[HN Gopher] Requiring MFA on popular gem maintainers
___________________________________________________________________
Requiring MFA on popular gem maintainers
Author : jacques_chester
Score : 147 points
Date : 2022-08-16 12:43 UTC (10 hours ago)
(HTM) web link (blog.rubygems.org)
(TXT) w3m dump (blog.rubygems.org)
| password4321 wrote:
| As promised 2 months ago:
| https://news.ycombinator.com/item?id=31730221
|
| Perhaps accelerated by the vulnerability 3 months ago:
| https://news.ycombinator.com/item?id=31298435
|
| --
|
| Implemented for npm 2.5 months ago:
| https://news.ycombinator.com/item?id=31573578
|
| --
|
| PyPI's transition was summarized a month ago on LWN:
| https://news.ycombinator.com/item?id=32111738
|
| which linked the discussion I was originally looking for, where a
| project owner considered potential downsides:
| https://news.ycombinator.com/item?id=32037562 and a response:
| https://news.ycombinator.com/item?id=32061428
| jacques_chester wrote:
| > _Perhaps accelerated by the vulnerability 3 months ago_
|
| FWIW this has been in the works since January:
| https://github.com/rubygems/rfcs/pull/36
| ufmace wrote:
| Good news for the Ruby ecosystem, but I'd also like to get a
| handle on exactly how many of the most popular gems have "over
| 180 million total downloads".
| yxhuvud wrote:
| That is what happens if you have CI systems that doesn't cache
| sufficiently aggressive.
| qrush wrote:
| Many: https://rubygems.org/stats
|
| You can also get database dumps here to dig further:
| https://rubygems.org/pages/data
| jacques_chester wrote:
| Approximately 100 gems, representing about a third of
| downloads.
|
| The original plan was to target based on download rankings, but
| these fluctuate, so in theory gems could be added and then
| removed from the list. A count of downloads can only go up.
| nkantar wrote:
| Were download rankings combined with one-way "membership"
| considered? (One-way "membership": once a gem/user qualifies
| based on recent downloads, they're permanently required in
| perpetuity.)
|
| This seems to be like it would mitigate the on/off problem of
| using a variable metric while also being biased to the
| currently relevant gems/users.
| jacques_chester wrote:
| IIRC we figured it would be more confusing than helpful.
| nkantar wrote:
| That makes a lot of sense, actually.
| londons_explore wrote:
| Remember that 'downloads' is only half the metric that
| matters... Really 'users' is what matters, but a single
| download could lead to the code being used by a large platform
| provider and that code handling the private data of 1 Billion
| users.
|
| So, you really want every possible assurance that that code
| does what it says. And MFA is a good start for that.
| jacques_chester wrote:
| It's true that download count is a coarse metric, but it's
| the one we chose on this occasion to start with a manageably-
| sized cohort.
|
| As it happens I gave a talk[0] about how to rank projects
| according to their risk. A surprisingly difficult topic.
|
| [0] https://www.youtube.com/watch?v=T_Lrb2rYLps
| qrush wrote:
| Huge thanks to the rubygems.org maintainers and to Shopify for
| contributing developer time and energy to making this happen!
| bradly wrote:
| If anyone is looking to do some open source contributions on a
| mature, production Ruby on Rails site, I highly recommend
| contributing to the rubygems.org project. The code is extremely
| clean and the project is very, very well run.
|
| https://github.com/rubygems/rubygems.org
| vlunkr wrote:
| I didn't know it was a Rails project, though I suppose it
| makes sense. That's neat.
| czbond wrote:
| I'd also like to add a "Cheers" to those members; doing so
| here, bc I don't know of a better place. Cheers!
| swayvil wrote:
| It's nice to see people with advanced fine arts degrees finally
| getting the respect they deserve.
| kelnos wrote:
| This is good news, but IMO far too late, and far too little. MFA
| should just be required, period, and this should have been the
| case years ago.
|
| Not singling out Ruby here; I'm sure many other package
| registries are similarly lax.
| ddevault wrote:
| This is the only mitigation that distributions like RubyGems can
| use to curtail abuse without a major redesign, but it's far from
| enough. This is the wrong model for software distribution. We
| would be wise to look to Linux-style distributions as an
| alternative, where malware is essentially unheard of rather than
| a weekly occurrence.
| jacques_chester wrote:
| If you would like to maintain such a curated resource, please
| do. But even then you'd need MFA.
| ddevault wrote:
| There are many, many Linux distributions that are already
| maintained in this fashion. Most of them provide Ruby
| packages! And they already have strong cryptographic
| signatures for all packages -- which is much better than MFA.
| jacques_chester wrote:
| Rubygems already has signatures. To a first approximation,
| nobody bothers.
|
| I know you're very gung ho on the idea of curation, but let
| me be blunt. Nobody is going to do it. Debian has on the
| order of 97k packages with 990 volunteer members curating
| them. RubyGems has 180k packages with 3 volunteers. Really
| it's 2 volunteers.
|
| So unless you know of 987 volunteers champing at the bit to
| review 180k packages from scratch, it's just not going to
| happen. And let's not even start on PyPI (340k packages) or
| npm (2 _million_ packages).
| ddevault wrote:
| I'll match your bluntness, then: suggesting that anything
| on the order of 2 million packages are _actually useful_
| is plainly ridiculous. Debian et al act as quality
| filters by only actually packaging the stuff anyone cares
| about or needs. A stronger argument along these lines
| lists the packages that you actually _need_ which are
| missing. And once you have such a list -- add them to
| Debian! It 's not particularly difficult.
| dalke wrote:
| I had code that was in Debian.
| https://tracker.debian.org/pkg/chemfp . Someone else
| added it, so I guess they thought it was useful. I know
| someone who used it too.
|
| You can see it's version 1.1p1, which was a very old
| version. Here's 1.6 on PyPI -
| https://pypi.org/project/chemfp/ .
|
| When new releases came out - free software under the MIT
| license, available at no cost - I sent an email to the
| maintainers to let them know.
|
| I never got a response. It was never updated.
|
| Is my code useful? I think it's useful .. for the small
| niche I'm in. People do pay me for it.
|
| And there are a _lot_ of niche packages.
|
| FWIW, I later switched to a commercial free software
| business model, where customers paid me for access to the
| source under the MIT license. More specifically, "we
| encourage people who redistribute free software to charge
| as much as they wish or can ... you might as well charge
| a substantial fee and make some money."
| https://www.gnu.org/philosophy/selling.en.html
|
| I realize that I could maintain Debian packages myself.
| But while it's "not particularly difficult", it's still
| more than I want to do. FWIW, based on my download logs
| for July-to-date, I should start with Ubuntu:
| 2 Amazon Linux 2 CentOS Linux 3 Pop!_OS
| 5 Linux Mint 6 Raspbian GNU/Linux 12
| Gentoo 19 Debian GNU/Linux 114 Ubuntu
|
| By comparison, it's even simpler to support all of these
| system via a pip-installable package.
| jacques_chester wrote:
| If only one in ten npm packages is useful, that's still
| 2x Debian's current current package count.
|
| I just don't think there are enough people available and
| willing to what you want.
|
| I would be happy to be proved wrong.
| ddevault wrote:
| Far fewer than 1 in 10 npm packages is useful.
|
| I don't think you understand what I want. I don't want to
| see all of the packages in these repositories added to
| Linux distributions. I want to see the packages _that you
| need_ added to these distros.
| jacques_chester wrote:
| > _I want to see the packages that you need added to
| these distros._
|
| So if I need a package, and it's not in the curated repo,
| what do I do?
|
| And no, I don't want to maintain the curated version
| myself. The whole point of using someone else's software
| was to save time and effort.
| cortesoft wrote:
| And because Debian has such strict curation, a lot of
| software ends up being distributed via other channels,
| either from alternative deb package repos or not using a
| deb package at all.
|
| If we add a lot of curation, you will end up with a lot
| of gems being forced out of rubygems. This will make
| people become used to sourcing gems from alternative
| locations, and you will lose even the most basic of
| protection you get from what rubygems is doing.
|
| You, or anyone else, is welcome to create their own,
| curated and vetted, gem repository. It is not technically
| difficult to source gems from places other than rubygems,
| so if there was a demand, developers could use your
| curated service.
| ddevault wrote:
| Debian's curation is not so strict as you suggest, and
| what's more: there are more distributions than just
| Debian. Add the packages you need and you'll be fine. I
| can speak from personal experience in this respect.
| cortesoft wrote:
| That's my point. If you make it so people are required to
| go to other sources of packages for normal operations,
| then it normalizes untrusted distributors of packages.
| kleer001 wrote:
| Multi Factor Authentication not Master of Fine Arts
|
| Probably obvious to the majority of you, but it threw me for a
| loop.
| papito wrote:
| Sir, this is Wendy's.
| the_svd_doctor wrote:
| For context https://www.youtube.com/watch?v=q4xLpzSRNOc
| hennell wrote:
| Ruby Dev who's just signed up for an MFA in choreography: "aw
| dammit"
| jzb wrote:
| I had to do a second loop over that myself.
| nomercy400 wrote:
| How would you do MFA when pushing artifacts using your automated
| CI? How would you enter the MFA code?
| jacques_chester wrote:
| You use an API token. We spent time making them more secure
| before rolling out the new MFA policy. We'd like to get to a
| point where OTP codes or OIDC tokens can be used automatically,
| but it will take a fair amount of work to do that.
| staticassertion wrote:
| Hell ya, I hope this becomes the new standard! Thank you so much
| to whoever pushed this, steps like this are going to pay
| dividends down the line as we bolster supply chain security in
| other ways.
|
| I do hope that, eventually, it will be mandatory for all
| publishing.
| jlarocco wrote:
| So what happens if somebody refuses to sign up?
| zhengyi13 wrote:
| 2nd paragraph, 2nd sentence: "Users in this category who do not
| have MFA enabled on the UI and API or UI and gem signin level
| will not be able to edit their profile on the web, perform
| privileged actions (i.e. push and yank gems, or add and remove
| gem owners), or sign in on the command line until they
| configure MFA."
|
| So, (among other things) no updates to the gem on Rubygems
| unless or until they do.
| jlarocco wrote:
| Sure, but what happens after that when the gem developer asks
| for the gem to be removed from Rubygems? Or decides to leave
| an old, insecure version on Rubygems?
| cortesoft wrote:
| The gem developer could always do those things. How does
| this change any of that?
| jacques_chester wrote:
| Then I expect it will be forked. It's open source, after
| all, and a lot of disputes about project direction and
| policy are settled by forking and each disputant going
| their own way.
| woodruffw wrote:
| This is fantastic work by the RubyGems maintainers!
|
| One interesting (IMO) aspect of this: there are _secondary_
| package ecosystems that piggyback on RubyGems that don 't qualify
| for the 2FA mandate at the moment (since, as user-installed
| packages, they don't have quite the same volume as an extremely
| popular library package).
|
| The biggest one I can thing of is CocoaPods[1] -- huge swaths of
| the iOS and macOS ecosystems rely on it, but it has "only" 57
| million RubyGems downloads[2] and therefore doesn't qualify as a
| top-100 package. This demonstrates (again, IMO) the need for
| manual curation on top of a uniform policy for the top N
| packages.
|
| [1]: https://cocoapods.org/
|
| [2]: https://rubygems.org/gems/cocoapods
| ctrlmeta wrote:
| Help me understand one thing. More and more services are moving
| towards 2FA/MFA. The 2nd factor is in a phone app. What happens
| if I lose my phone? Without my old phone I cannot log into the
| services. How do I get access to my accounts again? How do I move
| the 2FA setup to new phone again? Do I have to do this one by one
| for all 50 2FAed services I use?
|
| I am forever worried that if I sign myself for 2FA in 50
| different services and then I lose my phone I may permanently
| lose access to my accounts.
| jacques_chester wrote:
| For RubyGems:
|
| 1. You get given recovery codes when you enable MFA. Each is a
| single-use code that stands in for an OTP code. If you kept
| them, you can use these to login and then change your device.
|
| 2. If you lost those too, there's a manual reset process. As
| you can imagine it's slow and requires careful scrutiny to
| guard against social engineering attacks on the rubygems.org
| maintainers.
|
| In future it will be possible to use WebAuthn[0] for
| rubygems.org and, ideally, you will be able to bind multiple
| hardware tokens or biometric devices to your account, so that
| you have backup options.
|
| [0] https://github.com/rubygems/rubygems.org/pull/2865
| joshmn wrote:
| I recently (few days ago) had to do 2. None of my gems are
| super popular but I have enough that there are some serious
| production workloads behind. It felt scrutinized enough. I
| can imagine if I had more popular libraries that it would
| have been much more so.
| jrmg wrote:
| All the answers here boil down to "you're right, it's
| complicated, so a normal person will just completely lose
| access".
| nucleardog wrote:
| Other people have given a lot of options, but I'll throw my
| solution in the ring.
|
| I have a _separate_ KeePassXC database where I store the
| original OTP secret (if you click "add manually" or "can't
| scan", etc when the QR code pops up... it will give you the
| secret that's in the QR code) and recovery codes.
|
| If I ever lose my phone/yubikey/etc, I can go unlock my "break
| glass in case of emergency" database and access accounts
| directly or recover from there.
|
| I keep this in a separate database versus, say, just putting
| the password + OTP secret + recovery codes all in the same
| Bitwarden vault because I want to maintain the full security of
| the second factor. If my e-mail and password for Bitwarden is
| enough to get you the username/password/otp then I figure it's
| really only protecting against credential stuffing.
| tmarice wrote:
| You probably get recovery codes you have to store somewhere.
| Major 2fa code apps support migration between phones, and
| backing up the encrypted database to the cloud.
| chrisseaton wrote:
| > What happens if I lose my phone?
|
| Backup code (very long, one-time-use password.)
| lupire wrote:
| 6 digits is very long?
| chrisseaton wrote:
| No that's the normal codes, which are time limited. A
| backup code could be 40 digits or something like that.
| 8organicbits wrote:
| Most I've seen are 6 digits for both the TOTP and the
| recovery. Who is using 40 digits for an MFA recovery
| code?
| tialaramex wrote:
| The most you've seen for a recovery code is 6 digits?
| Where have you seen these "never more than 6 digits"
| codes ?
|
| GitHub's codes are 8 alphanumerics,
|
| Dropbox 8 alphanumerics,
|
| Live.com offers a 25 alphanumerics
|
| Google 8 numeric
|
| Facebook 8 numeric
|
| Nintendo 8 numeric
|
| Login.gov 12 alphanumerics
|
| Gitlab 16 hexadecimal
|
| I'm sure some fool somewhere used a six digit numeric
| "recovery code" but the usual, while it isn't 40 is
| certainly more than 6.
| MiguelX413 wrote:
| Most services I use give several 6~8 digit recovery
| codes, I've never had discretion with them. I have no
| idea what they're talking about.
| chrisseaton wrote:
| > Most services I use give several 6~8 digit recovery
| codes
|
| Well RubyGems itself, subject of this post, has 12 for a
| start.
| filmgirlcw wrote:
| I use a password manager to store my credentials, TOTP codes
| and stored secondary codes. Yes, that does make my password
| manager more of a risk, but for that reason, I use a strong and
| unique password for the password manager, have a password
| manager that has its own security key that is required for
| access from new devices, etc.
|
| When I transfer phones, all that stuff comes with me.
|
| For worst case scenarios, I have a few spare YubiKeys setup
| that I can use in the event that something goes haywire. And in
| a safe deposit box, I have a YubiKey and a printed out copy of
| my 1Password emergency kit. So that if someone drives into my
| house and it burns down, I do have an option.
|
| But I agree that this is a lot of stuff to keep track of.
| That's why I'm glad that Passkeys are being adopted by the big
| players (Apple, Microsoft, Google) and that we'll see consumer
| rollout of this sort of thing, which should make this a lot
| better.
|
| There's no such thing as a system without a threat model -- and
| biometrics can be imperfect, but I'm much more comfortable with
| that or even relying on my current MFA setup than I would be
| using SMS 2FA or no 2FA!
| dsabanin wrote:
| Check out the Authy app. It lets you have an encrypted backup
| with which you can restore the MFA codes on another device.
| Another option is using a password manager with MFA
| capabilities, like 1Password.
| devoutsalsa wrote:
| I've used Google Authenticator, Authy, and 1Password.
| 1Password has been far superior in my experience, the only
| downside being that it is a paid subscription, which won't
| work for everyone. My 2nd choice would be Authy.
|
| Entertaining related story... a few months ago, I tried
| signing up for Celsius, the crypto exchange that went
| bankrupt. Their sign up process required MFA, and for some
| reason the only app they supported was Authy. Unlike most any
| other site, instead of giving you a QR Code to scan, Celsius
| would do something weird where they have some sort of push
| message mechanism that's supposed to initiate the MFA setup
| process from within the Authy app. I never did get it to
| work. I have a personal rule that if the signup/signin
| process for a service is too arduous, I simply won't use that
| service if I have viable alternatives. So I didn't lose any
| crypto in the Celsius bankruptcy because their MFA signup
| processes sucked.
| _joel wrote:
| I have 1password too but that seemed a little incestuous to
| have the password _and_ the TOTP in the same app, it 's not
| exactly MFA. I use Authy, personally, with backups and
| encryption.
| jibe wrote:
| I have the same 1Password / Authy setup, for the same
| reason. But I have my Authy password in 1Password, so it
| is kind of an illusion of extra security. I'm strongly
| considering moving it all into 1Password at this point.
| _joel wrote:
| Thankfully I can just about remember 2 passwords :)
|
| Also you can use biometrics in Authy, fwiw. Then write
| down the password and put it in a safe. Then there's only
| 1 to remember but you can use biometrics in 1password
| too, so unless your threat model includes someone using
| your freshly chopped thumb then it should be ok.
| miohtama wrote:
| Two-factor reset is usually a slow manual process where the
| service provider checks that you are who you really claim to
| be. It is not automated so that it cannot be abused.
|
| If you have 50 two-factor authentication tokens you can use
| apps like Authy that allows you to do a local or remote back up
| of the tokens. TOTP is an RFC standard and you will find lots
| of apps for advanced users.
| MiguelX413 wrote:
| Services often give recovery codes too.
| __s wrote:
| Services usually offer a tokens which should be saved somewhere
| in order to reset 2FA. I agree, requiring users to keep tokens
| for every service is painful (see how many people had trouble
| not losing their btc keys when btc wasn't particularly
| valuable)
|
| I've only gotten a new phone once. Was android to android. I
| was able to transfer everything from the old phone to the new
| phone as part of setup process
|
| Granted, yesterday I had some trouble: my phone service failed
| to process a payment, so they disabled my service. Meanwhile I
| couldn't go in & review my bank info because I needed 2FA in
| order to login.. To make matters worse, the bank told me I
| needed to call a number for Loss Prevention Services to
| reenable sending money out of my account, & made me run around
| a bit looking for pay phones (surprise, they were out of order)
| before they let me use their phone
| Hendrikto wrote:
| > Services usually offer a tokens
|
| In my experience, "rarely" is more accurate than "usually".
| seized wrote:
| For SMS 2FA maybe, but I've gotten between one and ten
| codes for every service I've enabled proper TOTP 2FA on.
| em-bee wrote:
| what can you do now to prevent this from happening again?
| 1123581321 wrote:
| It's a good question. A lot of 2FA apps have manual
| backup/restore functionality. Some have cloud sync (e.g. iCloud
| sync so your new iPhone has the same app and codes, or
| 1Password/Bitwarden which has you log back into the app on the
| new phone with their service login.) These 2FA syncs can be a
| point of weakness so not everyone uses them.
|
| The services themselves (rubygems etc.) also provide a short
| list of one-time account recovery codes. You're supposed to
| essentially print them and put them in a safe. I wonder how
| many people both keep those codes and keep them somewhere
| secure...
| evolve2k wrote:
| Authy for example enable you to have a cloud backup -
| https://authy.com/features/backup/
|
| 1Password offers MFA and would still be available on your
| other devices if you lost your phone. As to if storing
| passwords with MFA codes is fine or a problem, I'll let
| smarter people than me decided what's best practice.
| 1123581321 wrote:
| Ah, yes. Authy was the iCloud one I was thinking of. IIRC
| they provided plenty of warnings about the tradeoffs of
| enabling that.
| JoaoCostaIFG wrote:
| Apps like the Microsoft authenticator and freeotp+ allow you to
| backup your codes. With freeotp+, you can export the codes as a
| json file and import them in another phone in case something
| happens. With the Microsoft one, you save the codes in the
| cloud (your Microsoft account).
| Avamander wrote:
| Are there any good and not ugly TOTP apps on iOS that have
| export/import functionality?
| otachack wrote:
| I use andOTP on Android and it has a backup feature that
| exports all your registered 2FAs into a file which you can
| import to another andOTP install. You can also export with a
| password on that file so it's encrypted.
|
| Other 2FA apps have backup options like Google Authenticator or
| Microsoft Authenticator. Bitwarden, if you pay for premium,
| gives 2FA as a feature and they just handle those codes. Just
| don't register Bitwarden 2FA under itself :D
| [deleted]
| MiguelX413 wrote:
| I use the TOTP feature of Bitwarden! It syncs across all my
| devices including desktops. It's very nice.
| striking wrote:
| Your second factor could be whatever you want it to be. Phone
| app, keyfob, TOTP program running on your machine. Many
| services allow for multiple options.
|
| Most 2FA apps have a convenient "move all of my codes to
| another device" function, offer online sync, whatever.
|
| And even if they didn't, every service provides recovery codes
| that you could use in case of an emergency, should you need
| access to some service and all else fails.
| ctrlmeta wrote:
| Genuine question - Which keyfobs support scanning QR code
| presented by an online service to add the TOTP seed and then
| generate TOTP codes?
|
| Any cross-platform recommendations for TOTP program that
| works on Windows, Linux, Mac?
| rgoulter wrote:
| QR code scanning is intended for mobile phone cameras as a
| way of communicating a TOTP secret.
|
| When presented with a TOTP secret, every website I've seen
| has presented the option to show the TOTP secret as text,
| which can be copied across.
|
| A password database like KeepassXC can store the TOTPs.
|
| FIDO / U2F hardware like Yubikeys (or various alternatives)
| are also a convenient second factor.
| striking wrote:
| You type the seed in. Services almost unilaterally give you
| the option to get a seed code instead. Even if they don't,
| you can scan the QR code and get the seed out of it.
| adamgordonbell wrote:
| As others are saying, you can store your TOTP code in a
| password manager, and if you lose you phone re-add it. You can
| also use something like oathtool do generate these one time
| passes at the command line.
|
| I had a similar question and wrote up how I'm doing it here:
|
| https://earthly.dev/blog/multi-factor-auth
|
| Oathtool:
|
| https://www.nongnu.org/oath-toolkit/oathtool.1.html
| tomjen3 wrote:
| I personally just put them in my bitwarden, which syncs with
| all logged in devices.
| zerkten wrote:
| Many services seem to offer one-time codes for storage offline
| in case this happens. Authy can working across multiple
| devices, but that probably has some security ramifications.
| Based on https://apple.stackexchange.com/questions/305372/will-
| my-goo..., you are able to restore Google Authenticator from
| iCloud.
|
| This is the usual security versus convenience problem. The site
| is forcing you to use an additional factor, but there is
| flexibility in how that is serviced. Choosing convenience may
| open paths for attackers, but the impact depends on your threat
| model.
| londons_explore wrote:
| Oauth would fix this...
|
| If only everyone would use Oauth rather than hiding it behind
| 'enterprise' plans...
| clintonb wrote:
| How exactly is OAuth a solution to MFA? You want everyone
| to run their own OAuth provider? Will the OAuth provider
| support MFA?
| ValentineC wrote:
| >> More and more services are moving towards 2FA/MFA. The 2nd
| factor is in a phone app. What happens if I lose my phone?
| Without my old phone I cannot log into the services. How do I
| get access to my accounts again? How do I move the 2FA setup
| to new phone again? Do I have to do this one by one for all
| 50 2FAed services I use?
|
| > Many services seem to offer one-time codes for storage
| offline in case this happens.
|
| Adding on: even password managers like 1Password [1] and
| Bitwarden [2] offer support for TOTP 2FA now.
|
| [1] https://support.1password.com/one-time-passwords/
|
| [2]https://bitwarden.com/help/authenticator-keys/
| nisegami wrote:
| The irony is of course that you're now back to a single
| factor if you store your TOTP secrets in your password
| manager.
|
| But a good single factor is probably fine.
| worble wrote:
| To be honest, the most likely surface of attack for a
| user are database leaks. So long as your password manager
| is uncompromised, even if someone does manage to get
| ahold of your username/password for a specific site they
| won't get anywhere.
| giaour wrote:
| It's only a single factor if your password manager login
| is compromised. If you're instead the victim of a
| phishing attack or you somehow spill the password + an
| MFA token for a single service, then you still get some
| of the protections you would expect from MFA (e.g., the
| leaked login will be time-boxed and non-renewable).
| ghaff wrote:
| I agree but how many people who have 2FA from Google for
| example have a printed out list of numbers? You can have
| multiple authentication devices but, again, how many people
| have this? And it's certainly _very_ easy to be traveling and
| not have backups with you.
|
| One solution with Google at least is that they basically
| hardly ever require you to reauthenticate on a given device
| but that obviously doesn't help if the device in question
| breaks or is lost and is also your soft token.
|
| As you say, not an easy problem. The happy medium depends on
| the threat model and is somewhere between being able to
| easily social engineer new access and having to show up in
| Mountain View with a sheaf of notarized proof of identity
| documents.
| njarboe wrote:
| I would like to have the option of only needing the
| password and no password reset unless you visit an office
| somewhere in person. For like Google, banks, brokerages,
| etc. But maybe that is less secure than two-factor online
| systems? Seems like it wouldn't be.
| tialaramex wrote:
| It is, in fact, less secure than what we should have been
| doing for at least 5 years.
|
| You are able to give away your password to bad guys, it's
| really easy because it's exactly like just using the
| password normally except whoops this was my-bank-
| login.example and not my-bank.example/login or login.my-
| bank.example or whatever the URL usually was.
|
| WebAuthn fixes that, everybody should implement and use
| WebAuthn. To their partial credit RubyGems apparently
| noticed they ought to do this, and so this message says
| they're working to implement it.
| ghaff wrote:
| Having to present physical, hard/expensive to reliably
| forge, government-issued ID at a reputable institution is
| a pretty good filter against most fraud. It's also a
| headache even if you live somewhere with a local branch
| of your bank.
|
| I tried to do this during the pandemic and the local bank
| branch didn't have anyone who could give me the right
| authentication so I had to spend a couple hours going to
| my local brokerage office to complete a transaction.
| Tainnor wrote:
| > And it's certainly very easy to be traveling and not have
| backups with you.
|
| It's also "very easy" to be traveling, lose your passport
| or ID and not have a backup with you. Or to accidentally
| leave your house and forget your keys inside. Or any other
| number of comparable scenarios.
|
| When that happens to you, it sucks, and you will have to
| jump through hoops. But still that doesn't mean that
| passports and keys aren't valuable in terms of security.
|
| Of course, the difference is that people understand the
| value of passports and physical keys, but by and large they
| fail to grasp the importance of IT security or how to
| protect themselves. This is, ultimately, an education
| problem. But we don't have the same internet anymore as 20
| years ago, and the problems associated with identity theft,
| unauthorised access, etc. are much bigger than they were,
| so we can't afford to be too cavalier about it anymore.
|
| Maybe, if people get locked out of their google account
| because they lost their recovery keys, they will in fact
| learn that, yes, they should have printed out their
| recovery keys (something which you are prompted to do), or
| stored them in an otherwise safe location (e.g. password
| manager).
| throw0101a wrote:
| > _When that happens to you, it sucks, and you will have
| to jump through hoops. But still that doesn 't mean that
| passports and keys aren't valuable in terms of security._
|
| Except there may not be any hoops to jump through with
| MFA if it is "too secure". See "I've locked myself out of
| my digital life" (a thought experiment):
|
| * https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-
| of-my...
|
| * https://news.ycombinator.com/item?id=31652650
|
| > _Maybe, if people get locked out of their google
| account because they lost their recovery keys, they will
| in fact learn that, yes, they should have printed out
| their recovery keys (something which you are prompted to
| do), or stored them in an otherwise safe location (e.g.
| password manager)._
|
| Except at that point it could be too late and they've
| lost all access to their digital life/assets.
| filmgirlcw wrote:
| Passkeys (the new thing from the FIDO Alliance that Apple,
| Google, and Microsoft all support) will help with this a
| lot.
|
| Apple is going to start rolling this out in iOS 16 and I
| expect many sites and platforms to implement support
| relatively quickly. It'll take time for this to work its
| way through the ecosystem and there will still be some
| trade-offs that will lake someone complain, but this is one
| of the more promising initiatives in the "passwordless"
| world that many security professionals have been striving
| for for quite some time.
|
| I do think that when it comes to software/package
| maintainers, the heavy lift of having to have an MFA
| solution is much smaller than for a regular user. Yes, you
| need to store your one-off keys somewhere safe (I use a
| password manager and store it in an encrypted file there
| whether that counts as a second factor or not is debatable,
| but I think the fact that my 1Password account requires an
| account key as well as my password when accessed from a new
| device helps protect against unauthorized access at least),
| but I do think this is an acceptable trade-off (for now) if
| you're maintaining a popular OSS package.
|
| Maintainers have to do a lot of janitorial work, it's true.
| And it does often fee unfair. But I don't think asking
| people who maintain popular projects to use MFA for their
| package system is too much.
| 8organicbits wrote:
| You got lots of answers about proactive approaches to the
| issue. In cases where you didn't do those, you'd contact
| support. If it's a bank account, they ask you security
| questions and then reset/remove MFA. I've done that over the
| phone while out of the country once. If they don't have
| support, or their support doesn't have an alternate authN
| approach, you could be locked out.
| [deleted]
| ylg wrote:
| Note that TOTP is not limited to a single authenticator. You
| can, for example, scan the same TOTP setup QR code once with an
| app on your phone and again with a different app on your laptop
| (or scan in one and paste the code in the other).
|
| I use this approach with Yubico Authenticator, which stores its
| data on Yubikeys, so I have all 2FAs on at least two keys even
| with TOTP-only services that seemingly allow only one
| authenticator per account, e.g., AWS.
| czbond wrote:
| Thanks for sharing that, I did not know it.
| londons_explore wrote:
| You can also screenshot the barcode and use it years later
| if necessary.
| ufmace wrote:
| Every service that I've seen that uses TOTP 2FA will also give
| you a list of fixed backup codes and strongly encourage you to
| keep them somewhere safe. There are also TOTP apps that will
| let you make a backup of your codes, to also be kept somewhere
| safe.
|
| Of course it's the user's responsibility to actually keep
| backup codes somewhere where they can definitely be accessed in
| case the phone is lost and also can't be stolen easily. Ditto
| for a app backup. Sounds straightforward, but easier said than
| done.
| alain_gilbert wrote:
| Funny thing that happened to me recently.
|
| I'm having a prepaid plan with att, and I did not pay it for a
| while. Recently I needed to get a text message so I went on the
| att prepaid website to reactivate the plan for the month so
| that I could get the text message.
|
| Guess what. The att website wants to send me a text message to
| ensure that I am the owner of the account... to my phone...
| that has no plan... fun times!
| messe wrote:
| The weird part about this, as somebody outside of the US, is
| that you need to pay to _receive_ a text message.
| anonymoushn wrote:
| What country do you live in, and what's the process for
| being assigned a phone number that can receive text
| messages without paying anyone for a phone plan? Does the
| government have an office where you can show your ID and
| get a SIM card for free?
| kuschku wrote:
| Steps to reproduce:
|
| 1. Buy a sim card from ALDI for 10EUR 2. Activate 3. Use
| the phone until the balance is down to 0EUR
|
| At this point you've got an empty balance, are unable to
| make calls or send texts, but you can receive calls or
| texts still just fine. You can also visit zero-rated
| websites (in the past e.g. 0.facebook.com).
|
| When I was a child my parents would give me a phone with
| a SIM card in this state, they could still call me if
| they needed to tell me to come home, and I could still
| call the emergency services, and given WiFi I could surf
| the open web as well, but I couldn't waste money on paid
| services or calls.
| deelowe wrote:
| You keep saying this, but it makes no sense to me. How do
| you receive text messages with a phone that's not active?
| How does the phone have service?
| messe wrote:
| If I were on a prepaid plane, and I didn't top up, my
| phone would still have an active SIM and phone number. I
| would still be able to receive calls and texts.
| ghaff wrote:
| That _may_ be true but it 's not obvious it would be.
| Certainly in times past in the US receiving calls/texts
| could incur charges.
| messe wrote:
| > Certainly in times past in the US receiving calls/texts
| could incur charges.
|
| That's why I originally said it was weird to me _as
| somebody outside the US_.
| ghaff wrote:
| It dated to mobile calls being expensive especially
| outside of a very bounded home area and being either a
| business expense or a relatively luxury thing. In that
| context, it didn't really make sense to hit a landline
| with a big charge for calling a mobile number--perhaps
| unwittingly. And that general thinking carried over to
| SMS.
| paulmd wrote:
| SMS is part of the service frame - every time your phone
| talks to the cell tower to go "here I am, I am IMEI 12345
| and I have sim ABCDE!" there is a 160-character frame for
| it to send a SMS message, and every time the tower goes
| "hello IMEI 12345/SIM ABCDE, I see that you are in cell
| ZXCV!" to track your equipment's location, there is a
| 160-character frame for it to send a SMS message to your
| phone.
|
| Well, we can't just trust your phone that its plan is
| valid, so there is also a service frame where the tower
| says "Sorry 12345/ABCDE, your plan is inactive!" that
| uses the same frame... and it has a 160-character frame
| for SMS too.
|
| SMS is literally free for providers to implement, it is
| just an inherent part of the phone's ping/pong process of
| talking to towers. So there is certainly no requirement
| for an active plan of any kind. As long as your phone is
| on the network it is notionally capable of sending or
| receiving an SMS, the provider just won't let it... but
| usually service messages ("your plan is inactive, go to
| this website to top up!") will be allowed.
|
| This is on top of emergency service - 911 calls (or local
| equivalents) will work regardless of plan status.
| Actually I'm not even sure you need a SIM card at all, or
| if that can be done simply by IMEI...
|
| Basically: just because a sim doesn't have an active
| plan, doesn't mean the SIM or the phone isn't active
| itself. There is still information interchange happening,
| and that carries SMS frames.
| dathos wrote:
| Receiving messages is free, so as long as you have a
| prepaid card that hasn't been deactivated (not using it
| for a year is usual with my provider) you can receive
| text messages without paying.
| dmurray wrote:
| The phone has a SIM card, and a phone number, as
| evidenced by the fact that he "did not pay it for a
| while" rather than never having had a plan. So the phone
| is active and can connect to the network and authenticate
| with a base station and attempt to make outgoing calls.
| Those attempts will be rejected by his phone provider.
|
| Incoming texts will also be rejected and not delivered.
| In other countries (I know about Ireland, anyway) this
| isn't generally true.
| alpaca128 wrote:
| As somebody else outside the US - where is this different?
| Without a connection you can only make emergency calls,
| receiving anything is impossible when your phone doesn't
| have a number without an active sim card.
| messe wrote:
| Except they did have an active SIM on a prepaid plan,
| that hadn't been topped up. In a situation like that I
| would still be able to receive calls and texts, just not
| make them.
| DangitBobby wrote:
| Did you try it? You might be able to receive messages from
| certain numbers.
| messe wrote:
| Needing to pay to receive texts is utterly alien to me.
| ghaff wrote:
| They're talking about being able to receive texts
| _without_ having a phone plan. Also, the (now) norm of
| texts being free in the US with most phone plans is 1.)
| relatively recent and 2.) not the case everywhere else.
| (Hence, the popularity of Whatsapp etc. outside of the US
| --where it 's uncommon for those who don't text
| internationally.
| cortesoft wrote:
| What? You can get texts to a phone without paying your
| phone bill?
| londons_explore wrote:
| In most countries outside North America, if you don't pay
| the phone bill you can still receive texts and calls. You
| just can't make calls, send texts or use internet.
|
| The same applies to prepaid cards - if the balance hits
| zero, you can only do incoming calls and texts.
|
| Obviously, the provider will still send debt collectors
| if you were on some fixed price per month plan, and those
| debt collectors will still try to collect moneys for the
| months the service didn't allow outgoing calls... I
| always thought it odd that a company was allowed by law
| to collect money for a service they didn't provide.
| messe wrote:
| Yes, if I'm on a prepaid plan? If I didn't top up, my
| phone would still have an active SIM and phone number. I
| would still be able to receive calls and texts.
| netzvieh wrote:
| In Germany at least you (can) buy a prepaid sim card and
| activate it. That gives you a phone number and you
| usually get the price you paid for the sim card added to
| your account balance. From then on you don't have to pay
| anything to keep using that phone number to receive
| calls/SMS. Calling/sending SMS costs are coming of your
| balance. You can buy packages (usually good for 4 weeks)
| with e.g. 300MB data volume or unlimited calls.
|
| There's also the model where you pay a monthly
| subscription and receive a new device every few years or
| have some other benefits.
| alain_gilbert wrote:
| Maybe they completely deactivated the sim card, I don't
| really know. The phone just doesn't even connect to a
| network anymore.
|
| In which case, I wonder if I actually just lost my phone
| number altogether(?)
| jacobsenscott wrote:
| Most services should have a fallback. Often it is just emailing
| you a code, or texting a code to a phone number. This is
| because true, strict MFA would become a customer support
| nightmare - half your users would be locked out from day one.
|
| Also realize you can use more than one 2fa device. At the step
| where it asks you to scan a QR code, you can scan it on
| multiple devices.
|
| Also, you don't need to use a phone to store your codes.
| 1password can do this for you, and then your codes are
| available anywhere you are logged into 1pw.
|
| The google authenticator app allows you to transfer your codes
| to another phone, but you need to remember to do that before
| wiping your old phone.
| tzs wrote:
| What I'd like to see is for sites to allow setting up two
| different kinds of 2FA, one of which is TOTP and the other is
| something hardware-based.
|
| TOTP has some limitations which make it not as secure as the
| better hardware-based approaches. For example if you get fooled
| into trying to login to a phishing site and the real site uses
| TOPT, all the phishing site has to do as ask you for the TOTP
| code. TOTP in this case only protects you from getting phished
| if the phishing site is just logging credentials for use later
| use. If they are going to use your credential right away it is
| no protection.
|
| If a site allows both TOTP and a hardware-based system though
| you can use the hardware-based system normally, and only resort
| to TOTP if the hardware is lost or broken, and stop using TOTP
| as soon as you can get replacement hardware enrolled.
|
| For TOTP when you are setting up and the site gives you the QR
| code, scan that in TOTP apps on your phone and if you have one
| on your tablet. Also save a copy of the QR code somewhere safe.
| I save an encrypted copy on my desktop computer. If you ever
| change phones or tablets, you can scan the QR code again.
|
| Some sites will also give you the TOTP key in text form. Save
| that somewhere safe and you can use it with command line TOTP
| tools such as oathtool [1].
|
| [1] https://www.nongnu.org/oath-toolkit/oathtool.1.html
| woodruffw wrote:
| > What I'd like to see is for sites to allow setting up two
| different kinds of 2FA, one of which is TOTP and the other is
| something hardware-based.
|
| This is exactly what we did for PyPI: we allow the user to
| enroll as many 2FA factors as they'd like, of both supported
| types (TOTP and WebAuthn).
|
| The post is dated 2019, but the summary of practices we wrote
| here[1] is still relevant (and IMO, correct).
|
| [1]: https://blog.trailofbits.com/2019/06/20/getting-2fa-
| right-in...
___________________________________________________________________
(page generated 2022-08-16 23:02 UTC)