2 Factor Authentication

What is the point of 2 factor authentication and why did it become so popular? We have manually made our phones the weakest link. I am much more likely to get my phone stolen than my desktop computer that is sitting in my apartment. Then why would I want to make my phone the master key to accessing every account I have from social media to banks? If I steal someone's phone, I have access to everything that person has. 2FA is made obsolete, and I have access to every password that is saved on the phone, probably even saved credit card information. Then for what reason exactly do we have 2FA? In theory 2FA could bring additional security only if it is not possible to login from the same device that is authenticating, but this is not feasible.

It's so your activities can be tracked across devices.

>>18762 >We have manually made our phones the weakest link. I am much more likely to get my phone stolen than my desktop computer that is sitting in my apartment. Most people are more likely to get a keylogger on their desktop computer or have one of their reused passwords leaked than to get their phones stolen. >Then why would I want to make my phone the master key to accessing every account I have from social media to banks? 2 factor authentication doesn't need to involve a phone. You can use totp on your computer or have a physical device. >If I steal someone's phone, I have access to everything that person has. 2FA is made obsolete, and I have access to every password that is saved on the phone, probably even saved credit card information. I don't know about you, but I don't save any passwords on my phone. This is also assuming that you've got the ability to actually get into my phone and that I haven't remotely wiped my phone by the time you try anything. >In theory 2FA could bring additional security only if it is not possible to login from the same device that is authenticating, but this is not feasible. Not only is this feasible, this is how every peer I know handles their 2 factor authentication for their jobs. The biggest appeal of 2fa is that without it, anyone in the world can try to log into your accounts. If you have a physical device, now your attackers are limited to those who are can access the physical device.

>>18763 >>18764 These two anons are both correct. 2FA is used for a lot of user tracking. Just look at Google Authenticator. That soykaf is one hundred percent for collecting further user data. It's popular because it's a convenient way to get a 2FA, but 2FA exists in more forms than just OTPs. And even then, OTP apps exist outside of Google's soykaf.

>>18762 If you steal someone's phone you probably won't be able to do anything with it unless you can guess the password, and that is probably not going to work unless the person you stole from is a moron. Unsurprisingly, 2FA is only as useful as the person who uses it will let it be I find it is ultimately safer to have 2FA than not, or at least it makes me a much smaller target than many others. Maybe your mileage varies, but if someone has the password to a service I use, they would also need physical access to my unlocked phone to get in and for me to be unable to reset the password and 2FA on those accounts - in that case I have bigger things to worry about, it's just not going to happen unless my life is already in serious danger Obviously the best security is to use different passwords everywhere, don't put your email address into dodgy input boxes. Bonus points if you protect your email, domain, internet banking, and social media accounts with extra scrutiny, but all services are ultimately as secure as the person on the other end of the corporate help desk As for tracking you, if you use Google Authenticator then that's on you. Just use a different OTP application

>If I steal someone's phone, I have access to everything that person has Nod really :DDD Enjoy bypassing biometric scanners, decrypting data-at-rest and accessing eSIM. The advantage of a smartphone over at-home computer that it is truly personal, it can almost not be tampered with because you have it on yourself all the time, and your home computer needn't be stolen to access your data, only tampered, e.g. by installing Evil Maid keylogger existence of which you'll never discover. Besides, 2-factor authenticaltion does not mean only cell phones or SMS, it's just the easiest to implement to make majority of accounts safer than whatever "qwerty123" password your average normalcattle is capable of coming up with. Before that, we had email notifications. SMS replaced email and smartphone applications replaced "desktop" applications. I repeat, it does not mean there no other ways of combining factors, e.g. a password and biometrics or password and a smart card.

>>18767 >I find it is ultimately safer to have 2FA than not, I'm of the same opinion here. You're not supposed to only use 2FA and only 2FA, you're supposed to have other authentication methods like a password, for it to work. If they don't have one or the other, they can't do soykaf. Lil harder for the script kiddies to get a hold of your account. >Literally OP's picture.

>>18769 >I'm of the same opinion here. You're not supposed to only use 2FA and only 2FA, you're supposed to have other authentication methods like a password, for it to work. It sounds like you don't understand what TWO FACTOR AUTHENTICATION is. Phones are an optional part, the only need is that you have TWO SEPERATE FACTORS that are required for the authentication. Simple phone authentication is not 2FA.

>>18764 >Not only is this feasible, this is how every peer I know handles their 2 factor authentication for their jobs. How would you prevent logins from a particular device? I don’t see a way to do this. Since when is it possible to blacklist a particular device without a way to bypass it? Also if we’re talking about devices being hacked, your phone can be hacked just like your computer can. Except now the 2FA is useless. Maybe you took additional security measures for your phone but a lot of people just has a 4 digit passcode and nothing else. Most people just have 1111. >>18767 I would argue it is probably easier to crack a phone password than other passwords unless it is fingerprint etc. And usually same password is used to access all other saved passwords. >>18768 In general you and a lot of others are basically saying smartphones are more secure than computers. That may be true (although arguable) that it is harder to remotely hack someone’s phone than their computer. But it is comparatively very easy to steal someone or to find one someone forgot on a table. It happens all the time. You cannot in the same breath say that 2FA is mostly for dumbasses that use “password123” and also talk about how you can make your phone more secure. A big chunk of people will have simple 4 digit passwords or no password at all. And for the big majority of people the same password will be used to access all stored passwords on this device. At the end of the day for the big majority of people if you steal their phone and crack their password, you have access to their email, their SMA, their passwords, their saved cards... The worst part is because companies trust 2FA you are now able to do a lot of actions that you probably wouldn’t be able to do because it would be flagged as suspicious. Spending 10k in one go? No need to call for confirmation, you approved it on your phone!

>>18776 I do agree that it makes it much harder for someone to just install a keylogger to your computer and get your passwords though. I just think it creates new vulnerabilities by putting ao much trust to a device that can so easily be stolen or lost.

>>18771 >Phones are an optional part, the only need is that you have TWO SEPERATE FACTORS that are required for the authentication. Yeah It was basically what I was trying to get at, my bad g.

>>18776 >How would you prevent logins from a particular device? We have to connect to a VPN to access any of our work-related materials or internal sites. Access to the VPN is tied to our physical computers, login credentials, and otp authentication that most of us have on our phones. Devices have to be whitelisted to connect to the VPN and phones are not whitelisted. Even if we assume we can bypass the whitelist, the level of effort needed to workaround it, the risk associated with it (you will be fired for doing it) are dissuading enough to keep most, if not all, of the employees who could workaround it from bothering to, especially since there is virtually no benefit to it. All of my peers in the industry have a similar set up. Some have smart cards or other similar items that are required to login to their computers as well. >Also if we’re talking about devices being hacked, your phone can be hacked just like your computer can. Except now the 2FA is useless. Maybe you took additional security measures for your phone but a lot of people just has a 4 digit passcode and nothing else. Most people just have 1111. Yes, if someone hacks your computer and your phone, you're fuarrrked. But if someone hacks just your computer or just your phone and you use 2fa on everything, you are much less fuarrrked. >You cannot in the same breath say that 2FA is mostly for dumbasses that use “password123” and also talk about how you can make your phone more secure. A big chunk of people will have simple 4 digit passwords or no password at all. And for the big majority of people the same password will be used to access all stored passwords on this device Not that lainon but this doesn't matter to the point lain is making. If your password is "password" and you have no 2fa, any skiddie anywhere in the world is going to be able to get into your account. If you have 2fa, now only people who can either steal or hack your phone are able to get into it, which lowers your risk substantially. The other point is that phone security has things like face id, encryption by default for many phones, remote wiping, wiping on failed logins, etc. Getting into modern smartphones after stealing them isn't as easy as it was a few years ago.

>>18762 Use keepass and save the 2FA stuff on it, so you database becomes the key, and open source 2fa clients usually allow backups

This discussion is quite interesting as someone who finds the whole system slightly irritating, and is curious as to the actual validity of the system. That said, I'm curious what things look like from the other end - that is to say, what purpose do they serve to the technocrats who have been so swift in adopting the practice? It's been suggested that it correlates data between phone and computer usage, but I imagine there are other ways of achieving this already. Possibly nothingburger, but I'd like to hear the takes on this.

>>18776 >I would argue it is probably easier to crack a phone password than other passwords unless it is fingerprint etc. We could argue about this forever, this is a moving goalpost since phones are such a high-profile target in general. If you have a newer iPhone and use a passphrase, it probably isn't getting cracked unless you are a high value target - in which case you don't have 2FA on your phone >And usually same password is used to access all other saved passwords. 2FA isn't a substitute for good security practice. As a general rule, never recycle passwords.

>>18784 >That said, I'm curious what things look like from the other end - that is to say, what purpose do they serve to the technocrats who have been so swift in adopting the practice? It's been suggested that it correlates data between phone and computer usage, but I imagine there are other ways of achieving this already. Possibly nothingburger, but I'd like to hear the takes on this. Less money spent on dealing with support for users who got hacked, more security within their own corporation, compliance with security regulations, not having it is guaranteed negative public opinion. I don't really think there is much of a tracking use case for non-sms based 2 factor authentication. Would like to see if there's any hard evidence of such.

you all are talking about how easy it is to crack someone's phone but missing the fact that you have to first obtain the phone, which is a big physical hurdle. At the very least it makes it difficult to spam attacks against hundreds and thousands of accounts at once.

it is an easy band-aid solution so normalniggers can feel better about using online services even though it just increases overall data footprint and attack surface. win win for globohomo.

>>18794 Yeah I would say it's two-sided. It makes it harder to be a victim of a large-scale hack where someone is just spamming attacks on every user, and it reduces the amount of accounts hacked in the long run. But if someone is personally being targeted then stealing someone's phone is the easiest approach to gain access to that person's everything. If you forget your phone on the table at a restaurant then that is practically equivalent to putting all of your credit cards and sensitive information in a weakly locked box and leaving it on the street.

>>18796 Majority of people use biometric authentication like fingerprint on their telephones, some on it's 2022. No need to memorize passwords and a thief should have sophisticated equipment to perform the attack on what most of the time is an opportunistic grab. What threat model are you trying to present here, who are you trying to protect your data from? I swear to Dog, discussions on bicycle locks are more comprehensive than a typical lainchan /sec/ thread like this, what the fuarrrk is your problem, OP? Most of the time a thief would end with a slab of glass, metal and electronic circuitry on his hands with nothing to do with it since many modern devices are harder and harder to even reset without right credentials for resale. Additionally, nothing stops you using a short password in addition to fingerprint, bank applications enourage that on top of whatever is already presented by default. A sophisticated thief is even less likely to get access to fingerprint + short PIN at the same time. How many factors do we have already, password from PC, phone finger print, bank application PIN, push notification inside the app with one-time code? sage as downvote

>>18798 Most sane Lainon. This basically summarizes my problems with this thread, too. I swear my classmates in infosec acts like OP here. Running like headless chickens screaming "what if- what if-" trying to find a flaw on the wrong (and improbable) things. At least elaborate a threat model.

The real problem is that passwords are just plain awful and nobody has come up with anything much better. Hard to remember and easy to guess is not a winning combo. But fuarrrk tying things to my cellphone.

>>18783 not sure why would you do that unless 2fa is mandatory, and basically that wouldn't be 2fa anymore

>phone stolen Good luck bypassing the lock of any phone past 2015

*MFA not 2FA, doesn't always have to be just 2 ;) to be honest I think passwords are soon to die and MFA methods will become the new way to login, can't find my OTP in a password dump. Microsoft are already pushing this hard with their whole passwordless spin in AzureAD / windows hello. Where I work I have seen attempted brute forces in 100+ accounts in 24h but since they all are forced to use MFA that fails. And when one of these get's the password but fails MFA it gives enough time to force a passsword change on the account. Like any infosec defence it's not designed to 100% protect you, it just delays an attacker and gives you time to respond.

And you;re really concered about someone hacing the device you use for MFA, just use a fido key.

Current popular deployments of 2fa are, as has been stated, activity trackers with plausible utility. The posts preaching how 2fa need not come in the form of a smartphone program are completely ignoring something important: just because it is possible to do things other ways does not mean that most people or companies will do them another way. People will be handing their butts over to Apple and Samsung and they're going to be happy and proud about it. Imagine it's 2020 and Bill Billson has been working at United Solutions Inc. for a year. All the office staff are told to work from home now and the company scrambles to find remote working and communication solutions. One guy in IT makes a Word document, complete with screenshots edited in Paint, on how to use NetExtender, Windows Remote Desktop, the Google Authenticator app, and a crappy web portal to register their credentials. Now, what does Bill do? He doesn't have admin access to the work computer in the office (running Win10 but with a Vista badge on the case), but that won't be difficult to get around and set up his own remote solution (if Bill knew how, but he doesn't). However, I don't think IT will be very happy if Bill decides do go over their heads. Maybe he can politely ask them not to do their 2fa with Google services? Bill asks them over the Microsoft Outlook browser client, since he was using it already and doesn't want to use the company Discord server. He gets an automatic reply telling him that a support ticket was made, then another email saying that the IT guy assigned the ticket to himself. Soon after, he receives an email from the IT guy saying "if you have havign trouble, see attached" with "remote.docx" attached to the email (the same document he has already read). At this point, Bill is fed up and needs to figure something out, as he hasn't been able to work this whole time, so he caves and installs Google Authenticator on his phone, vowing to come up with a less worse solution later. Bill later has his personal Google/Yahoo whatever mail automatically transitioned to 2fa and conveniently set up for the phone # that he has already supplied. Since he is a normal person, he throws his hands in the air and exclaims, "they have all my info anyway," and resigns himself to using these programs until Google/Microsoft/etc come up with something else. Does MFA make it easier to force regular people to use a less exploitable login method? Sure. Is the way it's going to be used in reality for 99.9% of people anything but a ploy, often unknowingly pushed by useful idiots, to further link all of their activity to a single mobile device and phone #? You be the judge.