Two-Factor Authentication Might Not Keep You Safe

https://www.nytimes.com/2019/01/27/opinion/2fa-cyberattacks-security.html

by pseudolus • 7 years ago

45 49 7 years ago

jchw4• 7 years ago

we actually know very little about how well two-factor authentication works

Actually we have known literally for years, maybe over a decade, that SMS-based two factor is insecure and prone to phishing... that's the point of TOTP/shared secret based two-factor auth...

CuriousCosmic• 7 years ago

I think the point of the article was to spook the non tech crowd into moving away from SMS based 2FA. Obviously the tech crowd has known for a long time but most other people are oblivious to all of this.

jchw4• 7 years ago

Really? They mention YubiKey but it seemed to me like they just lumped it in with less effective SMS 2FA.

sgustard• 7 years ago

Obviously the tech crowd has known for a long time

Who else but the "tech crowd" implements SMS 2FA on these websites? What does it say about our industry if we're pushing solutions we know to be flawed?

Phlarp4• 7 years ago

Is it not possible to capture both the login credentials and TOTP code from a phishing form and submit them to the real service in real time?

It would seem push notification style 2FA ala icloud/gmail/Duo/blizzard is the better solution but that also opens up a vector for users who simply accept every push notification request.

U2F would seem better than both those options but alas that can still be lost or stolen and compromised before access can be revoked.

m-p-3• 7 years ago

This is why having two tokens (one primary you carry with you and one backup kept in a secure location) is important.

altmind• 7 years ago

Not only SMS-based two-factor is susceptible to phishing, its also susceptible to intercept/forging by the rogue governments (RU) https://meduza.io/news/2016/04/29/mts-otklyuchil-oppozitsion... And very limited security in SS-7 makes it possible to hijack the messages even for the foreign phone numbers.

(Edit) Just to point our, here I talk not about possibility of sms interception - I'm talking about sms intercept that DID happen in 2016 and is widely publicised and have a lot of sources, including timeline of this event and comm with the mobile service provider(albeit, this info is mostly in russian)

panarky• 7 years ago

It's not just SMS that's vulnerable.

2fa apps like Authy are also at risk from fraudulent interstitial sites that capture your user ID, password and Authy code, authenticate with the legitimate site, and allow the fraudster to control your account.

Really the only secure 2fa is a hardware token.

hn_throwaway_992• 7 years ago

While hardware tokens are definitely more secure, there is a large difference between the security of SMS 2FA and TOTP code-based 2FA. SMS 2FA is fundamentally insecure because the SMS system can be hacked regardless of the security consciousness of the end user. On the other hand, while TOTP code-based 2FA is certainly subject to phishing, there are 100% effective ways that an end user can prevent this (like double checking the URL).

So while I do agree with you that hardware tokens are best, it's a mistake to lump SMS in with other forms of 2FA from a vulnerability perspective.

seppin• 7 years ago

Using a password manager defeats this as all the main ones will verify the url asking for the creds before sending them, defeating phishing.

yalogin• 7 years ago

How is the other method supposed to help? The secret is generated completely on the client dongle and so if phished the attacker is going to get the token needed for that time window. The attacker logs in and disables the 2FA.

tptacek2• 7 years ago

TOTP 2FA is also susceptible to phishing.

mbesto2• 7 years ago

Susceptible, but more limited.

I think an article should be written like this:

"There isn't a security measure that exists short of locking a computer in room with a keyless door and no external connection that is completely flawless to hacking, there are just varying degrees of computer security and 2FA happens to be safer than others".

Buge4• 7 years ago

TOTP is just as vulnerable to phishing as SMS.

If you want phishing protection, use U2F.

jchw4• 7 years ago

Yes that's true actually, it's U2F that actually fights phishing directly. I use TOTP integrated into my password manager, so it does partly fight phishing in that sense, since I can't accidentally enter it on the wrong domain.

Though it is still worth considering SMS insecure due to the many other pitfalls that aren't phishing, where TOTP fairs a bit better. Still, I wish more stuff supported U2F.

amanzi2• 7 years ago

Isn't TOTP also prone to phishing? If I can present a form to someone and trick them into entering their credentials, why not present a second form that also requests the TOTP code? That gives me a window of opportunity to log in as the user, or just script that part of it to happen automatically. Would that not work?

my_first_acct2• 7 years ago

The article mentions Yubikeys, but it doesn't mention that Yubikeys implement U2F.

The article reports that Google internally switched from TOTP, but doesn't report what Google switched to: U2F.

The article describes, in some detail, how TOTP and SMS two-factor authentication can be phished, but doesn't describe a two-factor authentication method that is quite a bit harder to phish: U2F.

There is a pattern here, and it is puzzling, to say the least.

EDIT: Changed "phish-proof" to a more realistic adjective.

Phlarp4• 7 years ago

Declaring U2F "phish-proof" seems premature at best. It is certainly much better than other existing options, but I wouldn't suspect it to stand up very long at all against a nation state adversary. Feels very much like "air-gapped networks can't be actively infiltrated" before Stuxnet.

my_first_acct2• 7 years ago

You are right, of course. I have corrected the parent comment.

viraptor2• 7 years ago

It's a shame they don't mention this only applies to some forms of 2fa. U2f / Fido does the verification both ways. It also authenticates that the url requesting the credentials is the expected one. As long as DNS+TLS did their job, you can't abuse it via a fake login site.

est31• 7 years ago

In general you are right about U2F, it's really much better than e.g. TOTP. But even U2F can be phished: https://www.wired.com/story/chrome-yubikey-phishing-webusb/

viraptor2• 7 years ago

I wouldn't say this is really a u2f problem. It's a "you mounted your secure lock with screws accessible from outside, so your lock security is irrelevant" situation.

Buge4• 7 years ago

The phrase "can be phished" seems inaccurate, because that Chrome vulnerability has been fixed.

https://bugs.chromium.org/p/chromium/issues/detail?id=818592

Buge4• 7 years ago

2FA by itself protects you against credential stuffing and other password reuse based attacks. It doesn't in general protect against phishing.

U2F protects against phishing.

ecesena• 7 years ago

This type of phishing is precisely the kind of threat that two-factor authentication is supposed to protect you against.

I've never seen an article so imprecise. 2FA protects against account takeover, not from phishing. In fact, most of 2FA mechanisms are affected by phishing, and that's why there are security keys with U2F and now FIDO2, that seem unknown to the writer. I'm surprised to see such a poor quality writeup from the NYT.

PakG1• 7 years ago

It's not factually correct, and off-topic, but why do I see so much hyperbole so often? Have you really never seen such an imprecise article? I believe I've seen plenty, and this one isn't the most imprecise one I've ever seen. I feel such hyperbole makes things seem worse than they are and then correspondingly ups the angst.

exabrial• 7 years ago

To be a broken record, SMS codes are not 2FA. They're readable by many people, they're not private, they don't have delivery guarantees; Can we please stop calling it that? Better yet, can companies stop promoting them?

amanzi2• 7 years ago

I think having SMS codes as a second factor is better than nothing at all. Changes the risk profile significantly. Anybody can try bruteforce your password, but a smaller group of people have the ability to intercept your SMS messages.

ian02• 7 years ago

Just because a password field in a web form is susceptible to various methods of attack doesn't mean its not a factor of authentication. And the same goes with SMS. It's still 2FA, just not absolutely secure/reliable.

Also there are lots of use cases where there just doesn't seem to be any more practical option for developers. For example, a second factor of authentication for financial transactions where the requestor only has a feature phone. Or the far more common scenario - where the practicality of rolling our hardware dongles, custom authentication applications is just too difficult/expensive.

3xblah• 7 years ago

I read that Facebook was using the PII disclosed for the purpose of so-called "2FA" for targeted advertising purposes.

https://gizmodo.com/facebook-is-giving-advertisers-access-to...

The paper from website of CS Prof. Alan Mislove:

https://mislove.org/publications/PII-PETS.pdf

Are HN readers concerned about having to disclose more and more PII to advertising companies in order to be "authenticated"?

Recently I heard someone being interveiwed on the radio who studies internet privacy and he was talking about this type of authentication. He was arguing it is problematic for privacy in that it requires the authenticating party to always have "one more" item of PII.

He suggested that the PII disclosure requirements would only keep esacalating and eroding privacy until the user has to "jump through her phone" to prove she is who she says.

I would provide a reference but I did not get his name. Maybe this sounds familiar to someone? Who knows, maybe he reads HN.

ian02• 7 years ago

Lots of hate for SMS as 2FA here. By no means perfect but does anyone know of a viable alternative? Genuinely curious as this is a problem we have hit deploying financial services applications for predominantly underbanked / non tech savvy users.

So, an authentication method that:

- Is without dedicated hardware, as hardware is expensive, difficult to distribute and if it's a USB there is no guarantee that a user has a laptop.

- That functions on feature phones (yes, they are still out there), or at the least phones without biometrics, as most don't.

- That doesn't require the user to do anything extremely complex, as ironically this is the part where a lot of fraud occurs.

Eg During a mobile banking rollout, customers were asked to register their phone number at an ATM. However many customers of the bank weren't familiar with ATMs (they banked at branches) and the people they requested help from linked their own phones and stole their cash.

kerng• 7 years ago

Reminds of KoiPhish relay proxy: https://github.com/wunderwuzzi23/KoiPhish There is also another one called Medlischka I believe.

FIDO and U2FA is addressing this, but it needs browser support. And Google Chrome had some bad bugs in their WebUSB implementation that allowed any site to read keys - not sure if all those issues are addressed by now.

known• 7 years ago

Reminds me of short comings in Captcha

galaxyLogic• 7 years ago

Wouldn't the solution be browser telling you the fake site looks like Bank of America but the IP or URL is incorrect

Two-Factor Authentication Might Not Keep You Safe

Related Stories