2023, 04:30:26 am
content: Many websites and applications are moving away from passwords and using Fido instead, which is significantly stronger, using asymmetric keys, the private key for the application being managed by the device keystore and never leaving the device (unlike passwords).

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 04:31:40 am
content: One way password managers are better than native browser store is that browser will happily export the passwords in the clear while password managers would ask for the master password.So, if threat model includes physical access to the PC, then browser store is not secure at all. Still better than a spreadsheet.

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 04:33:30 am
content: Quote from: DrGeoff on March 10, 2023, 04:30:26 amWhich makes is a nightmare to manage if you want to access the service from multiple devices. Also, I have not seen any of those in practice, so I don't know how "many" there actually are.Plus now that Apple embraced it, in a typical Apple way, I expect them to screw it up somehow.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: March 10, 2023, 04:37:50 am
content: Quote from: ataradov on March 10, 2023, 04:33:30 amThere are many. Bigger ones from Google and most Social Media systems along with Apple.The device problem is addressed in multiple ways.

author: IanB
author_rank: Super Contributor
timestamp: March 10, 2023, 04:39:01 am
content: Quote from: ataradov on March 10, 2023, 04:31:40 amHow so? Which browser store will export (or reveal) passwords without first asking you to enter the master password?

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 04:42:06 am
content: Quote from: IanB on March 10, 2023, 04:39:01 amBoth Firefox and Chrome will do this.You may need to be logged in into your account, but do you really log out all the time?I use Firefox as a secondary browser and I don't have any accounts setup, and it lets you export the passwords, there is not even a master password to enter. I don't want to log out of chrome to check.

author: Zucca
author_rank: Unknown
timestamp: March 10, 2023, 04:42:47 am
content: https://bitwarden.com/blog/host-your-own-open-source-password-manager/well the above feature is very important to me. Privacy is also important.

author: IanB
author_rank: Super Contributor
timestamp: March 10, 2023, 05:33:15 am
content: Quote from: ataradov on March 10, 2023, 04:42:06 amNot Chrome in my experience. Even when logged in there is no way to reveal passwords without secondary verification.

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 05:39:10 am
content: Quote from: IanB on March 10, 2023, 05:33:15 amI just added a saved password and in the autofill settings there is an eye icon next to each password that shows it. And close to it there is an export option that just saves all of them in a file. All of this without being asked for any additional verification .Although this articlehttps://www.alphr.com/view-google-chrome-saved-passwords/suggests that it should ask for the OS (?) password. I'm using official Chrome on Linux and see nothing like that.

author: RoGeorge
author_rank: Super Contributor
timestamp: March 10, 2023, 06:04:22 am
content: I have a text file with websites, usernames and partial passwords.By partial passwords I mean only write down hint letters, hints that only I know what group of letters or words they have to be replace with, so to form the password. That equivalence between pass hints and their corresponding chars is not noted down anywhere, I just know them by heart.About two factor authentication, it's horrible, because it makes you dependent of a second device (what you do if your phone goes belly up?), and because it automatically disclose your identity (your phone number is also your global UUID).I was once auto-enrolled by the bank into some shitty second authentication for online payments, and as a result I was unable to make payments with a debit card because of no phone battery. To make it even more ridiculous, the outside payments (i.e. Aliexpress) were accepted without SMS confirmation, only the EU payments were needing a second pass by phone SMS. I had to walk to the bank to be unsubscribe from such crap.In my eyes, dual authentication is nothing but surveillance, extra data harvesting, and constant nagging if you log from another device.Same with passwords complexity: the only times when I've lost an account it was because of a site database leak, not because of brute forcing my password that didn't had enough numbers and special chars.Two factor authentication never ever blocked a hack attempt, in my experience. Never. It only blocked me from using my own accounts. Many times. The stupidest thing ever.

author: IanB
author_rank: Super Contributor
timestamp: March 10, 2023, 06:05:48 am
content: Quote from: ataradov on March 10, 2023, 05:39:10 amThat's odd. You are supposed to be asked for either your Google account password or your OS account password. I don't use Linux so I can't account for that. Is it possible you are using some kind of reduced security settings?

author: 5U4GB
author_rank: Super Contributor
timestamp: March 10, 2023, 06:09:12 am
content: Quote from: DrGeoff on March 10, 2023, 04:30:26 amThe problem with these mechanisms, stuff like OAuth being the poster child, is that it's almost impossible to use correctly on the server side, it's so bad that the author of the OAuth spec actually resigned from the editor position rather than be further associated with it. So with randomly-chosen per-site passwords, as several people have pointed out, you're about as safe as you can make yourself. With single-point-of-failure systems like OAuth and others you're only safe as any site you use or your auth provider is. If they get popped its game over for you and everyone else using them.In terms of phone-based 2FA, the OP needs to specify which 2FA they're talking about, is it SMS or a 2FA app using (typically) TOTP? Those are pretty good, I'd recommend looking at Authy for that and then use it for any critical account where money can change hands.

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 06:12:23 am
content: Quote from: RoGeorge on March 10, 2023, 06:04:22 amAll 2FA comes with a set of recovery codes. You use one of the codes.Quote from: RoGeorge on March 10, 2023, 06:04:22 amSMS 2FA is worse than no 2FA.Quote from: RoGeorge on March 10, 2023, 06:04:22 amIt may not be for you, but 2FA for sure stops a lot of account takeover attempts for people that are targeted in attacks.

author: 5U4GB
author_rank: Super Contributor
timestamp: March 10, 2023, 06:12:49 am
content: Quote from: RoGeorge on March 10, 2023, 06:04:22 amNot with a 2FA app that does TOTP, which is what a great many sites and probably all the ones you care about use. It's effectively just a challenge/response calculator based on a seed value (your password) that you provide, so you can set it up on a new device with only a password. In terms of good-enough 2FA it's probably the best option out there, it's entirely under your control (no centralised single point of failure) and portable across devices.

author: 5U4GB
author_rank: Super Contributor
timestamp: March 10, 2023, 06:14:02 am
content: Quote from: ataradov on March 10, 2023, 06:12:23 am[Citation needed]

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 06:14:09 am
content: Quote from: IanB on March 10, 2023, 06:05:48 amNo idea, but I don't really care, I'm very happy with my password manager.It is good if this asks the password from the people that actually use it. Although it is still weaker than the password manager security where your key actually encrypts the stored data.

author: ataradov
author_rank: Super Contributor
timestamp: March 10, 2023, 06:15:33 am
content: Quote from: 5U4GB on March 10, 2023, 06:14:02 amPersonal opinion + all the SIM swapping attacks + it is usually setup by incompetent idiots (banks mostly at this point), so recovery is hard or impossible.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: March 10, 2023, 06:28:45 am
content: Quote from: 5U4GB on March 10, 2023, 06:09:12 amIt's not OAuth. The reason it was created was partly because of problems with OAuth.Webauthn is built into all modern browsers and Fido is well documented and has been in use for several years now. It's very transparent which is why you probably don't think you've seen it.I'd suggest reading up on it a bit more. It avoids PKI because of the inherent problems with PKI and the constant renewal of expiring credentials.

author: JohanH
author_rank: Frequent Contributor
timestamp: March 10, 2023, 08:40:56 am
content: I'm using the following.Bitwarden with passwords synced to all devices. Bitwarden passwords can also be exported if you want to migrate to another format. You could also set up your own Bitwarden server, if you don't trust the provided one.AndOTP app as 2-factor (TOTP) on the phone. 2-factor list is exported in encrypted format to my own cloud storage, so easy to restore to a new phone.There is 500+ entries in Bitwarden, but only 30+ 2FA sites. More sites should offer 2FA. The most important sites do provide 2FA (TOTP).

author: RoGeorge
author_rank: Super Contributor
timestamp: March 10, 2023, 09:25:45 am
content: Quote from: JohanH on March 10, 2023, 08:40:56 amAgree, more sites should offer 2FA, butas an option only.What buggers me it's the trend to make 2FA mandatory.That's why, for example I give up using github. There are other similar git websites that do not enforce 2FA. For me, 99% of my online accounts are disposable, including the github one. Why would I bother with 2FA on any of these.All these mandatory 2FA websites are all acting like an account there would be the ultimate goal in life, worth protecting it at all costs. I'm so sick and tired of unsolicited protection.With time, unsolicited help always turns into some sort of exploitation from the "benevolent helper" side, even when the initial help was not planned as an exploitation. Talking here about any kind of unsolicited help, this is not about computers only.

author: Marco
author_rank: Super Contributor
timestamp: March 10, 2023, 09:34:34 am
content: Passkeys are the future, shame about the ecosystem lock in.From the user point of view it's pretty much the same as a password manager with random string passwords, except the site can request presence or biometric authentication and passwords are handled with PKI as they should be.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: March 10, 2023, 09:48:47 am
content: Quote from: Marco on March 10, 2023, 09:34:34 amIt's not PKI. It's asymmetric keys. PKI involves certificates and chains of trust.With an asymmetric key pair the private key never leaves the device, as is the case with an HSM or smart cards.

author: Marco
author_rank: Super Contributor
timestamp: March 10, 2023, 09:58:32 am
content: Quote from: DrGeoff on March 10, 2023, 09:48:47 amThat's the difference between traditional U2F and Passkeys, the latter do leave the device. Your iPhone can have the exact same passkey as your Macbook, also Apple can maintain a cloud backup of your passkeys which can be downloaded to a new device.The usage model for traditional U2F is far too unfriendly for normal users, having to register multiple authentication devices for a single website is bunk. Cross device syncing (or less politically correct, cloning) and cloud backup are a necessity for mainstream adoption.

author: 5U4GB
author_rank: Super Contributor
timestamp: March 10, 2023, 10:05:52 am
content: Quote from: DrGeoff on March 10, 2023, 06:28:45 amAfter ploughing through other SSO stuff in the past like OpenID, OAuth, SAML, Shibboleth, BrowserID, and others, all of which ended up being horribly failure-prone, I just lumped Fido in as yet another one (because it looks and sounds a lot like the others did) and didn't have the energy to search out the necessary third-party analysis on whether it can be used safely or not. It could well be perfectly OK, it's just part of a large collection of similar attempts that ended up being awfully failure-prone once deployed, which is why I'm still sceptical about it.And yes, that could be an unfair assessment, it just comes from a long line of protocols with a very poor track record, sort of like buying yet another 18650 off Aliexpress and hoping that this time it'll finally have the stated capacity :-). In any case I'll have a longer look at it when I get time.

author: golden_labels
author_rank: Super Contributor
timestamp: March 10, 2023, 12:24:08 pm
content: Quote from: ataradov on March 10, 2023, 06:15:33 amIf you compared SMS 2FA to some other authentication method, it would at least be debatable. But you are making a statement that no security is better than security that has some small chance of failing.(1)Huh?I am not sure, what is the goal of mentioning poor implementation. I don’t disagree with accuracy of your observation: I just do not see, what it supports. Hard recovery is not weakening the security.(1)SIM swaps are slow and expensive. They never were and it doesn’t seem they ever could be applicable to anybody but high-value targets. The hole is also absurdly trivial to patch.

author: JohanH
author_rank: Frequent Contributor
timestamp: March 10, 2023, 01:02:18 pm
content: It's commonly agreed upon that SMS 2FA is better than no 2FA at all, even though TOTP also in my opinion is better.

author: Zucca
author_rank: Unknown
timestamp: March 10, 2023, 02:45:08 pm
content: Quote from: RoGeorge on March 10, 2023, 06:04:22 amNot only it saved my ass once, but I was happy to see the scammer was very pissed off because my psw in his hands was useless.That said the implementation is horrible sometimes.

author: alm
author_rank: Super Contributor
timestamp: March 10, 2023, 03:35:01 pm
content: Quote from: RoGeorge on March 10, 2023, 09:25:45 amMany password managers offer TOTP secret storage and token generation. Obviously this is a step down compared to storing the secret on a different device, but it could be a solution for those mandatory 2FA sites that you don't care about.With TOTP no personal information, like phone numbers, has to be exchanged either, although some sites insist on having a phone number as "backup".

author: golden_labels
author_rank: Super Contributor
timestamp: March 10, 2023, 03:35:32 pm
content: Quote from: RoGeorge on March 10, 2023, 06:04:22 amStrong words, considering that:You do not know, that your private, personal experience has no value as an argument here. These are low-probability events and they are not even uniformly distributed across population.You do not realize, that the information you see is asymmetrical: you almost always know about failures, but virtually never about successes. The disproportion is enormous. Which makes the experience itself false.Your fail to observethe Sagan standard.(1)Practices you described earlier show negligence regarding security.(1)There is a debate on how much improvement 2FA brings. Including positions on possibly better options, inadequacy or relative weakness of some specific 2FA mechanisms (e.g. the SMS mention above), abandoning password-based authentication altogether, and what is the right balance. But yours is not among them.

author: RoGeorge
author_rank: Super Contributor
timestamp: March 10, 2023, 04:14:49 pm
content: You missed the "in my experience" part. Do as many security measures as you wish, but do not make themmandatory. Not everybody cherishes the same an online account. If you need strong security, that's fine from my side, use those measures for your accounts.Do not enforceyoursecurity needs onmyaccount. That's my rant about.

author: Zucca
author_rank: Unknown
timestamp: March 10, 2023, 04:24:13 pm
content: Forcing users is never good. Agreed.

author: alm
author_rank: Super Contributor
timestamp: March 10, 2023, 04:36:42 pm
content: Most people will not voluntarily choose to put in extra work for more security. If average Jane/Joe could log in by just typing in their name, they would. So expect all the big platforms to force their users to be more secure and move away from this failed idea called password authentication. If this doesn't work for you, you might have to move to more niche or self-hosted services.

author: madires
author_rank: Super Contributor
timestamp: March 10, 2023, 05:20:04 pm
content: Quote from: golden_labels on March 10, 2023, 12:24:08 pmPoorly secured SS7 provides a much more professional way to redirect SMS.

author: golden_labels
author_rank: Super Contributor
timestamp: March 10, 2023, 05:51:43 pm
content: Quote from: RoGeorge on March 10, 2023, 04:14:49 pmI made a comment on exactly that and only that part, so I am pretty sure I did not miss it.Quote from: RoGeorge on March 10, 2023, 04:14:49 pmI commented on the argument against 2FA, not about your preferences.The rest is also not as straighforward to simply say “leave it to me”, but I didn’t even touch it and not willing to.

author: Zucca
author_rank: Unknown
timestamp: March 10, 2023, 07:34:44 pm
content: Quote from: alm on March 10, 2023, 04:36:42 pmTrue but why now set up a big red warning to let them know what are the consequences. I mean better to be transparent than bossy.

author: RoGeorge
author_rank: Super Contributor
timestamp: March 11, 2023, 05:49:47 am
content: 2FA, posted in another thread, today:Quote from: lexibeamin on March 10, 2023, 10:23:28 pm

author: Zucca
author_rank: Unknown
timestamp: March 13, 2023, 01:49:38 pm
content: I am wondering how well the access to that tablet was protected...It looks like he build a impenetrable fortress on quick sands.

author: madires
author_rank: Super Contributor
timestamp: March 13, 2023, 04:47:14 pm
content: Usually 2FA apps are protected by a password or biometric authentication.

author: alm
author_rank: Super Contributor
timestamp: March 13, 2023, 06:57:23 pm
content: Quote from: RoGeorge on March 11, 2023, 05:49:47 amThis anecdote proves as much about the effect of multi-factor authentication on security as an article about a car crash with a fatal outcome proves about the effect of seat belts on safety.

author: Halcyon
author_rank: Unknown
timestamp: March 13, 2023, 11:28:26 pm
content: I would never save credentials in a browser. They are extraordinarily easy to extract.Use a reputable password manager (I prefer Bitwarden) with a browser plug-in/application for your phone.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 14, 2023, 03:02:26 am
content: I have KeePass, anyone else using it?

author: Black Phoenix
author_rank: Super Contributor
timestamp: March 14, 2023, 04:25:00 am
content: Quote from: SiliconWizard on March 14, 2023, 03:02:26 amI use Keepass as my password manager since 2014...3 databases copies, one on my at the system with me at the moment, another on the NAS at home and a offsite one.Then when any change is made they are merged and updated.

author: JohanH
author_rank: Frequent Contributor
timestamp: March 14, 2023, 02:16:22 pm
content: Quote from: SiliconWizard on March 14, 2023, 03:02:26 amI used Keepass in the past, also command line version. DB in cloud for easy replication. But at one point there were problems that some platforms moved to 2.x format and some stayed on 1.x. So I got lazy and then moved to Bitwarden. It's also available for virtually all platforms.

author: Zucca
author_rank: Unknown
timestamp: March 15, 2023, 04:03:01 am
content: Many thanks!I am done with the homework!For now here my idea1) Bitwarden Premium2) 2 SFA in Bitwarden with authenticator App Yubico on my phone (not in my PC)3) Yubico app on my phone with NFC activation4) Yubikey 5 NFC attached on my necklace5) Phone unlock with fingerprintThe idea is to use the NFC Yubikey only to unlock the Bitwarden vault... so I should tap my phone on my chest only at the beginning and I do not have to take my Yubikey out from my necklace and plug into my PC.Until... I setup a local server in my garage and run Bitwarden locally at home, which could be a bummer if internet at home is down and I am out.....

author: JohanH
author_rank: Frequent Contributor
timestamp: March 15, 2023, 07:04:14 am
content: Quote from: Zucca on March 15, 2023, 04:03:01 amIt stores a copy locally, so opening the vault will work. You can't just synchronize changes.

author: golden_labels
author_rank: Super Contributor
timestamp: March 15, 2023, 08:00:08 am
content: Quote from: Zucca on March 15, 2023, 04:03:01 am6) Driving a tank with a week of water supply and a toilet: to prevent rubber-hose cryptoanalysis.I am not saying your idea is invalid or unnecessary.I do not know your situation and threat model. But remember that overengineering is as bad to security as negligence or ignorance.Security is a balance between many factors. Convenience is one of them. Security measures that are too burdersome are not only pain in the ass, butdecreasesecurity. A brain naturally seeks ways to reduce effort and in the end circumvents the security. This is like having 3 doors and 20 locks to your apartment: in the critical moment you will have only one lock closed and it will be one, which is weaker than what you would have if you only started with one door with 2 strong locks.(1)Again, I want to stress: I do not say your idea is bad! But it has 5 factors involved in protecting the target resource, which sounds much. So just re-evaluate, if it will not end up with your brain trying hard to avoid going through that path each time you need to authenticate. And I tell you, your brain is much clever than you are, and has a master degree in deception.(1)Nerds feeling an urge to educate me on physical security and adequacy of locks: this is a picture drawn to explain a different subject and whatever one thinks about locks is irrelevant.

author: JohanH
author_rank: Frequent Contributor
timestamp: March 15, 2023, 08:52:04 am
content: Ars Technica has a new article that at a first glance looks like they are bashing 2FA TOTP:https://arstechnica.com/information-technology/2023/03/software-for-sale-is-fueling-a-torrent-of-phishing-attacks-that-bypass-mfa/I.e. TOTP bad --> don't useRight?No, what they are saying that even with 2FA based on TOTP, you can be hacked by this particular man-in-the-middle hack, if you are tricked to use the web page and input your 2FA code. In this case it wouldn't matter if you used 2FA SMS or no 2FA at all.That doesn't mean using TOTP is worse. But if you don't know how to interpret the article it could sound like that. The opposite is true. Using only a password is worse in most situations, except this one.Conclusion is that there is currently no other solution to prevent this particular hack except FIDO2 solutions. I would look into Yubico devices, but they are still expensive for personal use.

author: Zucca
author_rank: Unknown
timestamp: March 15, 2023, 01:11:48 pm
content: Quote from: JohanH on March 15, 2023, 07:04:14 amI need to do more research on this, I didn't yet since it is a future project.Even if I VPN in my local network I can't sync the changes?Or did I not understand your statement?

author: Zucca
author_rank: Unknown
timestamp: March 15, 2023, 01:14:31 pm
content: Quote from: JohanH on March 15, 2023, 08:52:04 amThis, anyway I spent 50USD for my Yubikey with FIDO2 support, it does not break the bank.

author: Zucca
author_rank: Unknown
timestamp: March 15, 2023, 01:18:47 pm
content: Quote from: golden_labels on March 15, 2023, 08:00:08 amI will try my idea out and report back.To me it is the best compromise between the extra work/actions needed to get into the data and the security level achieved.In other words, 5 or 8 security levels are not a big difference to me if I all I have to do is just 2 clicks and 1 tap with my phone to my chest to get 4 numbers once a day.

author: JohanH
author_rank: Frequent Contributor
timestamp: March 15, 2023, 01:57:43 pm
content: Quote from: Zucca on March 15, 2023, 01:11:48 pmAs I've understood it, while being offline, the vault is read-only and you can't make changes. Whenever you become online (including VPN), you will be able to create new changes.

author: madires
author_rank: Super Contributor
timestamp: March 15, 2023, 02:29:23 pm
content: Quote from: Zucca on March 15, 2023, 01:14:31 pmHaving just one Yubikey is a SPOF as you can't backup/restore it. So you need at least two in case one breaks or vanishes into thin air.

author: madires
author_rank: Super Contributor
timestamp: March 15, 2023, 02:44:37 pm
content: Quote from: Zucca on March 15, 2023, 01:11:48 pmWith most password managers you can create you own 'cloud PW manager' by storing the database in a network folder, e.g. local server or some cloud storage. It's a bit more work than a native cloud PW manager, but you can change the PW manager or storage service at any time without much hassle (no service lock-in).

author: Zucca
author_rank: Unknown
timestamp: March 15, 2023, 03:04:37 pm
content: Quote from: madires on March 15, 2023, 02:29:23 pmOr you need to have the long number recover code provided at the SFA setup to pierce through the SFA in Bitwaden and deactivate it until the new Yubikey arrives.PS: This is why it will be on my necklace.

author: Zucca
author_rank: Unknown
timestamp: March 19, 2023, 02:17:59 am
content: Yubikey NFC 5 secured with a M3 screw in my walletHappy ending.Thanks everybody!

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 19, 2023, 08:38:57 pm
content: Speaking of that, what kind of security key would you guys recommend these days?Yubikey seems to be one of the top players currently. Always good to know alternatives too.One thing I've noticed - at least with Yubikey products - is that there is no model with both NFC and a fingerpring reader.I would like a security key with fingerprint, but I would like NFC as well.Of course I understand that NFC may not provide enough power to the key to power a fingerprint reader, so that's likely the main reason why it's not offered.

author: Marco
author_rank: Super Contributor
timestamp: March 19, 2023, 08:50:53 pm
content: I was looking around to see if there were any programmable Java Cards with a fingerprint sensor, with open API access to the fingerprint verification ... if it exists I can't find it. Smartcards with fingerprint sensor powered by NFC do exist, but it's all proprietary.I did see Feitian hasa pretty nice form factor FIDO2 key with fingerprint sensor and NFCthough. Not an endorsement of the quality, only thing I know about it is that it looks nice.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 19, 2023, 08:55:57 pm
content: Quote from: Marco on March 19, 2023, 08:50:53 pmAh, thanks. Looks good indeed.

author: artag
author_rank: Super Contributor
timestamp: March 19, 2023, 09:33:28 pm
content: https://ambiso.github.io/bitwarden-pin/

author: Zucca
author_rank: Unknown
timestamp: March 27, 2023, 03:40:15 am
content: Interesting, SFA and everything bypassed by a session token....

author: Halcyon
author_rank: Unknown
timestamp: March 27, 2023, 03:52:46 am
content: Quote from: Zucca on March 27, 2023, 03:40:15 amI think the more salient point here is that someone at LTT downloaded and executed malware on their machine, which enabled the threat actor exfiltrate data from the web browsers installed on that machine. It's basically like giving someone access to your physical machine if you have a password saved or a session open.This highlights four key issues:1. Whatever antivirus/EDR tool they are using (if any) was insufficient.2. There wasn't enough separation between their critical infrastructure (which includes their cloud services like YouTube) and files originating externally from untrusted sources.3. Staff training/awareness/knowledge was insufficient.4. Their Disaster Recovery/Incident Response plan was lacking or non-existent.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 27, 2023, 04:44:12 am
content: Session IDs are still a very serious security concern, and at this point are a ridiculously large hole. You can use 2FA all you want, if you have a session open that never expires by itself...I talked about it in another thread. Google accounts in that regard have a serious problem.Of course you would throw your Android phone away if it kept asking for your credentials. There's a conundrum to solve here.And regarding YT (or any Google account for that matter), being able to delete all videos or some account entirely without having to at least re-enter your credentials (these are some drastic actions that should warrant an extra step) is mind-boggingly stupid. Fortunately there are services that will re-ask for credentials even when you're logged in for issuing some types of actions. But not YT. Hats off.

author: madires
author_rank: Super Contributor
timestamp: March 27, 2023, 12:44:36 pm
content: As always, it's a tradeoff between security and convenience.

author: Zucca
author_rank: Unknown
timestamp: March 27, 2023, 01:50:34 pm
content: Quote from: Halcyon on March 27, 2023, 03:52:46 amWise wordsHalcyon! So if you have a malware running in background, there is nothing you can do?I imagine even FIDO2 or any other highest security concept/method is at risk with a malaware....I understand the data extraction from the infected PC, but how they sent the data out to them? I do not know.

author: Zucca
author_rank: Unknown
timestamp: March 27, 2023, 02:10:19 pm
content: Quote from: SiliconWizard on March 27, 2023, 04:44:12 amAmen, I browse always in incognito and delete all cookies and history at shutdown. I do not know if helps.

author: madires
author_rank: Super Contributor
timestamp: March 27, 2023, 03:40:15 pm
content: It depends on how the session management of the website is implemented and how often you delete cookies. A bad website would set an auth/session cookie which never expires after the first login. As long as the cookie isn't deleted it's used as magic key any time you visit the website again, i.e. you don't need to re-login. If the bad guy is able to hijack that cookie before you'll delete it then he can use it to access the website. The same can also happen for short-lived cookies (the bad guy needs to be quick enough). However, the attacker can't hijack what is not there.