Hacker News Reader

Comment by smokey_circles | Hacker News Reader

No.

2FA is designed to authenticate that this is you logging in. Wrong off the bat.

The "they just use your login token" is akin to "they just hacked the CIA's database". Just.

I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem where login.signup.domain.com does not match login.domain.com and so users are used to searching.

The bit that completely lost me was the lamenting of convenience with the YubiKey.

Security and convenience are polar opposites.

Coupled with the "tech bros" comment, I am not sure this is in good faith at all

View on HN

> The "they just use your login token" is akin to "they just hacked the CIA's database". Just.

He's saying that they can basically MITM you, which is true. GitHub asks attacker for token, attacker asks you, attacker gives token to GitHub on the spot, presto.

Ah, I did overlook that one.

That said: I remain unconvinced that 2FA is a trivial thing to beat. Now we're talking about an active attempt to impersonate you, as opposed to a general catch-all-the-2fa-less-logins

Put another way: If you ran this phishing site, would you focus your time on the logins with 2FA enabled (which if I've understood correctly means you'd have to catch them in the window the token is valid for) or the logins without?

If you use your phished credentials immediately (e.g. inline with it being phished), then it doesn't make a difference if they are using 2FA. You use the credentials they entered to login from a backend system automatically, and then if that ends up with a 2FA prompt, you show the victim the 2FA phishing page next, instead of redirecting them to the real app/whatever.

This obviously does have its own downsides (you have to maintain a login infrastructure, as well as your phishing infrastructure), but this was even seen before 2FA became common to detect if an incorrect password was entered into the phishing site.

It is definitely an improvement, but TOTP doesn't provide much protection from phishing, and as it becomes more popular more phishers will need to accomodate for them in their campaigns, further reducing their effectiveness here.

> 2FA is designed to authenticate that this is you logging in. Wrong off the bat.

Pretty sure you are in agreement with the post here. IOW, 2FA isn't to authenticate the site.

Most of 2FA I use won't help you assuming the credentials I just gave the phishing site are immediately forwarded to the real thing. I will see a login verification, just like I expected, from the site I expected it to come from. Maybe, just maybe, I might notice that the login location is not where I am, for 2FA implementations that tell you that.

I might be, I took the article at it's title to mean "2FA does not protect you from your password being leaked"

Reply on news.ycombinator.com