Hacker News Reader

Comment by sgroppino | Hacker News Reader

I'd have though that two-factor authentication could have prevented this type of attack?

It could, and the plugin creators regret not having it active for everyone's account:

> Sigh... totally agree. I could add a longer story why just this account had no 2FA enabled, but the lesson learned is simple: From now on, we enable 2FA for every account that offers it.

So they won't make this mistake again.

Thanks - saw it now in the comments.

Only with U2F, because the hardware dongle would refuse to provide the OTP to a different domain

Yeah, we really need to distinguish between a 2FA app and a dedicated hardware key. My phone is probably the least secure thing I've ever owned, both in terms of technical security, and physical security.

This whole 2FA thing has been really jarring for me, because I always treated my phone like a public space: no password, no private data (that I know of), ready for inspection by foreign authorities. Of all the things the world could ask me to trust, why the phone?

Even a dedicated hardware key that generates an OTP[1] can still be phished. Only U2F cannot be phished.

[1] https://en.wikipedia.org/wiki/Security_token#/media/File:Cry...

> Of all the things the world could ask me to trust, why the phone?

Because it's the only instance of a computer that you can expect majority of users to own and always have on them.

2FA as a thing would not get any reasonable adoption if you required people to buy hardware keys to use it. Not to mention, hardware keys do not work on every device one would like to log in from (AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in).

> AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in

Using an USB OTG adapter, it should be possible. However, even the flagship tablets of Samsung don't carry NFC, only the phones do - and even there it's a hit and miss if you have NFC.

Apple, on the other hand, doesn't have developer-accessible NFC anywhere.

This is a real shame.

For clarity: U2F does not use one-time passwords (OTP), but challenge-response authentication. This is why it provides better protection against phishing than hardware OTP tokens.

Not if the phising site asks for the 2FA token.

The point of 2FA is challenge-response and the secret key is in the token. If a phishing site asks for 2FA it can get only one valid challenge-response pair, not the secret key.

That still allows them to log in though.

One login is enough to authorize an Oauth app.

Require second login to transfer chrome apps to alternate account + 24 hour timer on transfer that sends an email to recovery email/everyone else relevant when extension is transferring.

SMS and TOTP (Google Authenticator) can both be phished.

U2F cannot be phished.

Can't it?

What if I control the user's computer and can let my own code interact with U2F? Or does the protocol somehow prevent that?

If you control the user's computer, that isn't phishing. That's keylogging/credential theft.

Reply on news.ycombinator.com