Hacker News Reader

Comment by donw | Hacker News Reader

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well.

I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices.

For your critical services, keeping encrypted copies of your backup codes is a must.

View on HN

I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now.

The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which I cannot disable) prompting me to backup every time I use the app. I don't know why they are so determined to get hold of my OTP keys, but it isn't happening.

I'm currently using an app called "OTP Auth" and it seems quite nice, and is quick to use.

a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely

I would recommend testing theories of :

- losing phone

- losing computer

- losing both

and have reasonable backup strategies for these scenarios.

I use Google's authenticator on my phone and a 50-line python script on my desktop PC. I store the OTPs in a JSON file and the python script runs them through the TOTP algorithm and spits out my 6-digit code on the console.

I'm less worried about losing my "computer" since I don't own a laptop, plus the secrets are backed up using my normal backup process.

A good 2FA system involves backup keys which can be stored in a safe or safety deposit box, not handing your private key over to a third party.

Isn't that the point of having backup codes for Google, etc.? I can use those to restore my account, and secure them however I like.

Backing up the secrets to a third party makes them vulnerable to anyone who can hack your Authy account. I'm not sure what that requires, possibly hacking a phone number. Of course, there's also a backup password, but then you're just replacing the "physical" factor in 2FA with another password.

Without Authy, to compromise my account, you need physical access to my phone, my backup codes, or another backup mechanism I've specified. Authy just provides an additional way to compromise my account, and I don't think it provides any real benefit in exchange for that risk.

You should have the backup codes stored somewhere more secure than your computer either way, quite possibly printed out.

> the app tries to get me to backup my keys to their servers

That's the idea for using Authy.

2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec. Sometimes a lot longer (some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time, and then you have the time it takes to find your phone, unlock, decline twice the iOS update prompt, go to the right app, find the right msg, copy the code, check it is correct, etc etc).

Yeah if it is really a critical service and rarely used, we should. But if I have to wait 30sec in front of a login box every time I go on netfix or on amazon, you can bet their sales will go down the drain.

I have my 2FA in Notification Center and consider this fine given that it's second factor. With that, it's about eight seconds for me involving one slide of my finger. I'm also mystified that you think support for 2FA and mandatory 2FA are the same thing, particularly for something like Netflix.

I am not arguing about support vs mandatory. Just that I am not convinced 2FA is a compeling alternative. At least the way I see it implemented.

I like the idea behind SQRL, which still requires another device, so still inconvenient, but at least it does not rely on the server sending a message through a slow protocol. The website displays a QR code, you launch an app, scan the QR code, this app connects to the server and authenticate you through cryptography. No login or password to type, no message to wait for or to copy manually. No privacy concern since it does not rely on a third party. I could live with that.

If you're discussing sales, you are arguing mandatory.

Duo is the counterpoint to 2FA being cumbersome.

2FA doesn't have to be done over email/SMS. Nearly all websites these days support Google Authenticator protocol enabling use of a wide race of app/devices (for example my Garmin watch) to produce the code. No need to wait for an email/SMS.

Most services have the option of remembering your 2FA authentication on a certain device. For example, I have to enter my LastPass password in my computer to login, but I only have to use 2FA if I'm logging in from a new device.

> some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time

SMS isn't real time either, it's best effort. Mostly (~99,9%) it gets through within seconds, but delays of a few minutes are perfectly acceptable to telcos. As service provider you can't do much about it, either pay through the nose for "priority" delivery (which maybe halves the amount of delayed messages in our experience) or tell your customers to switch mobile providers (yeah, good luck with that).

As a service provider there is something you can do about it: Use well known out-of-band 2FA specs such as TOTP. Those are compatible with Google Authenticator and don't require a phone number, which is a massive inconvenience (not always available, not available in every country, SMS not reliable, requires an ID, not free, leaks personal information to the service provider, ...)

Well, yeah. We're not using SMS for 2FA, just for delivering monitoring alerts. With those reliability statistics (and the impossibility to improve it) I wouldn't do SMS-based 2FA at all.

We've found other interesting behavior in email-to-SMS services using it for alerts (this is in the US):

Verizon: will deliver all messages typically with low latency.

AT&T: Variable delivery latency and they have some sort of rate-limiting where if your system generates 10 alert messages within a short period, they queue them up for a couple of hours!

Inmarsat: Fast consistent delivery but they have an undocumented rate cap that when reached results in all (all!) messages being black-holed for 30 days. There is no way to reset this state. The cap is something 150 messages per month or 5 per 10 minute period.

> 2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec.

That's definitely true, and it's definitely annoying. But one is not logging in every day (or even, I hope, every month: 90-day cookies are safe enough).

You auth machines you use regularly so that login is 30 seconds once.

That's not such a high penalty so that devices you've physically used are authorized and all others aren't.

I browse with tin foil hat settings so I authenticate multiple times a day.

Then you wouldn't complain about an extra few seconds for 2FA.

I do.

I don't turn on 2FA because it's a pain in the ass. I want to like it but the extra annoyance isn't compelling enough for me.

In that case, you might be better off investing in an OTP device? [1]

It's hard to make a strong recommendation without knowing where on the scale of 1 to RMS you are...

[1] https://www.technologyreview.com/s/531926/a-physical-key-to-...

This does sound perfect to me. However I worry about losing a token without a established way to replace it.

For me I don't like staying logged into most services, I find it very uncomfortable that my computer "remembers" me for some reason. I use a browser plugin to delete cookies on tab close and don't save any history. I'm not so much RMS, just like my browser to "start fresh" most of the time. I also use a VPN 90% of the time.

So I value quick login more than account security, I guess.

I still feel squeamish about Authy having all the tokens - what happens when they get breached?

2FA is an extra layer of protection, not a panacea.

A successful attack would require both an Authy breach and that the attacker have passwords for the services that they want to compromise.

This should buy you enough time to regenerate your 2FA tokens to mitigate the threat.

If you use a YubiKey then you can move tokens between devices without needing to trust a third party, nor worry about them somehow being exfiltrated from your phone.

https://www.yubico.com/

Has anyone had yubikey fail?

I have one on my keychain, never an issue in years, but I can't help but be concerned, one day, I will be locked out...

I've dropped my YubiKey quite far onto hard ground, dropped it in water, and various other abuses. It seems quite hardwearing.

I just have two, if you're doing strictly u2f they are less than $20. I have a nano4 and a neo that I use for u2f, oath tokens, and rsa keys for sign/encrypt/auth. It's not the cheapest setup but it's highly functional and about the best account security I could put together. I lost a gmail account for 45 minutes once and decided that would be much worse then the cost of the keys.

When I ran a CA, half of my root key to unlock the more sensitive keys was stored on an older Yubikey on a necklace and it never left my neck. That includes the shower and rolling over on it in bed. I couldn't make that thing fail, and arguably I wanted to based on how I treated it. (Back it up, though.)

this is probably a good time to set up Two-Factor Authentication (2FA) as well.

Note: Dropbox also supports U2F for 2FA, which provides much better protection agains phishing.

https://blogs.dropbox.com/dropbox/2015/08/u2f-security-keys/

1Password can do 2FA, also syncs between all your devices. And no trusted 3rd party cloud service.

Keeping all the keys (password and 2FA tokens) in 1Password means it isn't true 2FA anymore:

https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-...

They're actually talking about 2FA for 1password itself. Not supporting TOTP via 1password for other services.

I also recommend authy. Makes 2fa slightly less painful.

Not a fault of authy, but namecheap and paypal both don't offer support.

I'm especially angry at namecheap because their homegrown 2fa solution is unreliable. Especially when travelling. I'm considering leaving them agter 4 years of promises to support authy but nothing!

Ugh, tell me about it. I check this page every now and then and just notice new comments and a response from Evgenia S. that the team is working on it:

https://www.namecheap.com/support/knowledgebase/article.aspx...

FWIW, Gandi.net supports TOTP, but their prices are a bit higher. However if you only own a handful of domains, the $20/year difference won't really matter.

Note the hack was in 2012. Hopefully most people have rotated passwords by now.

Anyone know of automated ways to rotate all the passwords on all of our accounts across the web?

It's a common feature of password managers.

Honest question: Why does any none need password managers? Does not chrome password sync or firefox sync do the job? Thanks

To generate random, strong passwords. Also not to be locked into a browser. Better actual password management (e.g. last changed). Tags.

A canary of chrome did have the ability to generate random passwords, but password management in chrome is still a pain IMO. Not sure about FF, but a quick google suggests it doesn't generate random passwords automatically.

FF doesn't, but as usual, there are addons for that :)

Chrome and Firefox are password managers :)

People use other managers for many reasons: storing passwords (and other secrets) which aren't used on a site, using them on different browsers (say, Safari on the desktop and Chrome on mobile) and lack of trust on the browser's password manager.

Also, for a long time, browsers didn't save passwords with forms marked with autocomplete=off.

Some of us still use native applications that don't use Chrome or Firefox.

Can any open source password managers do this?

When I used pwsafe and keepassx they had this option.

Wow, single point of failure for all my accounts, all my credential, all my personal, private and public data. I would love to use it!

I know you're being sarcastic, but with lastpass you can rotate most of your passwords.

https://blog.lastpass.com/2014/12/introducing-auto-password-...

Anyone know of an open source Firefox extension that can do this?

I don't, but would the extension in-effect need to have all your passwords too? Since I don't know of any battle tested (multiple very bad vulnerabilities exposed in public) password managers that offer this other than LastPass, I say check out the public opinion of that extension.

Yes, but as an extension it could just call into Firefox (which has all the passwords) to do all the work.

Have you tried this? It fails for most sites IME.

Yes I did (I didn't want to say it, disappointing most HNers).

I works for most of the major websites (Google, Amazon, etc. I think you can look them up). And also handles multiple google accounts pretty well, even when an google account is logged in, without logging it out. And it definitely doesn't works for the majority of the websites.

(And now for the skeptical ones) I'd say use it for websites you use 2FA since any bug (or intentional backdoor) won't be successful.

PSA: If you're using LastPass for managing passwords, DONOT use their 2FA authenticator app, since now it offers an option to autofill option. Now that is the point where you're crossing into al eggs in one basket territory.

Normal people don't rotate passwords unless they are forced to.

And what happens if 2FA seeds are stolen from the site?

Reply on news.ycombinator.com