There was a chap on here the other day who said they hate 2fa and don’t need it because they use passwords that are 50 characters and generated by the password manager.
This is a perfect example of why you should always activate it when possible.
Alot of people don’t like Microsoft, but they’re pushing for zero password authentication for a reason. Passwords are getting really insecure really fast.
This vulnerability has nothing to do with password strength or security and everything to do with password reset security, i.e. email and improper handling of parameters to that reset API call.
Passkeys are interesting and potentially quite strong but they’re going to have to fall back to the same old reset mechanism if you e.g. drop your passkey device (phone) into a lake.
Yeah, good luck with that. You can tell someone “if you lose this token, all data are unrecoverable”, they’ll reply with “ok, got it!” and about two and a half second later call you saying “Hey I lost my token can you recover my data?”.
I just use their Authenticator app out of convenience, I get a notification when I login through it and it asks me to input the correct number given by the app, a 2 digit number.
I don’t know about windows specifically, but for outlook they’re pushing their authenticator app (you can use any) and SMS or email one time links. I think it works really well, and almost all attempts to access my account have stopped tbh, they can’t phish for my password if I don’t have a password.
I see a lot of people around me resetting passwords of services they rarely use because they forgot what password they used and don’t have a password manager (or not synced one). And I don’t understand why all services don’t propose to generate a one time link to log in instead of changing passwords (a few services do propose it already)
Passwords are useless for all users using the same password for every account they have, and i’m sure it’s a majority of users.
The idea with passkeys though is that it’s like a dongle, not just your phone number. It’s not an SMS code or link, it uses the cryptography hardware of your phone to authenticate. But the question of “what happens if I lose my phone” still persists.
“5 ways to hack 2FA” is pretty click-baity though. All of those attacks are either not exclusively related to 2FA or could target another component. If you can just bypass security altogether, instead of questioning 2FA, you should consider ditching that service/site.
All except point 1, that is. But everyone should know by now that 2FA by SMS is insecure.
One of the biggest issues with 2fa is that normally it’s either an easily spoofable phone/email or an app locked to a device.
This is why I use a password manager (pass) that is synced across all of my devices (via a private self hosted git for version control) that I can send 2fa QR codes to cameraless devices via screenshots using zbarimg and have every device capable of 2fa verification with the pass-otp extension.
I know this setup is a bit complicated as just dealing with git or importing a gpg key would give most people I know sense of existential dread. I am curious to see what others use for similar functionality.
I’m just using my password manager in place of the authenticator app.
So rather than using an app like Google authenticator or Authy to see what the new random sequence is for the MFA, my password manager stores that QR as a string and will display the same random sequence that a normal MFA app would.
They key difference is that my MFA is synced across any device that I have configured my password manager on using the same cryptographic keys and version control history.
So if my phone is dead, lost, or stolen, I can still access my banking account via MFA as normal.
I suppose it brings up the idea of what a “factor” is in how it’s used for MFA. If a factor is supposed to be a different device, a different app on the same device as your password manager, or just a different passphrase that’s constantly changing.
I see. IIRC from school, “factor” actually has a definition - it’s either something you have (keycard, phone), something you are (biometrics) or something you know (password).
For authentication to be truly an effective MFA, it would have to require at least two of those factors. And that’s also why I.e email isn’t really a MFA.
So, I guess it boils down to where are you storing your passwords. If they are also in the password manager, then, its only 1FA, because knowing your password manager password is enough to defeat it. (Or, if someone finds a zeroday in the pass manager).
It’s still two separate passwords so I think it qualifies as 2 factors.
But yes the password manager has one gpg key which only has one passphrase used to decrypt the passwords saved in the password manager. So if that was compromised then so would all passwords
There was a chap on here the other day who said they hate 2fa and don’t need it because they use passwords that are 50 characters and generated by the password manager.
This is a perfect example of why you should always activate it when possible.
Alot of people don’t like Microsoft, but they’re pushing for zero password authentication for a reason. Passwords are getting really insecure really fast.
This vulnerability has nothing to do with password strength or security and everything to do with password reset security, i.e. email and improper handling of parameters to that reset API call.
Passkeys are interesting and potentially quite strong but they’re going to have to fall back to the same old reset mechanism if you e.g. drop your passkey device (phone) into a lake.
Or just make it clear your account is gone if you lose your passkey, so have a second key for backup or learn a hard lesson.
Yeah, good luck with that. You can tell someone “if you lose this token, all data are unrecoverable”, they’ll reply with “ok, got it!” and about two and a half second later call you saying “Hey I lost my token can you recover my data?”.
Have they given up on their “Passwords are insecure, use this 4 digit pin instead” push?
I just use their Authenticator app out of convenience, I get a notification when I login through it and it asks me to input the correct number given by the app, a 2 digit number.
How does Microsoft’s implementation work?
Is it possible to log into windows without a Microsoft account using that method?
I don’t know about windows specifically, but for outlook they’re pushing their authenticator app (you can use any) and SMS or email one time links. I think it works really well, and almost all attempts to access my account have stopped tbh, they can’t phish for my password if I don’t have a password.
Yeah this is being standardized at the mobile hardware level now with
https://fidoalliance.org/passkeys/
https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/
That reverse-code thing is super annoying. The next vector is through the shitty app itself.
I see a lot of people around me resetting passwords of services they rarely use because they forgot what password they used and don’t have a password manager (or not synced one). And I don’t understand why all services don’t propose to generate a one time link to log in instead of changing passwords (a few services do propose it already)
Passwords are useless for all users using the same password for every account they have, and i’m sure it’s a majority of users.
Google is moving that way with passkeys. I think it’ll catch on with many people.
Just cut the passwords out and go straight to unlocking with a device.
That said not sure what happens if you lose your device.
don’t even have to lose the device
phone is the most common, plenty of ways in from mitm attacks (insecure wifi for example) to social eng the account phone provider
guess you could go the dongle route but if it was super common thieves would just target them
I think the question is less about getting hacked and more about getting permanently locked out of your account.
sure but it shouldn’t be, any good process will have some recovery method
course that can be a vulnerability as well
thank god recovery questions are dead
The idea with passkeys though is that it’s like a dongle, not just your phone number. It’s not an SMS code or link, it uses the cryptography hardware of your phone to authenticate. But the question of “what happens if I lose my phone” still persists.
https://fidoalliance.org/passkeys/
https://developer.apple.com/passkeys/
https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/amp/
I mean it’s just 2fa without the password so same issues with what I described
https://www.csoonline.com/article/570795/how-to-hack-2fa.html
just the first result on google
“5 ways to hack 2FA” is pretty click-baity though. All of those attacks are either not exclusively related to 2FA or could target another component. If you can just bypass security altogether, instead of questioning 2FA, you should consider ditching that service/site.
All except point 1, that is. But everyone should know by now that 2FA by SMS is insecure.
How do you secure email accounts then? And wouldn’t that make those just even more attractive targets?
I don’t have 2FA for my GitLab account since it’s only accesible via my GitHub account which has 2FA. Is this good or should I add 2FA to GitLab also?
If you have to use your GitHub 2fa to sign in that’s fine I would assume.
Okay, thanks!
One of the biggest issues with 2fa is that normally it’s either an easily spoofable phone/email or an app locked to a device.
This is why I use a password manager (pass) that is synced across all of my devices (via a private self hosted git for version control) that I can send 2fa QR codes to cameraless devices via screenshots using zbarimg and have every device capable of 2fa verification with the pass-otp extension.
I know this setup is a bit complicated as just dealing with git or importing a gpg key would give most people I know sense of existential dread. I am curious to see what others use for similar functionality.
Is that second factor, though? If I understand it right, you are basically generating your MFA from your password manager, is that so?
I’m just using my password manager in place of the authenticator app.
So rather than using an app like Google authenticator or Authy to see what the new random sequence is for the MFA, my password manager stores that QR as a string and will display the same random sequence that a normal MFA app would.
They key difference is that my MFA is synced across any device that I have configured my password manager on using the same cryptographic keys and version control history.
So if my phone is dead, lost, or stolen, I can still access my banking account via MFA as normal.
I suppose it brings up the idea of what a “factor” is in how it’s used for MFA. If a factor is supposed to be a different device, a different app on the same device as your password manager, or just a different passphrase that’s constantly changing.
I see. IIRC from school, “factor” actually has a definition - it’s either something you have (keycard, phone), something you are (biometrics) or something you know (password).
For authentication to be truly an effective MFA, it would have to require at least two of those factors. And that’s also why I.e email isn’t really a MFA.
So, I guess it boils down to where are you storing your passwords. If they are also in the password manager, then, its only 1FA, because knowing your password manager password is enough to defeat it. (Or, if someone finds a zeroday in the pass manager).
It’s still two separate passwords so I think it qualifies as 2 factors.
But yes the password manager has one gpg key which only has one passphrase used to decrypt the passwords saved in the password manager. So if that was compromised then so would all passwords