I HATE TWO FACTOR AUTHENTICATION

(Pic unrelated, I don't have many images saved so it was the most relevant one I could find.) I HATE 2FA SO MUCH IT'S UNREAL Every time I want to log in to my university's system, which uses Microsoft accounts, they send a code to my phone and then I have to type the code into the Microsoft authenticator app and then I have to type my phone password into the app so I can finally log in. Why is this even necessary? Why do I have to give my bloody phone number to log in to something on my computer? Why is this bullshit being inflicted on reasonable people to protect retards who don't set secure passwords? Too bad if some "password123" halfwit gets their account hacked, that's their fuarrrking problem. Online accounts should only require username + password and an email address. LEAVE MY PHONE ALONE

HR or IT gets to check off the "2FA, we did an infosec" box without having to implement and (and regularly audit) their own. Microsoft gets to lock people further into their ecosystem, and very likely gets to link your personal device telemetry to your work telemetry and sell the bonus data. Only person that loses is you. (I got locked out of my job's documentation for weeks because my phone was stolen, wouldn't have gotten a new one otherwise. I agree it fuarrrking is like kicking dead whales down the beach).

>>75218 Exactly THIS. Plus the funniest part of the story: The most often used second factor is SMS. The only people not reading your SMS is the people who don't want to. It's built upon a 1970's technology that is comfortably crackable by average people for nearly 3 decades now. It is the least secure protocol i can think of, maybe the second least secure after writing 4 number pin codes on a paper airplane and trying to throw it to the recipient. So it is totally useless as a 2FA. The useful technology, key hashing based tokens existed in the late 80's at least, in a physical form, and exist today as free, open-source and audited apps. They need zero communication for the second factor. As we all know 2FA should mean: something you know and something you have. But in cases like OP's, even if it's sent through a(n allegedly) secure protocol, the scenario is: something you know and something THEY have. You have fuarrrk all control over the second factor, you have the keys, and the hashes travel through god knows who in a god knows what kind of form (secure or not). The only point of the whole thing: locking you into their ecosystem. Everybody who forces people into predatory information ecosystems like Microsoft's really should kill themselves.

>>75219 *you don't have the keys sorry for my malding induced mistyping syndrome.

>>75217 you are so right its insane to me that we are just accepting the fact that people dont know how to protect their accounts with a password. password managers with strong autogenerated passwords really are the way to go, but >>75218 is right saying that microsoft and companies like to push 2fa on us because of tracking. it all is like kicking dead whales down the beach. recently ive started keeping an encrypted db with my passwords on a usbkey and ive never felt more secure to be honest https://github.com/cyberfilth/LazLock

You can always just use totp and not rely on SMS and such.

>>75222 >You can always just use totp and not rely on SMS and such. isn't that pretty much what M$ auth is? What would be better is to get a physical way to auth like via USB. Ask the IT person if there's a way to auth with that instead. We bought a bunch of Yubikeys at my work because a few (more than i expected, actually!) employees didn't want to use the authenticator app and we decided that USB is pretty much the next best thing.

>>75223 ms authenticator supports (for now) totp but it pushes you to using push notifications and what i think is some proprietary totp-equivalent. unless its just totp with 8 characters, i havent tested or checked this hypothesis. for example registering a authenticator device for live/365 makes you click "use a different type of authenticator app" to get standard totp, otherwise its seemingly ms auth specific. even worse this option is discouraged by ms, so many tenants disable it. i think they even changed the default to disable it recently, so for inattentive tenant admins, they may have lost the ability to use totp instead of ms auth.

Meme security invented by Google to enhance their personal tracking data collection.

>>75232 Defo not meme, but certainly awfully used by corpo. (per usual.) are there alternatives to 2FA? honestly 2FA's way of authenticating saved my ass a few times already.

2fa as a concept is fine, and there are great free software implementations like LinOTP that are secure, flexible, and respect the user's right to use whatever software they want on their own computer. The problem is that so many of the 2fa systems in use are hot garbage. I'm convinced duo mobile only has any market share because they give managers kickbacks to use their software.

On paper 2fa is sensible but I too am bothered by how it's often utilized. Like needing to use some silly app which I do not know how to back up or what happens when my phone dies, gets lost, stolen, deprecated or even the phone number gets disabled and I can't receive SMS codes any longer. Then the way to resolve myself being locked out is the same way you'd just social engineer your way into someone's account. It's good to have redundancy but what 2fa in reality does is tying access to all your things, like your online banking, your payment service, your work accounts and company resources, your social media and online identity, your open source projects you decided to host on github, your account with any big silicon valley company for whatever purpose. Basically so many things that the only way sometimes you can be aware of is once you're locked out and check what isn't working for you any longer. It does not pose a benefit or quality of life improvement as far as I've experienced as a user but it helps tying data about you together via your phone number. In short it's mostly only good for tracking and control. >[Please make a better post] Screw you, apple man. It a perfectly fine post that I now need to break down into parts to hunt down what triggers the word filter? (1/?)

A better approach would be to achieve the same goal is to have something like redundant RSA key shards. Something like 3 different places with each 2/3rds of your private key so that if you lose access to one then no 3rd party can do anything with it while you still have access to everything else by having the complete key via the remaining 2 shards. Say you've got [1,2], [2,3] and [3,1], you only need 2 of them to get [1, 2, 3], no central authentication service or SSO needed. No mission critical data needs to be sent anywhere, the service you're having business with only needs a public key they can verify its validity via handshake. The part of the data which you can theoretically post publicly without worry so password or database leaks aren't anywhere near a problem beyond the violation of privacy. But wouldn't grant access to anything unless you've got the full private key. If we weren't being scammed with these meme methods then we'd have likely something at least similar. What's your thoughts? (2/?)

But other than that, using a password manager which can automatically save your credentials database in an encrypted form simultaneously to a designated USB drive (primary copy) and to the machine you're using it on (backup) is already a great approach. Ideally you'd also backup those keys on designated backup devices on a regular basis, preferably at least one which will survive if your house burns down (1,2,3 Rule) but even the 2-copy way makes you reasonably safe without needing a whole memory castle to remember your random sequences of special characters. Hell, even single use key lists are better if you can get them via a secure way which I greatly prefer but even established banks ran by old out of touch people (can't say the b word) don't support that method any more. It's all so tiresome.. (3/3)

>2fa fine 2fa fine it saved my ass 3 times shut the fuarrrk up jesus fuarrrking christ why is the hacker community so fuarrrking dumb and clucked now first of all, it doesnt even work, since 99% of it is over sms and i can just call a carrier and politely ask them for all your text messages, and this will never be fixed. even if 2fa is good then why does not one single company provide opt out? because data mining., 2fa is just a transition to photo id for all internet activity its like those glitterboy yuppies who think cloudflare captchas serve a real purpose >it saved my ass 3 times pls jump off a cliff, you are the reason this soykaf exists

0th of all, all 2fa can also be trivially defeated by redressing your GUI and soykaf like the same attacks that worked against winblows users in the 90s

as long as i see some "pls enter phone number XDDD" bullshit every day i will continue plotting on killing as many web devs as possible, possibly in the millions.

>>75257 >garbage collect all the web devs Hey, halt, whoa there! I merely operate ze train to the camps! The real culprits are the product leads, bosses, share holders and possibly soon regulators. I wouldn't be surprised if the EU introduced something that would require (((2fa))) everywhere. >but they owned crapple with the usb c rule! They also tried to outlaw memes at one point. I agree it would be better if the usages of 2fa would at least support yubi keys or other peripheral/usb hardware preferably on the browser level but that said, the real OGs are the places that don't even require an email address to register and it's just name/pw or asymmetric key.

be quiet, /sec/ might hear you! Sincere question, would you prefer biometric MFA like thumbprint, or a physical key (e.g. special USB) over phone MFA? >>75258 go away, we don't want that bullsһіt here. there are a dozen other boards for it.

>>75265 >we don't want that bullsһіt here You're right, my deepest apologies! The actual real OGs are of course the places that let you post without any login bullcrap whatsoever while you're behind a seven proxies! >biometric authentication Only if it's self hosted and isn't sent to some bunch of söy nazis who feel the need to control about what or if people are allowed to talk or not.

>>75265 Physical key. I'm not giving biometric data to check my damn email.

>>75265 >would you prefer biometric MFA like thumbprint, or a physical key (e.g. special USB) over phone MFA? Funny story: in canada, unless we decide to sign risky legal papers to all of our employees, (which we won't. won't stoop that low) we can't use biometrics at all. physical or phone auth are the only options. That said. Physical auth all the way for me. there's something that feels more secure than some intangible phone number sms. (that can be can be intercepted)

All I need to do is scan QR code on my phone.

> who feel the need to control about what or if people are allowed to talk or not. why is this always the talking point? Is this really the only reason you can think of to dislike a technology? Also, there are types of 2fa that aren't SMS- or push-notification based. I use one every day, it's great, I can use a free software TOTP authenticator on my phone or laptop, and the 2fa password is part of my SSH password. >2fa does nothing it does something, your complaint is that it's not foolproof. Google's implementation in particular seems to be useless because you can't meaningfully change your phone number.

>>75273 >Is this really the only reason you can think of to dislike a technology? Not sure what your issue is. This thread mentioned other reasons too. But retaining the liberty to speak your mind is a pretty damn good reason alone. Without that you can't complain about the other problems either and the way that tech companies get us to link more and more parts of our life with their data collection business model and their worryingly strong willingness to be a tool for ever increasingly controlling governments by means like those terrible implementations of 2fa makes me wonder why we aren't talking even more about this. And I don't think you're in the right place here for trying to cast ridicule on anyone mentioning that concern. Technology is meant to empower humanity, not to oppress. >it does something Yes, being an inconvenience that gives you the illusion of being safe. >I use one every day, it's great Damn dude, it's one thing to endure it as a necessary annoyance but enjoying having to jump through that additional circus hoop just to be able to access your own accounts? That sounds mental. Like, is it the dopamine hit you get from feeling protected every time while you have to wait for that 6 digits code to pop up on your phone every time? Anyway, you vill link your private phone number to your online activity, you vill get your bank account frozen for expressing opinions counter to the current narrative even if it's subject to change, you vill get locked out of your smart home and electric car if you forgot to charge your smart phone and you vill be happy!

>>75275 >Yes, being an inconvenience that gives you the illusion of being safe. Like my password? It's so inconvenient to type it in and all those web services have gaping security holes just waiting to be found anyway. >Damn dude, it's one thing to endure it as a necessary annoyance but enjoying having to jump through that additional circus hoop just to be able to access your own accounts? thinking something is great =/= enjoying it. And it's for work accounts, I don't own anything on those machines. >wait for that 6 digits code to pop up on your phone every time? I don't have to wait actually. I use the free software application andOTP that I downloaded from F-droid, as soon as I type in my andOTP password I can see the next code. >Anyway, you vill link your private phone number to your online activity Again, my phone number is not linked to the particular 2fa system I am talking about at all. >you vill get locked out of your smart home and electric car if you forgot to charge your smart phone and you vill be happy! If you need to sign in to a web service to use things you own, you deserve whatever dumb consequences that comes with.

>>75273 >I use one every day, it's great, please shut the fuarrrk up little yuppie this is like that one glitterboy who told me touch screen buttons on the side of a computer monitor are great. they are DOG SHIT and you are DOG SHIT and have no taste or common sense and are just drinking corpo coolaid

>whats the alternative? >whats the alternative? a fuarrrking password. the 90s garbage was better in every way than this garbage. please smash your head under a bus if you support anything remotely like "2FA" or selfies or whatever fuarrrking snakeoil that's so stupid you should never be allowed to work in engineering or security once you are outed

>>75293 The thing that gets stored in plaintext across networks, in memory, and still semi-frequently in the database? Or even if it's not in plaintext in the DB, it uses something soykaf like MD5 or SHA1? Not to mention soykafty password requirements that gimp their entropy. Yeah, so safe. 2FA is a soykafty mess, but its added on top of another soykafty mess to try and make something better than each one individually. Also, anyone relying on SMS 2FA is an idiot (either user or company, depending on if token 2FA is available or not). If you actually value true security and not "good enough" security I only expect you to use auto-rotating PPK cryptography and avoid anything less than that, but then you can't use 99% of the modern internet. Oh, also hope you use DNS-over-TLS to avoid DNS sniffing. The list goes on. This entire thread is completely useless and just exists for people to hurl insults and threats at one another over the well established soykafty mess that is computer authentication. Hope a good thread didn't die for this one.

>The thing that gets stored in plaintext across networks, in memory, and still semi-frequently in the database? stopped reading there 2008 called it wants its "noo u cant just plaintext" spergs back

>>75292 >>75293 What's it like to get triggered this easily?

Please OP by all means turn off 2FA. Convince your co workers to do it too. And your C leve staff. If you do this, then I just need to find your credentials online, which are alot easier to find than you think. More so every single day. Then I can hammer all your logins all day way easier.

>>75321 >find your credentials online, which are alot easier to find than you think How are you going to do this? You can't scare me into thinking that the surveillance and datamining that is 2FA is necessary.

>>75321 What makes you think I can't find your 2FA codes either? If you're retarded enough to post your password publicly there's nothing stopping you from sending whatever other codes to Rajesh in India.

>>75322 It's not for your sake. It's for the sake of the more "special" neophytes in one's business. passwords are leaked everyday because of these dumbasses and they'll never bother to change their password once in a while, let alone diverse their password on different platforms. They will never realize their password got leaked and all of the sudden the company is at risk because ofc they use the same password on their work credentials. We are forced to use this because at least it's bot/dummy-proof without spearfishing attacks or actively trying to get a 2fa code/bypass it. (Like what >>75323 says.) I hope yall take the time to change your complex password every once in a while on what you care. Like. do it rn. Sec101.

>>75328 Changing passwords on a schedule is security theatre. If someone gets your password chances are they're already inside + it makes it harder to remember passwords, leading to less complex passwords being used. I of course don't reuse passwords because I do not trust sites to store them properly. I use a password manager which I do trust.

>>75323 FIDO defeats this through some soykaf I don’t understand. Yubikeys are the future, but have just been too slow. On a long enough time scale, anyone gets spearfished if it’s tailored enough, FIDO makes that impossible I think because it is based on key exchange. Everything should be like SSH, and hopefully one day it will be.

2fa doesnt solve anything you dumb fuccing fagg0t. you still can have any action taken as you once you authenticate to your bank, such as withdrawing all your money. if youre an auto mechanic you plug your backdoored phone/laptop to the odb and it uploads malware to the customers car that causes it to steer off the road at full speed. you fuccing little fagg0ts who are always right dont understand the concept of groundedness. fucc off and die, get the actual fucc out of my industry. sms 2fa is a complete joke and waste of time and terrible UI i have not been hacked since i started using the net in 1999, and still will never. why do i need this terrible bullsh1t that cant be disabled that totally isnt for datamining? fucc yourself consumer yuppie dorito eating fagg0ts

>>75217 >>75223 If it's using TOTP or HOTP you can just use oathtool https://www.nongnu.org/oath-toolkit/ on your computer(which is where I assume you store your passwords already).

>>75217 You're right man, 2FA is bullshit. I understand that it is something that should work as an extra layer of security for accounts, however I think it is more for stupid people who forget to log out when using a device that which is not theirs.

Privacy conspiracies aside, they do it because the average person is retarded, but also because the botnet is killing the internet so it's not all the normal people' fault. Most people choose simple passwords and then they get hacked. Hardware is getting more powerful so passwords can be cracked more easily. That's my take

>>75217 sounds like you're university's IT department is inept honestly. MFA, when done properly, is nothing but a simple button press on your device. If you're having to jump through the hoops you've mentions, you're IT department is a pack of apes. But it is a university, so I can't imagine they're being paid well enough to care.

>>75245 >I'm convinced duo mobile only has any market share because they give managers kickbacks to use their software. My uni makes me use this. At least unlike op, you only have to re-authenticate every few weeks for any given device. Kickback theory makes sense. Pretty sure that's why I had to buy a $70 "iclicker" for a freshman math class that I never used again.

>>75217 hey varchar what happened to your site

>>75217 >I HATE 2FA SO MUCH IT'S UNREAL Wait until you get a corporate job >type password to unlock laptop >type password + 2fa dance to connect to vpn >type password + 2fa dance to login to email >type password + 2fa dance to login to jira >type password + 2fa dance to login to giblab You'll really want to kill yourself then. We finally for work from home but at what cost.

>>75711 I assume you recognised the wallpaper in the photo? >what happened to your site I took it down because I felt like it wasn't good quality. That was a feeling I always struggled with but it got to me eventually.

SMS based 2FA is straight up a security hole because of sim swapping. Of course requiring a phone number is cancer too. TOTP or no 2FA.

>>75782 Especially busted if you then social engineer your way to total control and completely lock out the target because hey, you're from his number, surely that's enough confirmation you're him. Even more busted for retarded stuff that completely relies on the phone number for both identity and auth.

>>75761 I liked your site, varchar >I assume you recognised the wallpaper you talked about 2fa in your blog too

>>75791 >I liked your site, varchar I'm glad. I've been thinking about starting again with a new site. I might try self-hosting this time.

>>75219 >long ass history lesson about how sms is unsecure to and crackable yeah but 2FA via SMS is time sensitive doofus. it's not like reading OTPs from a month ago is going to do anything. the actual attack vector for 2FA via SMS is a SIM swap attack. this is how SIM swappers with literally no technical skills can hijack 2FA SMS, do account takeover, and steal cryptocurrency and soykaf. the main reason why 2FA over SMS is so ubiquitous is because 2FA is a requirement due to the prevalence of phishing in enterprise environments and the ubiquity of SMS as a protocol used for the mass public. it is a requirement for IT service desk personnel to use a 2FA method that is at the very least an app, or better yet a hardware key such as YUBI.

2FA is fine, it's just commercial implementations that suck. TOTP stored in a FOSS app like Aegis is really cool (as long as you trust your phone, of course)