How to Enable Two-Factor Authentication on Amazon | Hacker News Reader

How to Enable Two-Factor Authentication on Amazon

eff.org

69 pointsmaxt28 comments

I had MFA in my AWAS account using a hardware device. Just last night he battery finally wore out and I wasn't able to login. So I clicked the link saying I'm not able to login... and within 15 minutes amazon called me back to remove the MFA on the account. They asked for the email on the account, and to repeat back a code they emailed me.

So in the end, after thinking I was all secure with this special hardware one time token generating device, it falls back to email + phone, both of which can get taken over easily.

> it falls back to email + phone, both of which can get taken over easily.

How easy is it really for someone to intercept a phone call Amazon makes to your number?

(edit: I'm not arguing, I really don't know)

Attackers can social engineer the carrier to provision service onto a new sim card, which means they then have access to calling and sms.

Specific example of this, for reference: https://medium.com/internet-creators-guild/getting-hacked-as...

in fairness, this is still much better than just needing access to your email to gain access.

But this $40 device is a mirage.

What's the alternative?

Linode makes me email then a copy of my drivers license. That's at least a start. My preference would be to allow more sophisticated mechanisms if verifying identity. For example, since I'm in SF and amazon has representation here, have me go to their office and show them my ID. Or even better (for bigger clients), send someone to our office on record and seek out the person desired. Another method might be alternative (secret) emails vs the one on the account, or 1 time generated codes you have to print out.

Basically the MFA in the end is a gimmick since phone and email is all you need. Carriers often can be socially engineered to forward numbers or change sims, and email obviously can be hacked. Might as well just text + email instead -- didn't need to buy this $40 device.

Did Amazon recently merge the retail 2FA TOTP setup and the AWS 2FA TOTP setup? My normal retail 2FA TOTP code failed, but my AWS code worked for getting me into the retail 2FA settings (and also into the AWS settings).

Which seems really odd to me. Because I know I had two separate 2FA TOTP seeds, one for AWS, one for retail.

Anyone else notice anything like this?

That's odd indeed. I have a different 2FA seed for my retail and AWS account, but I've never tried using the wrong one but it's conceivably they allow you to use either

Well what's even more odd is that sometimes they do and sometimes they don't.

I wasn't able to use either though, as I said above. My retail 2FA TOTP failed for my retail account, but my AWS 2FA TOTP worked for my retail account (and for my AWS account).

So something shady is going on.

I've read horror stories about people who's personal and seller Amazon accounts were conflated. As such, I recommend keeping AWS and retail usage completely separate. Different email, different card, different name too if possible.

I have had to log in on a different machine twice recently because of this.

Yes! I had 2FA set up on AWS when they announced it for retail, and after I set that up, my retail one was required to log into AWS.

Anyone know if you can use the authenticator app on more than one device? My wife and I share the same Amazon account and it would suck if I had to generate a token for her whenever she wanted to buy something. I don't want to have separate accounts because I don't want to pay for Prime more than once.

Prime lets you share with members of your family

https://www.amazon.com/gp/help/customer/display.html?nodeId=...

https://www.amazon.com/myh/households

Thanks for that!

The simple way to do this is to use the authenticator app on each of your phones and scan the QR code at the same time, when you setup 2FA. Since it's time-based, your apps will always be in sync and showing the same code.

  Anyone know if you can use the authenticator
  app on more than one device?

Not only can you do that, you can scan the QR code in the image in the article and get the author's TOTP credentials in 'Google Authenticator'.

The normal way to do phone-based 2FA is a QR code with data of the format "otpauth://totp/yourusername?secret=1F56D7AFLONGBASE64&issuer=Amazon" where the secret is the secret needed for TOTP [2] one-time code generation.

As such, you can write down the secret (or print out the QR code) and scan it into other phones (or use it with tools like oathtool on linux) and they'll then generate identical codes to your main phone.

Obviously, if you store your TOTP secret alongside your password or keep a copy somewhere that isn't safe, there's no point in using 2FA. And if people fuck this up too often 2FA users will start insisting we install twenty shit proprietary apps (one for steam, one for salesforce, one for symantec vip access....) and nobody wants that. So use your new powers with care!

[1] https://www.eff.org/files/styles/large/public/2016/12/19/ama... [2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...

Printing out or otherwise saving the QR code (somewhere safe) is also the only way to have a backup code in case the device is lost or broken, because they don't provide one-time backup codes (unlike pretty much everyone else).

Then again, it sounds like it's really easy to disable 2FA with just a simple phone call, so...

I thought that only worked if the two devices scanned the code at the samw time.

Use Authy instead of Google Authenticator. It allows multiple devices and backups

+1000 for authy.

1Password [0] can store and share one-time passwords as well.

[0] https://1password.com/

Did not know this! A little cumbersome, but it works!

Yes, there is oathtool that you can use on Linux (well, that's how it's called in Debian). I use the same, just type:

oathtool --totp -b "key value"

where your "key value" is your secret (same thing you would get if you scan QR code). And then you just need to keep the secret safe, and you can run it on as many devices you need.

EDIT: just realized that michaelt had much more substantial comment.

And for Gmail

* Google 2-Step Verification || https://www.google.com/landing/2step/

And for everything else...

* Turn On 2FA | Turn It On || https://www.turnon2fa.com/

Reply on news.ycombinator.com