[HN Gopher] Bypassing 2FA - Secret double octopus [2019]
       ___________________________________________________________________
        
       Bypassing 2FA - Secret double octopus [2019]
        
       Author : rolph
       Score  : 10 points
       Date   : 2021-12-07 20:20 UTC (2 hours ago)
        
 (HTM) web link (doubleoctopus.com)
 (TXT) w3m dump (doubleoctopus.com)
        
       | kevwil wrote:
       | Beware of paid, proprietary solutions to security problems
       | claiming to be "the only passwordless solution offering seamless,
       | mathematically unbreakable authentication that doesn't require
       | humans to come-up with, manage, memorize or input passwords".
       | Free tools like SQRL exist, which uses elliptic curve public key
       | crypto instead of passwords, and no doubt other solutions also
       | exist.
        
       | armchairhacker wrote:
       | There should be a better solution for 2FA now especially with
       | cryptocurrency all the rage now. Like a small waterproof chip
       | that can be attached to your skin (maybe upper elbow) with an
       | RFID. Why hasn't such a product been invented yet?
       | 
       | Currently there is the YubiKey, Ledger, Trezor, which all cost
       | $25-70. Just for a USB that can generate a OTP (I'm
       | oversimplifying but does what they do really cost $50?). Then
       | there is Duo mobile for phones, which may be slightly less secure
       | but is probably better for most cases. But both suffer from the
       | situation where you can lose your key.
        
         | tialaramex wrote:
         | The FIDO (and at this price you're probably buying FIDO2)
         | authenticators aren't generating an OTP, they're doing public
         | key crypto to prove they're the same key as you enrolled.
         | 
         | There have been several open hardware designs in this space, so
         | if you can do a lot better that seems like you should go into
         | business.
         | 
         | And since you mentioned phones, a nice modern phone, with a
         | fingerprint reader or similar, is also a Security Key for this
         | purpose anyway. Google even have a prototype for the scenario
         | where your (Android) phone is a valid Security Key, your
         | desktop or laptop with Bluetooth and Chrome can see it nearby,
         | so it lets you authenticate from the phone for desktop web
         | pages.
        
         | encryptluks2 wrote:
         | 2FA isn't inherently insecure, and hardware tokens are not that
         | much better IMO than an encrypted USB drive. I agree $50 is too
         | much for a glorified USB drive with tamper-resistant chips.
         | Prob could achieve near the same thing with some hot glue. I'm
         | on the same page though, the issue with hardware tokens is that
         | they can easily be lost thus causing you potentially to lose
         | access to accounts or make replacing the token on your account
         | way more difficult.
        
           | vorpalhex wrote:
           | You are supposed to have multiple hardware tokens all
           | enrolled so you have backups.. but the hardware tokens are a
           | bit pricey and several implementors have failed to read the
           | spec and only let you enroll a single token.
        
             | tialaramex wrote:
             | I will ask, as I always do, for a list of these "several
             | implementors" who don't obey the WebAuthn spec. Note that
             | even if dozens of you say "AWS" that's just one bad
             | implementation, not several.
        
         | J5892 wrote:
         | > Why hasn't such a product been invented yet?
         | 
         | The YubiKey Nano is really small. I'm sure a skilled piercer
         | could find a way to get it under your skin.
        
           | InitialBP wrote:
           | The YubiKey's that support NFC are all significantly larger.
           | The Nano does not currently support NFC. Size is a challenge
           | with NFC specifically as I believe larger NFC chips lead to
           | larger area of allowable communication.
        
             | aledalgrande wrote:
             | You have your elbow close to your laptop anyways... might
             | as well plug in.
        
       | skykooler wrote:
       | Not sure what's up with the cookie banner on this site: "This
       | website uses cookies to improve your experience. We'll assume
       | you're ok with this, but you can opt-out if you wish." There are
       | two buttons, "Accept" an "Read more". "Read more" is just a link
       | to google.com (not even a search string) which feels really
       | condescending.
        
         | authed wrote:
         | I love it... but I didn't see it until I unblocked
         | JavaScript... they are probably just laughing at the current
         | mess.
        
       | 1cvmask wrote:
       | Saas Pass has had a passwordless authentication solution
       | available on the market for almost a decade. The future has
       | arrived. It is just not evenly distributed yet.
       | 
       | - Disclaimer: Worked on UI and UX stuff
        
         | antisthenes wrote:
         | How does it work?
        
           | 1cvmask wrote:
           | You can scan an ecrypted barcode or through push login or
           | other methods. There is more at the developer site.
        
             | TheMatten wrote:
             | Is this basically what Discord does with it's web/desktop
             | client?
        
       ___________________________________________________________________
       (page generated 2021-12-07 23:03 UTC)