Hacker News Reader

Comment by tomphoolery | Hacker News Reader

"I don't keep any cookies or browse history"

Why not?

"I get the numeric code sent to me. I go to Google Voice on my computer"

This seems like it defeats the purpose of 2FA. Am I wrong? Isn't 2FA supposed to work by proving that you own a device for which it was set up on?

"always download all the images made by Google Charts because that service will die at some point"

Probably. If it matters to you, learn some JavaScript and build stuff in highcharts. And next time, never rely on a service that you don't pay for.

Also, it's clear by this post you hate Google, especially its suite of exceptionally shitty products, and not the Web.

View on HN

Regarding image-google-chart, and other google APIs: I was going to voice my support for this complaint, as I have a number of still popular projects that use it (and will need fixes or updates), but I had to rethink that.

Conclusion: free lunch is over. Some of us developers are learning that we can't rely on a free (or even paid) service for any long term.

> Conclusion: free lunch is over. Some of us developers are learning that we can't rely on a free (or even paid) service for any long term.

I totally agree. SaaS is ephemeral. Personally I don't expect to see a SaaS site being active for more than two-three years, because the goal of most startups is to get bought, at which point they'll happily let the product die or turn into a piece of crap. If I use a third party service, I do that with an expectation that my project is temporary and will die/get superseded faster than the service it relies on.

"This seems like it defeats the purpose of 2FA. Am I wrong? Isn't 2FA supposed to work by proving that you own a device for which it was set up on?"

The bug is in the design of 2FA. Sooner or later Google will get rid of GV and I'll just move to another provider to front-end my SMS spam instead of sending it to my phone. The other failure mode is best displayed by my bank not realizing their site is accessible via mobile, so my two factors when customers log in on their phones are the phone people log in with and the code they're sending to the customer's phone, oh wait that's only one factor. Although in the second example the bank wins by security theater.

The bank does offer a phone app that demands access to pretty much everything on my phone presumably for marketing / spam purposes or just being weirdo creeps, so needless to say I won't leave it installed, although I did try it for a short period of time. However the bank phone app sucks so I didn't lose much by uninstalling that creep-app. Also the creep-app doesn't do 2FA and seems to be permanently logged in, so I've downgraded my account access to merely the phone lock screen level of security, which isn't very good.

Damn. I never thought I'd be happy about my usually behind-the-curve bank, but my bank's app has me type in my user code, password and then identify with my fingerprint. Now, someone could still steal my phone and login to the banks website -- but that'd also require my fingerprint or cracking the very long passphrase, which while it can be done, if that's what I'm up against I've probably got bigger issues than my bank account being raided...

The "factors" in 2FA are most commonly, something you know (a username/password) combination and something you have (your phone).

Even if you log on on your phone, it's still something you know and something you have, this does not diminish the 2FA.

2FA means something [only] you know and something [only] you have (the phone number), the 3rd factor is usually something you are (biometric).

So using a password and the SMS on the phone is still 2FA as far as I know.

However, I also consider my home PC to be safe enough that I don't want 2FA on it. Nope, banks apparently don't want to waste money on considering this user story. Or that what about registering multiple tokens/phone numbers. Got a new phone? Just burn the old one, you can't have backup login methods!

Also the creep-app (...) seems to be permanently logged in

That's terrible. My bank's app is actually really insistent on logging me out; just locking the screen or switching apps will immediately lock it - though it doesn't lose internal state, which is nice.

> The bug is in the design of 2FA

While 2FA is often phrased as “Something you know and something you have”, I find that misleading. Knowledge is acquired from information, and the way they check what you have is through information alone.

What it really proves is that the telephony system authenticates you as part of their network. That authentication is done by the SIM card, which it is assumed you have unlocked with a password of entropy 13.3 if it's a PIN code with four random digits.

That, and your actual password.

By far the easiest way to get incorrectly identified through the telephony system is to break the PIN code, which requires to have physical access to your SIM card. But if all your secure HTTP cookies and/or your keyrings are only protected by that as well, then yes, your 2FA has a single point of failure. It goes from an arbitrarily strong password and something you have to a 13-bit entropy password and something you have. Or, if like so many you leak PIN code information from your life or the traces you leave on the surface of your phone, just something you have.

Bank security theater is positively hilarious.

"Pick a security picture, now write a security phrase. Please choose three security questions. Now enter a password. Would you like to enable 2FA on your phone?"

I'm not sure on the positive hilariousness.

My bank's mobile app does not work on rooted phones, because they are concerned for my safety, afraid that some rogue app will get my banking info and steal my money. Well, that's my problem, isn't it?

Do you know how most people with custom ROMs bypass this? They go on XDA and download a patched version from some stranger on the internet, stored on some malware-ridden file hosting service.

Upvote for "never rely on a service that you don't pay for"; I think that idea needs to be said out loud more often.

How exactly does paying come into the picture here. I'd bet that, for example, FoundationDB's customers would disagree with you.

Because it enables a very simple transaction: I am exchanging money for your good and/or service, so you try to provide me the best experience you can.

If Starbucks gave away free coffee but monetized their restrooms, their coffee would eventually end up full of diuretics.

It doesn't work with SaaS startups. The goal of a typical startup is to get bought. The so-called "exit". Which basically means they don't give a crap about their users. They'll lie to you on their front page that the want to create an awesome service, but it's all a trick to get you to sign up - because the more people sign up, the bigger growth they have, and the better chance of getting bought. And when the buy offer comes, the product gets shut down, paying customers or not.

It might not hold always, but it is a very good rule-of-thumb.

Normally, a company (either startup or not) cares most for its clients, because they are the ones that pay its topline and ultimately its workers' salaries. Other parties (users, providers, government, whatever) also have power and can also influence the company's behaviour, but clients normally have it easiest.

That does not always hold, as I said. Another example is you being a commodity client; if the company is, for example, more interested on big clients, your interests might not be the first concern for that company. But they will have you in mind, nonetheless, as the bad service you receive can signal something bad for bigger clients. Sometimes, even big clients are commodities, as they can't wield a lot of power, so the company can act not in its client's best interests (monopolies or tax burden when price is inelastic are scenarios that come quickly to mind).

That's why I mentioned SaaS startups - because they're both an exception to your rule and something HN demographic has to deal with a lot.

I still don't buy that rule though. Let me illustrate it by a graph:

                                 .....
     |             ooooooo ......     .
     |          ooo    ....oo          ...
     |       ooo   ....      ooo          ....
     |     oo    ..             oo            ..
     |    o    ..                 o             ..
     |   o   ..                    oo             . profits
     |  o   .                        oo
     |  o ..                           o user satisafaction
    -+-o-.---------------------------------------------------->

Companies have figured out that the point of maximum profit is not aligned with the point of maximum user satisfaction, and they only care about the former - the latter is a proxy. In every mature market we're past maximum user satisfaction point, and this is what we perceive as "products getting crappier".

I agree, but to some extent I think we all do pay for Google services. They sit at the junction of just about everything we do online, and they've turned everything we do, look at, hear, say. etc. into a commodity data product that they sell over and over again. The services are either compensation or bait, depending on how you want to look at it :).

Reply on news.ycombinator.com