Hacker News Reader

Comment by rolobio | Hacker News Reader

Am I the only person who loathes this form of 2FA? I have this on my eBay account and it never works. I click the "Approve" button, and it fails to send so I can't login. I would prefer to just use my 2FA TOTP app, which has yet to fail me!

My work has the same sort of setup, they expect you to install the "Microsoft Authenticator" app (no TOTP supported) and click approve in that. But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app? I'm basically alt-tab'ing and clicking a different button, not really an improvement. It should be on a separate device, or something out of Microsoft's control so they can't screw it up.

Worse still is SMS 2FA, which appears to just be an analytics technique rather than a security feature. As we know, a phone number is only as secure as a carrier's most-tired employee.

View on HN

>Am I the only person who loathes this form of 2FA?

Not in the slightest. I tried to configure TOTP-only and Google effectively tells me to go fuck myself, because they apparently know how to secure my account better than I do.

I've found that if you move away from Gmail (and there are much better providers around), a Google account doesn't contain much. Turn off your history and someone compromising your account can do... what? Search for things you'd like? View your YouTube favorites? Meh.

Agreed. I have moved off of Gmail (went to fastmail, very happy) and I also removed my other services off of my gmail account for logins. My google account has my calendar and youtube and that’s it.

Me too! However, my fastmail app is slow on my phone (a Nokia 6.1), compared to the Gmail app which, while not buttery smooth, is still faster than Fastmail...

And the Gmail app refuses to allow IMAP accounts to archive emails, so that's pointless...

The hardest thing for me to replace so far has been Google Maps. I use a handful of OSM map apps, but none of them come close to the local business lookups of Google, which I need quite often.

Right but you don't need an account for that.

You don't need an account for that yet. I've been using Maps in "incognito mode" for 6 months, but I wouldn't be surprised if they're still using Maps to collect data about me.

Better yet, always be logged out of google (and everything else really) unless you must. Then log out and erase all cookies ASAP.

docs, drive and photos are pretty packed for me at least

I was in that same boat, which is why I decided to migrate off gmail and move to a paid provider. One day I just woke up an realized I had to much important shit tied to my email to not be a customer. Paid services to replace google are surprisingly affordable. And best yet, if there is ever an issue, there is also a number I can call. Totally recommend migrating away.

«there is also a number I can call»

Unfortunately that's a number a hacker can call to social engineer the employee and steal your account. Same method as in SIM swapping attacks.

Assuming reasonable levels of competence on the part of the service, which scenario seems more likely for the average user:

1.) Some unexpected glitch occurs (could be the user's fault or could be the company's), and the user's ability to access the service is temporarily interrupted until a human is able to investigate and resolve the problem.

2.) The user is specifically targeted by a malicious actor performing SIM swap and/or social engineering attack.

I'm not really a gambler, but if I'm forced to guess, I'd say #1.

EDIT: clarify initial assumptions

The issue with moving away from Gmail is that some sites don't allow you to change your email address. I can only imagine the chaos that will be when Google decides to kill Gmail.

what do you use for photos storage ?

Not OP. While I've personally not yet fully migrated out of Google, I found Synching and Resilio Sync quite useful to transparently backup photos to my own computer. And to prevent losses, I have a Backblaze subscription.

While I do have a VPS, it only has like 20GB, so I've yet to find an affordable and easy photo sharing solution.

You can set up PhotoStructure to build smaller (4k, 1080p, whatever you want) previews on your home server, and rsync just the previews dir and DB periodically up to your VPS. A couple of my beta users do this. (I'm the author, btw).

https://photostructure.com/faq/why-photostructure/

Hey thanks, I'll take a look!

As always in this threads I hear people talking about SyncThing etc (and i have it and it's neat) but that works for Android. How do you exit the iCloud land in an easy and reliable way? There is no SyncThing for iOS.

I wish SyncThing was more userfriendly or something. I've tried it on different Android phones and computers and have never gotten it to work.

I use Wasabi with Clouberry for backups and otherwise store all data on my hard disks.

But if you're into "cloud" storage, Mega.nz gives you 50GB of free and very reliable storage.

I have a NAS that backs up to rsync.net.

> they apparently know how to secure my account better than I do

This is definitely true for 99% of people though

And the company is taking full advantage of that.

"Trust us."

Yet no company wants more personal information from you than this one. They want everything. Even when they have so much, they are going to great lengths to get more.

They are not in the security business, they are in the online ad sales business.

And you aren't even exaggerating. They now require ID verification to watch age-restricted videos on YouTube.

Windows with a Yubikey is like this, most particularly in Edge. It'll accept your key once but you'll have trouble using it again. It'll tell you that it doesn't recognise the key.

Some bullshit with Windows Hello, I'm sure, since using a hardware key in the browser triggers it.

I would rather use FIDO2, which is an open, decentralized standard that's both super secure and convenient. Why is nobody supporting that? That way we don't even need to remember usernames, let alone passwords.

I was really hoping that would catch on when I got my first yubikey some years ago. So far it seems that basically no one is using it. Which really sucks because it's so much more secure. Makes it impossible to accidentally send credentials to the wrong site.

Same :( There are plenty of sites using U2F, but not WebAuthn. I hope that's because it's still relatively new.

I've yet to run across one browser / operating system combination where WebAuthn is implemented well. Stuff like assertion interface not showing up if you have two authenticators present. Browser and OS vendors should really fix their shit before any mass WebAuthn adaptation happens.

What don't you like about the Win10 + Edge implementation?

If you have a Windows 10 computer with Windows Hello enabled, Windows 10 will ALWAYS assume you want to use a platform authenticator if the website doesn't specify whether to register a platform or a cross-platform authenticator.

If you have both Windows Hello enabled and a Yubikey inserted into your computer and you start the registration, Windows 10 will always bring up the Windows Hello dialog, asking you to perform a biometric verification. In my case, this will be a fingerprint reading. Your Yubikey won't be in any way active and the option to use your Yubikey won't be visible even if you click "More choices".

What you actually need to do is to press the "Cancel" button on the Windows Hello dialog. If you press Cancel, only then are you prompted to register a security key. And if the registration was started accidentally, you need to press "Cancel" both on the Windows Hello dialog and on the security key dialog.

It's just downright stupid UX. You basically need to teach the users to "start the registration and then immediately cancel it" if they want to use a Yubikey on a Windows Hello machine. If the website doesn't specify "platform" or "cross-platform" preference during registration and the user is using Chrome on macOS with Touch ID, Chrome will just ask if you want to use Touch ID or use a security key.

If the website specifies a preference for cross-platform authenticators, or there's no Windows Hello set up on the machine, then Windows will actually show the security key registration dialog without any need to click "Cancel".

There's also the issue that WebAuthn resident keys can only be managed through the clunky command-line interface. At least I haven't found a way to manage resident keys in another manner. But the clunky command-line interface is actually among the best management options - other browsers provide no management for resident keys.

I've actually considered writing a blog post griping about how stupid the experience with WebAuthn is. Chrome, Firefox, Safari, Edge, Windows, macOS, iOS. I don't think there's been any combination there where something hasn't annoyed me.

The cancel issue you described is no longer present in the current version of win10.

The unfortunate fact is nobody except us geeks uses Yubikeys. 99% of users prefer platform keys. So it's not hard to understand why software defaults to it.

What's the current version of Windows 10? Because I'm getting it on 20H2.

With Safari now having it built-in so you can do FaceID/TouchID I have a feeling it is about to become more common for websites.

ironically, google is probably one of the companies pushing that the most.

Apple, Google, and Microsoft all support FIDO in their OSes and browsers.

IIRC, the Google/Android 2FV implements FIDO2

Isn't it U2F?

No, it's WebAuthN these days (FIDO 2) which can transparently use U2F tokens.

> But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app?

By ensuring that whoever signs into the account has at least two distinct factors: the password and the trusted phone with the authenticator app. One thing you know, one thing you have. Perfect. (Depending on your phone's settings around biometric unlock, it might be even the trifecta: one thing you know, one thing you have, and one thing you are).

Let's imagine we implemented your suggestion of requiring the login to be on a different device than the authenticator app. What threat model does this protect against? An attacker who has your password and the unlocked phone will just sign in from a different device with the password, and then use the authenticator app from the phone. The only people you're protected against are those who do not have any access to another device than the stolen phone.

GP is saying they're using an authenticator running on the computer they're logging in on (they alt-tab to it from the browser). So they have two factors in the sense of "something you know" vs. "something you have" but in this case the something they have is the same device.

Yes, I understand that. And like I explained, there is nothing wrong with it being the same device.

I have trouble with the MS signin for work. Looks like blocking third party cookies (which safari seems to do) makes this nearly impossible (or incredibly inconvenient) to use.

The something you know these days is just stored in your password manager, protected by your phone’s passcode most likely, so it all ends up being “something you have”.

Your phone's passcode is something you know.

I'm with you. I also dislike that I can't even turn this form of 2FA off for my Google account. If I have 2FA enabled, this is required to be one of the methods. The only way to get rid of it is to sign out of my Google account on my phone.

Agree. And worse I sometimes just don’t get the pop ups.

It’s literally the only reason I’m considering dumping the Gmail app. If you use an app password and the standards based mail client like imap or pop, this isn’t forced on you.

Ive also seen an increase in google flagging my accounts for some reason and I have to go and reclaim/verify them using the recovery accounts.

Incidentally I was just on the Ebay website and looking through the settings since it's been a while. I thought I'd activate 2FA, but when I saw that they only offer SMS and via their app, I discarded the idea.

> Am I the only person who loathes this form of 2FA?

Apparently not, but it's always worked for me. Two things, though: 1) sites should support multiple methods of 2FA. I don't understand why many only let you have one. If I drop my phone in the toilet, I want to have a FIDO token enrolled as backup. 2) some of these implementations, like Google's, are proprietary. I want something universal and standards-based so we're not dependent on a different app for every service we use.

> But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app? I'm basically alt-tab'ing and clicking a different button, not really an improvement. It should be on a separate device, or something out of Microsoft's control so they can't screw it up.

You're correct, and knowing only what you've told me, I would argue this solution was implemented incorrectly.

Every time I log in, ebay bugs me to confirm my phone number "for security purposes". I say no, because I know the next step is harassing me with text messages every time I want to log in (like Google, etc). Passwords work for many of us. I generate them with pwgen(1), store them in a text file on encfs, and cache them in browsers. If my actual desktop computer ever got pwnt, I would have much bigger problems than a Gmail account or even online banking. This might not match the security model of people who reuse passwords across sites, and/or log into accounts on public computers (derp), but it is the original security model of the web and it's extremely frustrating that companies are attempting to destroy it in favor of some magic (read: unpredictable) new system that continually gets in your way.

eBay would not flip on two factor without you knowing. Likely it is to alert you of a new device accessing your account and possibly part of a password reset flow.

It’s a good point though — how munch more secure is two factor if you have an unguessable password locked away in a password manager. Your single point of failure is security of your computer.

But this is exactly what Google did to me - rejected using my perfectly good password in favor of "two factor" authentication consisting of my recovery email and some saved browser session (which no longer exists as I periodically wipe browser sessions). Plus the countless number of websites (usually online banking) that abuse your phone/email to send you a code for every login, having been spoiled by the mobile-surveillance environment. So I really can't trust that eBay wouldn't start doing something similar.

And yeah I do get the idea that if my password is actually compromised and hostilely changed, I'm going to be looking at the company for some sort of reset. But the right way of doing this is a higher friction process that could require phone engagement, in person notarization, etc. It's certainly not to make this reset process part of the every day login experience based on this mistaken idea that passwords are always insecure.

Yes, this is a good point. With the Authenticator app on the phone and unguessable passwords (stored in a password manager on the phone), security all comes down to your Phone’s passcode. Know that, and you have complete access to all accounts.

Apple and Google should just short circuit this and directly be an Authenticator as well as manage the long lived token (the password) behind the scenes, which will eliminate the alt-tab dance.

You can use regular TOTP with Microsoft. You have to click some box during setup that will show you a QR Code. I can't remember what it said, but I did it a few months ago after a tip here on HN.

https://authy.com/wp-content/uploads/2018-07-27_1450.png

Reply on news.ycombinator.com