Bypassing 2FA – Secret double octopus [2019] | Hacker News Reader

Bypassing 2FA – Secret double octopus [2019]

doubleoctopus.com

21 pointsrolph21 comments

Not sure what's up with the cookie banner on this site: "This website uses cookies to improve your experience. We’ll assume you’re ok with this, but you can opt-out if you wish." There are two buttons, "Accept" an "Read more". "Read more" is just a link to google.com (not even a search string) which feels really condescending.

I love it... but I didn't see it until I unblocked JavaScript... they are probably just laughing at the current mess.

There should be a better solution for 2FA now especially with cryptocurrency all the rage now. Like a small waterproof chip that can be attached to your skin (maybe upper elbow) with an RFID. Why hasn't such a product been invented yet?

Currently there is the YubiKey, Ledger, Trezor, which all cost $25-70. Just for a USB that can generate a OTP (I'm oversimplifying but does what they do really cost $50?). Then there is Duo mobile for phones, which may be slightly less secure but is probably better for most cases. But both suffer from the situation where you can lose your key.

2FA isn't inherently insecure, and hardware tokens are not that much better IMO than an encrypted USB drive. I agree $50 is too much for a glorified USB drive with tamper-resistant chips. Prob could achieve near the same thing with some hot glue. I'm on the same page though, the issue with hardware tokens is that they can easily be lost thus causing you potentially to lose access to accounts or make replacing the token on your account way more difficult.

You are supposed to have multiple hardware tokens all enrolled so you have backups.. but the hardware tokens are a bit pricey and several implementors have failed to read the spec and only let you enroll a single token.

I will ask, as I always do, for a list of these "several implementors" who don't obey the WebAuthn spec. Note that even if dozens of you say "AWS" that's just one bad implementation, not several.

I'm assuming you're someone that uses some sort of hardware tokens--if not, ignore this.

How do you manage your tokens with WebAuthn? I have several but I've never really used them as much besides a repository for TOTP tokens because I just can't wrap my head around it.

So I've got one I leave in my device, another I leave laying around the house as a "backup", and another I'm supposed to keep secure off-site somewhere.

I register a new account. What's the process?

Register on the one I've got in my device because of course. Then go dig out my backup token and add that to the account. Then... ?

Pull out a journal and write down the account I've created, swing by the bank once a week/month/quarter to swap my on-site backup for the off-site, go back through my journal and find every account I've created during that time period and enroll the new backup token?

What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone?

This is easily mitigated with TOTP--just put the TOTP secret into a separate keepass file. As soon as I've registered it's backed up off-site. I'm very risk averse in this area, so I just can't see a path to using webauthn that makes any sense.

> What happens if my house burns down during the week/month/quarter I've registered a new account? Is that account just gone?

Well no, the account is still there but you can't access it.

I'd be pretty happy with the outcome where a major disaster's most annoying effect is "I lost my HN karma" or "I have to make a new GitHub account, although all my existing code is still available to download". Maybe your house burns down a lot, but most people go decades without that happening, so, it's OK if it sucks pretty badly when it happens.

I'm not comfortable losing everything. But most of the entities who have a relationship I need to stay alive after a major disaster are already used to this in other cases. I am not going to be the first account holder at my good bank whose worldly possessions were all destroyed in a house fire. It may take a few days, and a lot of inconvenience, but hey, my house burned down so I think the inconvenience isn't the worst part of the scenario. Even Google promises (vaguely) to make it possible for you to recover access to your account with them, despite using WebAuthn, in the event of such disasters.

The government is another example. Ordinarily they'd prefer I used WebAuthn (actually they seem unduly keen on SMS, but I use WebAuthn) but if my house burned down they can see their way to consulting their database of e.g. photographs of me, records of where I live (oh, the place that burned down well that makes sense) and so on instead to confirm my identity manually.

Edited to add:

You know what, people vary. Maybe you can never be comfortable without setting up TOTP "just in case". Fine. But what I suggest to you is: Don't actually use it. The phishing protection of WebAuthn is effective even if you have TOTP setup so long as you don't let the phishers persuade you to use TOTP. Keep TOTP for when your house has burned down, and all the rest of the time you have that protection.

You do lose some other WebAuthn benefits (e.g. bad guys can steal all the other credentials, passwords, TOTP secrets, SMS codes, from e.g. a server break-in, but it doesn't mean anything to steal your WebAuthn credentials because the relying party doesn't have any secret credentials, that's the whole point of the design) but phishing is the #1 win

This is my opinion as well. TOTP info can be encrypted, many programs offer phishing protection for TOTP tokens. I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well.

> I just don't see the value of hardware tokens where the hardware token can be compromised, and the credentials to access them can be as well.

What sort of compromises are you envisioning here?

> Why hasn't such a product been invented yet?

The YubiKey Nano is really small. I'm sure a skilled piercer could find a way to get it under your skin.

The YubiKey's that support NFC are all significantly larger. The Nano does not currently support NFC. Size is a challenge with NFC specifically as I believe larger NFC chips lead to larger area of allowable communication.

You have your elbow close to your laptop anyways... might as well plug in.

The FIDO (and at this price you're probably buying FIDO2) authenticators aren't generating an OTP, they're doing public key crypto to prove they're the same key as you enrolled.

There have been several open hardware designs in this space, so if you can do a lot better that seems like you should go into business.

And since you mentioned phones, a nice modern phone, with a fingerprint reader or similar, is also a Security Key for this purpose anyway. Google even have a prototype for the scenario where your (Android) phone is a valid Security Key, your desktop or laptop with Bluetooth and Chrome can see it nearby, so it lets you authenticate from the phone for desktop web pages.

Beware of paid, proprietary solutions to security problems claiming to be "the only passwordless solution offering seamless, mathematically unbreakable authentication that doesn’t require humans to come-up with, manage, memorize or input passwords". Free tools like SQRL exist, which uses elliptic curve public key crypto instead of passwords, and no doubt other solutions also exist.

They do get credit for having a really cool company name. However—and I know this is picky—if I see the word “authentification” multiple times on the site map it does not fill me with confidence.

Saas Pass has had a passwordless authentication solution available on the market for almost a decade. The future has arrived. It is just not evenly distributed yet.

- Disclaimer: Worked on UI and UX stuff

How does it work?

You can scan an ecrypted barcode or through push login or other methods. There is more at the developer site.

Is this basically what Discord does with it's web/desktop client?

Note that push login is vulnerable to one of the phishing attacks described. User goes to fakebank.example, attacker goes to realbank.example, user types in their username, it is pasted by attacker, the user gets a push login request, "Hey are you trying to log into Real Bank?". Yes, says the user, of course I am, and they let the attacker into their account.

WebAuthn fixes this, by having the web browser take responsibility for the thing humans are bad at. Is this, in fact, realbank.example? No, it's fakebank.example. Attack failed.

Reply on news.ycombinator.com