Hacker News Reader

Comment by md_ | Hacker News Reader

The fault with phishing _always_ lies with the victim, by this logic.

Put differently: if you assume the user to be infallible, there's very little reason to use 2FA of any kind. (Don't believe me? Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.)

View on HN

I leave my work desk to grab a coffee. An attacker adds a hardware keylogger between my keyboard and computer. When I come back 5 minutes later I don’t sweep for any hardware modifications. Now they have my password.

This threat model is orders of magnitude less likely than something like phishing. It is not scalable for attackers and simply doesn't work for anybody who works from home or works in a location with meaningful physical security.

It also isn't defeated by 2FA, since they've physically installed something on your machine to detect your keypresses. They just capture your password and the sms code.

The post asked to “Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.” Defense in depth is absolutely a thing. Now does your grandfather need this level of security? Probably not. But that doesn’t mean multi-factor is worthless.

But it isn’t. The key logger steals your second factor code just the same.

That only works if the site allows replaying codes and it doesn't expire before the attacker logs in with it.

You've installed a physical device. Just have it interfere with the actual code typed to the 2fa page so the target's login fails and automate the login with the correct code.

Sure, I guess. I would tend to argue that with hardware access they can do a number of things, though:

- They can install a wifi-enabled* keylogger that exfiltrates your OTP. Yes, they have to use the OTP before you do, but that seems solvable to me--just program the keylogger to transpose one of the six characters that comes after your (now known) password.

- They exploit any number of likely plug-and-play vulnerabilities in common OSes (e.g. https://www.thetechherald.com/tech-news/disable-plug-n-play-...).

- They steal your computer. Are you using FDE? If not, your cookies are sitting there on disk waiting for them.

- They...steal your phone next time you forget it at your desk. ;)

Are there scenarios where TOTP can protect against a non-phishing attack? Yeah, I can construct one if I really have to. (I think you're thinking too locally; my top argument for TOTP would be that I can rarely be sure the identity provider has implemented reasonable quotas against password brute-forcing--and who knows how well they secure things like server logs against rogue insiders?)

But if you tell me you use TOTP because you're afraid of a local attacker plugging in a keylogger--and not because of phishing--I think your priorities are out of whack. :)

* Or they use a covert channel, but I'm not serious about this part: https://dl.acm.org/doi/10.5555/1267336.1267341

What? that's absolutely not the reason for 2FA... if he can key-log your passwords, he can keylog your 2FA code...

deployment of a keylogger means your host is compromised, from there you can do so much you really don't need someone's password...

2FA is for plain phishing attacks. building phishing attacks against 2FA is significantly harder and usually easier to detect\protect from.

Reply on news.ycombinator.com