Hacker News Reader

Comment by jrmg | Hacker News Reader

I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud).

It feels like it might.

This isn’t counting the productivity that’s lost to actually using the TFA system successfully, which is probably measurable on a population level.

View on HN

I think it is hard to say actually. An account that gets killed off by 2FA failures is dead, which is definitely extremely annoying. But on the other hand — the maximum cost that could be incurred is just the value of the account, and lots of our accounts are actually basically valueless (Facebook, Twitter).

On the other hand if your account is taken over, it could be used to perpetuate scams (which could harm your loved ones if they fall for the scams), it could be used for various things that might hurt your reputation. Or depending on the type of account it might be a stepping stone to get into, I dunno, your bill-paying account for some utility company, which will probably have all your bank account details in there because utilities companies tend to not be super on the ball about that kind of thing.

In the current state, I believe it indeed causes more economic and personal harm. Properly executed MFA by both the provider and the user are great, but we have a long way to get there.

The recovery user flow, at the end of the day, should provide an option for identity proofing through a service that can consume a government provided identity credential. Login.gov, Stripe Identity, ID.me, whatever, something that can attest that you are you when provided a sanctioned credential.

You should be given the option to opt out of this, have your data E2E encrypted, and if you lose your creds your data loss is on you. But for everyone else, they can then provide ID and get their digital identity and data back (at a very low cost to the service provider, proofing is usually $1-2/request in bulk; if you want to charge the user that cost, that’s palatable).

(corp|customer identity governance and proofing is a component of my work at a fintech)

https://media.fidoalliance.org/wp-content/uploads/2019/02/FI... ("Recommended Account Recovery Practices for FIDO Relying Parties", Page 3)

https://doi.org/10.6028/NIST.SP.800-63a NIST SP 800-63A Enrollment and Identity Proofing

More than just that. 2FA should

1a) be possible to be disabled or

1b) Offer non-electronic second factors such as paper codes

2) Offer a broad range of options in general, not just phone or even worse only SMS. I can count the services that I can use my Yubikeys with on one hand

3) Be predictable (or at least be configurable like that) by the user and not behave different on weird conditions such as your IP

4) Allow to configure more than just 2 factors. 2 factors are really bad. It should usually be 1 or 3+.

5) It should educate properly about how to use it and also about the risks (e.g. increased change of losing access, especially when certain factors are used)

I think that when identity proofing actually becomes important, we should fully leave private services. That is something too important, so the state should either standardize and enforce it or offer it. Maybe, offering a wide-scale MFA / Auth solution should come with similar restrictions that we have for finance, including the identity proofing fallback your mentioned.

Not to mention the chances that your 2FA method will be used as another tracking and marketing vector. These days I'm deeply suspicious of companies that require 2FA.

I feel like virtually every service demands a phone number on sign up partially for bots but mostly for for tracking.

Sorry, do you mean just sms 2fa or totp too? If you meant totp too, how so?

> I have long wondered if two factor authentication actually causes more economic harm than it solves

At Google at least, there are people who are responsible for measuring this sort of thing. 2FA adoption reduces overall account loss.

This is the way of capitalism. Move costs outside your organization and call it profit.

It's why companies don't offer phone support. Or ones that do (like mine) get premium pricing.

Of course many if not most of the services would not be offered in the first place had it not been for the financial incentive offered by the market economy (i.e. 'capitalism' painted with broad strokes) so you can pick your evil: have a market economy with many players, some good and some bad... or have some alternative economical organisation with far fewer services, usually still good or bad.

At least the market economy and 'capitalism' offers the choice of foregoing on those 'premium' services by enabling me to run my own services on my own hardware connected to the 'net through my own fibre connection. Since 'capitalism' leads to more choice it puts the onus on the individual to choose wisely. For some that choice comes down to paying more for those 'premium' services, for others - like me - it means I do a little more work to be able to run my own things. If I loose access I can get it back, the hardware is right here on the farm after all. I have 2FA enabled on a number of services to protect against leaked passwords but since everything is run in-house I can always get back access if I for some reason lost (access to) my devices and backup codes.

This is a win for 'capitalism' as far as I'm concerned no matter which way you turn it - those who want to be served can get served, those who want to serve themselves can do so. You do need to make a conscious decision on what side of the divide - pay and be served or do the work to serve yourself - you want to be on since the space in between can be treacherous to navigate. You also do need to react if a supplier does not keep to its end of the bargain if the system is to work. For the likes of Google/Microsoft/Facemetabook/Apple/etc. this means you should avoid them if possible in any way and if not, make sure you have a way out if they start acting up.

Hard disagree.

MFA is the best mechanism to stop hackers from constantly hacking everyone. Without it everyone would be getting brute forced 24/7.

Why wouldn’t exponential API rate limiting not solve this brute force issue?

Because brute force does not imply a high rate. You can brute force a password by making attempts on an irregular schedule, a few attempts per hour. That will not be caught by any rate limiter as it would make the service unusable for regular users with fat fingers or misconfigured keyboards.

Reply on news.ycombinator.com