Hacker News Reader

Comment by technion | Hacker News Reader

I'll repeat a comment I made last week:

I love the principle, but I can't use it with AWS, I can't use it with my bank, I can't use it with my domain registrar, and I can't use it with Office 365. That's 0/4 of the high priority targets for me.

Edit: If anyone from AWS is around, please consider this. Your organisation has made huge headway in the field of security, but the AWS console logon is a very high profile target.

View on HN

Similarly I remember the first organisation that really tried to get me as a user to care about account security with a hardware token was .. World of Warcraft. Followed a bit later by the use of TOTP in Steam. Banks meanwhile are either stuck in the past or have tried bad proprietary solutions.

Domain registrars are an odd one, because so rarely does one need to log in or do anything - but when you do it may be urgent.

Banks in the UK have been handing out hardware fobs. Not USB devices you put in, but a calculator like interface where you input the challenge they give you and you type the response back.

I guess it works since it doesn't need anything else special and can easily work with web flows.

I think you mean a ChipTAN generator.

https://en.wikipedia.org/wiki/Transaction_authentication_num...

The nice thing about these is that you do need something else special but that something else is your bank card, and the PIN used to access it.

Only for some banks, e.g. Barclays. HSBC's version[1] does not require a card to use.

[1]: https://www.hsbc.co.uk/1/2/contact-and-support/security-cent...

I've not used mine for some time now, as my bank offers the same function via the smartphone. Very handy though.

Banks in the US also hand out hardware devices, especially for business accounts.

I have RSA token device from Wells Fargo for example.

The problem with these is that I need a special device for every single account. There are two business accounts I have access to and I have to deal with two hardware devices.

The ones in the UK are a standard - every account I have uses the same ones and they are interchangeable. Everyone I know had one - they are ubiquitous as the chip and pin standard is here.

I have 2 bank accounts in the UK, and neither of them provided an hardware fob.

It's frankly a bit disappointing, since storing secrets in their mobile app means that at the end of the day, when you do banking on your phone, you're really using only 1-factor authentication

That's interesting - I have accounts with three of the major banks and all of them have me them (they do use it different amounts, some only for signing transfers, some for everything including logging in).

for many years my SomethingAwful password was more secure than any other online account I had.

> Banks meanwhile are either stuck in the past or have tried bad proprietary solutions.

Or they have a standardized API for accessing all accounts, and use your existing debit card’s security module to sign and authorize all messages you send via this API.

That’s FinTS, and every German bank supports it. Standardized, univerals, open, and secure.

Oh, and KMyMoney and GNUCash also have plugins to directly access it, and there’s even a taskbar widget for KDE to always show your account balance.

I work for Duo Security. We have an SSO product that allows you to use U2F Yubikey tokens with AWS, Office 365, and anything else that supports SAML. Other companies offer similar products.

Here is an overview of current 2FA support of service providers:

https://twofactorauth.org/

To apply some pressure, there are handy "public shaming" twitter-shortcuts.

The highest profile target is your personal email account, because that's generally the account that can reset the others. Does your email have support for U2F or at least an authenticator app?

I'm running Office 365 with the only thing is supports - Microsoft's app. Which is not infallible:

https://lolware.net/2017/08/01/capturing-mfa-logons.html

Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here.

Last time I used Office 365 you could disable the push requirment when configuring the auth app, that would then allow you to use alternatives.

I used freeotp with my o365. :)

Yep, just set it up a couple days ago. Supports Google Authenticator/Authy/etc.

> Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here.

Do you check this mailbox frequently? If not, won't you miss important communication?

I'm also using Office 365, but I use the same TOTP app that I use for every other 2-factor service I use...

I have my email protected by an SSH key plus TOTP (using the cool Google Authenticator PAM module), but I just realized I haven't enabled 2FA on the VPS control panel, so everything is protected only by a single password. sigh

When you are hosting your email / whatever on a VPS... access to your system is possible via a whole bunch of "not 2FA enabled" routes. I would treat that as the least trusted storage available.

Yeah, maybe. My "threat model" is mostly drive-by automated attacks (like malware stealing my not-very-protected SSH keys) or overly broad warrants, not people specifically targeting me.

For AWS, you can. https://github.com/Yubico/yubioath-desktop For domain registrar, depends who you use. Gandi uses oath as well.

Banks are still a decade behind in almost every way. Can't help you there.

The Yubico Authenticator app does TOTP and HOTP, but not U2F.

You need yubikey to use that authenticator. The key itself does u2f (unless it's a very old version), so the authenticator is irrelevant in that case.

The website (AWS) doesn't use U2F in that scenario, so you don't get the phishing-resistance U2F brings to the table. It's just regular TOTP, with the secret stored on your Yubikey instead of your phone (or wherever else you'd store it normally).

>"I love the principle, but I can't use it with AWS, ..."

You can use Google Authenticator with TOTP with you AWS console. Or am I misunderstanding your comment?

It's not a hardware device obviously but its the same principle, just implemented in software.

Yes, you can use TOTP, but TOTP can be phished.

The article I was responding to, was written regarding U2F keys, which is a different protocol, with protection for this scenario.

Reply on news.ycombinator.com