Hacker News Reader

Comment by saganus | Hacker News Reader

Wow.... wtf? I'm guessing someone just dropped the camera on a desk without realizing it was on... but still... holy cow...

Edit: I guess you are right. It does seem a bit improbable that you would get such a good reading on the numbers. Definitely scary as fuck...

View on HN

No, this was probably intentional. When there is security, especially corporate mandated, people will find a way to work around it to gain efficiency.

Microsoft makes me/us do 2FA ~5-20 times a day, doesn't support U2F and implements 2FA in a way that forces you to type a PIN into the phone rather than the other way around (massive phishing hole they don't seem to care about - sometimes I'll be flooded with 2FA prompts and have no idea which ones were initiated by me or by an attacker).

I've joked about writing an app on my phone that would just auto-respond to all the 2FA prompts with my PIN, and have been told that other people actually tried to (or did) implement such an application.

Meanwhile I was at a Googler's place a year ago and watched him tap a U2F device on the side of his laptop to complete the second factor. Sigh.

How does MS make you do 2FA 5-20 times a day?

You mean you work there and accessing services or tools requires you to do 2FA every time?

I hope they are already planning to overhaul that because it does seem like a very cumbersome and insecure way of "securing" accesses.

You are probaly referring to https://www.yubico.com/

I just bought one the other day for personal use, pretty cheap, cant say more becuase I have yet to receive it, but I have high hopes.

I've had one for about 6 months that I use for gmail. I like it, easy to set up, works pretty much out of the box, security story seems reasonable, and device is physically pretty sturdy so far.

For at least 2 linux boxes I use, I needed to add udev rules for the yubikey. That wasn't immediately obvious and took a few minutes to figure out why it wasn't working.

I'm a fan. It would be nice if there was more support. I can use it on gmail, github, and dropbox. I'm not aware of any other online services that support it (that I use)

If you work for Microsoft (I do) that doesn't sound right. There are times when I get 2FA but not often on my work machine. Microsoft employees get a smart card and if your machine has a TPM chip you can create a virtual smart card accessed with a pin or biometric factor like fingerprint or Windows Hello.

I don't use Windows except when interacting with the 15 year-old payroll time entry system. I have nothing nice to say about support for non-Windows users, though most of that is unrelated to 2FA (though supporting U2F would sure be a lot more friendly than proprietary apps that surf on top of the TPM)

No a fan of Microsoft systems, but they have GS-API/Kerberos and AD FS 3. Unix users will want SSH key management, but apart from that, Microsoft made efforts to help people spread single sign-on to much of their infrastructure.

If your payroll system has a web interface, you can have an applicative firewall in front replay your stored credentials as a hacky SSO (after checking your identity another way, of course).

The payroll system, as well as security group / mailing list systems are all completely useless in anything but IE (not even Edge).

And Kerebos does nothing for these 2FA woes sadly.

in a way that forces you to type a PIN into the phone rather than the other way around

Could you explain more what you mean by this? Presumably it's not typing a phone into a PIN...?

Usually you copy a OTP from the phone to the application you're trying to use.

We use Okta at work, and we can either put in a six-digit code, or we can prompt the webapp to push a request to our phone, and then click "accept" or "deny" (after unlocking the phone, of course.)

Okta at least shows which app is requesting permission.

What closeparen said. Normally the phone gives you the PIN and you type it into the application you just signed into. Gives you some amount of assurance that the second-factor is going to the desired party.

Instead, MS's 2FA send a notification to your phone where you type in a static, pre-defined PIN. There is no way of knowing what actor or application triggered the 2FA request.

What's absurd is that there is an RSA iphone app now...

Seems intentional to me. They just don't want to carry the keychain around.

I've heard of this being done because many people are sharing the same 2FA login.

Reply on news.ycombinator.com