Hacker News Reader

Comment by quicklime | Hacker News Reader

I’m not going to say whether this is good or bad for security, but it did save me a few years ago when I accidentally dropped my phone and broke it.

View on HN

Oh, it's clearly bad for security! Lots of things that are bad for security. For the best security, Google would require all users to sign in with dedicated hardware authentication tokens every time, and also present themselves for in-person interviews in Mountain View where Google employees would personally confirm each user's identity before letting them log in. That would be really good security!

It would also be really bad for usability. Just like it would be bad for usability if you lost access to your Google account forever because you broke your phone.

As an example, my employer requires 2FA on pretty much everything, so the start of my day looks like:

* Power on laptop, log in using laptop password

* Log in to LastPass, use lastpass password, verify with 2FA. * Connect to VPN, log in using SSO (Okta) password from LastPass, verify with 2FA.

* Open github tab, log in using the Okta password again, verify again with 2FA.

* Open JIRA ticket, get sent to Okta, skips password prompt since already logged in, verify again with 2FA.

* Open email, get sent to Okta, skips password prompt, verify again with 2FA.

* Oh, my calendar tab was already open so Google didn't know I authenticated in another tab so sends me to Okta which now expects another 2FA there once I interact with it.

Also the policy is that the lastpass password, SSO password and laptop password should be different. So that's 3 passwords and 5 2FA pushes in about 5 minutes (and again after lunch as all those sessions expire during it).

My understanding is you can configure Okta to remember 2FA on a device for a while, but our security department has chosen to disable that. This is a lot of security overhead, but in this case I'm being paid for it rather than paying for it so whatever. Can you imagine getting a paying customer to agree to this level of 2FA double checking?

And the annoyance makes people want to turn it off.

Typical solution: Make the timeout much longer so you don't need to keep doing the work

Correct solution: Deploy a second factor that isn't annoying

If your second factor is a FIDO Security Key then you just touch the key. Doing this a dozen times per day feels about as much trouble as how you have to hit the spacebar to make spaces when typing, ie you aren't even aware of it.

The VPN couldn't easily do this out of the box today (as OpenSSH demonstrates, where there is a will there is a way but I wouldn't trust a typical proprietary VPN client to not open massive security holes this way) but all the web stuff you mentioned could use WebAuthn, and Okta supports that if your employer deployed it as I understand it.

Correct solution to me is to just turn it all off and accept the tradeoff to not make your employees suffer all day.

That security key works fine in an office environment, but becomes a lot more annoying on, for instance, a mobile device.

I'm hoping that more apps start accepting NFC security tokens for mobile apps. Apple says they added NFC FIDO-2 authentication support in iOS 13.3[0], but I have yet to see an app that allows me to authenticate that way.

[0]: https://www.macrumors.com/2019/11/12/ios-13-3-fido2-security...

This is certainly better, but it doesn't really get us to the point the GP is describing, where authenticating "feels about as much trouble as how you have to hit the spacebar to make spaces when typing, ie you aren't even aware of it." I have to somehow get both my phone and my token out of my pocket at the same time, and hold them together, which can be awkward on a cramped subway, or when I'm holding something in my other hand.

Apple has subsequently announced and demo'd a platform authenticator for Macs and iPhones, like the one on a Pixel (the flagship Android phone).

So then you don't need the token because the platform (ie your phone) does the multi-factor authentication itself. In this case you touch a fingerprint reader. I can hold my phone in a way where my right index finger naturally is placed to do this so it feels pretty convenient.

Again, not on iPhones today but it has been demo'd and does already exist on Android.

GitHub's web interface uses my security key in NFC form from my android phone, I assume it would be the same on iOS?

Android has supported NFC security keys for a long time, and I believe it's automatic for websites that support U2F. I'm not sure about iOS, in the past it used to be impossible.

I use one of these: https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B0... . Plug into laptop when using laptop, hold against back of phone while using phone, and the form factor is non-annoying on my keyring with my house keys. I was shocked that YubiKey doesn't offer a single key that works for both phone and laptop.

The yubikey 5 NFC does. I think they also have a cheaper product which does FIDO2/U2F only also via usb A and NFC too. Before that, the yubikey neo did both NFC and USB A.

> For the best security, [...] That would be really good security!

Actually, that would be very bad for security, because users would work around it. (Well, it might be really, really, good for security if it got people to stop using Google, but I doubt that's what you meant.) As the saying goes:

> Security at the expense of usability comes at the expense of security.

I was being factitious, but seriously, how would you get around an in-person interview requirement? Let's assume that Google isn't doing anything stupid—you can't just stay logged in forever, and whatever process the Google employee does on their end is reasonably protected and audited.

> > Well, it might be really, really, good for security if it got people to stop using Google, [emphasis added]

Yeah, I lost my phone for the first time last year, and was very very glad for this default, because I was able to remove 2FA on my now lost phone from my computer that remained logged into google services, and log into google on the replacement phone, and reset 2FA to that new device.

I don't understand why these large companies don't incorporate some type of printable backup code that can be used if your 2FA device is lost/broken. I've incorporated this type of system multiple times in the past, and it works wonderfully.

In fact, Google does: https://support.google.com/accounts/answer/1187538?co=GENIE....

Yeah, pretty much every 2FA I have set up has done this.

They do. But now that I think about it, I don't remember where any of mine are, because I haven't had to use them in over 5 years.

Every 2FA I have setup has this. Kudos to GitHub in particular for strongly insisting that you save the backup codes somewhere.

My paranoia about my devices stability and its 2FA software (LG G4 bootloop victim) means that I keep two phones with 2FA verification and applications enabled - one stays safe at all times so that in case I lose or drop my new one I can use the backup.

I've lost my phone and been able to re-connect to every 2FA service I use without any need for human interaction. For google I was saved because my laptop was still logged in and I could turn google's 2fa off.

Basically everyone else has an "I lost my device" thing and a fallback to SMS codes or email links. This certainly weakens 2FA in general, but strict 2FA is unusable in practice.

Just store your 2fa totp key or qr code or backup somewhere that is either protected by 2fa (password manager, online storage) , or is available offline (file cabinet).

Some online storage services have secure areas requiring 2fa to open which would be suitable.

Most services that use standard TOTP codes have backup codes that you can print out and store in a safe, and the ones that don't you can save the QR code that enrolls the 2FA app and use it again to re-enroll a new device if needed.

Obviously the backup codes are preferred as you're not storing a master key to all future codes, but it's a lot easier to manage than a second device (at least for me).

I hardly ever use my phone for 2FA. I have a 5 line Python script using pyotp to create my codes on all my computers.

Admittedly if a skilled hacker breaks in into my computer they could recognize what the script does and misuse it. But at least no scripted attack should ever look for it. It's not on github because my seeds are hard-coded and there is not much to generalize.

You could also use a Yubikey to store up to 32 TOTP codes on it. One benefit is that you can set it up to require a touch to generate the code.

Again, like with the phone, I would always need to take it out the pocket. Which is inconvenient if the pants are in the bedroom but I am not. Or I have a different pair of pants and the contents of the pockets hasn't got swapped.

Ah. I actually leave my Yubikeys plugged into my computers.

I use the Yubikey Nano. I have a USB-C version in my laptop and a standard USB version in my desktop PC.

Isn't that what backup codes are for? Does no one use backup codes anymore?

Me too. Cracked, unusable phone screen. Fortunately was still logged into Google on my desktop otherwise I wouldn't be able to change 2fa before fixing the screen.

Reply on news.ycombinator.com