[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHG8knDP0qd1Y-5qzs=Ajeb9pAp4ggcdaHx6NYqc7aJBYV666w@mail.gmail.com>
Date: Sun, 3 Jul 2016 20:11:58 +0300
From: ArkanoiD <ark@...ex.net>
To: passwords@...ts.openwall.com
Subject: Re: 2-Factor vs Authentication
I remember well how it all began.
I used OTP device since 1996, it was Prolinear Pocket PC (an MS-DOS
handheld), with S/Key calculator (now known to be broken, ironically) --
and I tried to convince other people in the company to use OTP too, either
way (desktop, handheld or whatever) without much success.Then it was my
first smartphone, Nokia 9000i, in 1998.
When SMS authentication was invented a few years later, it was KNOWN to be
insecure, and it was widely discussed at that time (and yes, SS7 and fake
base station attacks were mentioned that early as well). The common
consensus was that SMS is bad and insecure, yet attacks are expensive and
rare enough so there is some value in this "poor man's OTP", still
SMS+password being better than password alone, thus adding extra layer
won't hurt.
What could possibly go wrong? :-)) It was never meant to be the only factor.
On Sat, Jul 2, 2016 at 6:41 PM, e@...tmx.net <e@...tmx.net> wrote:
> On 07/02/2016 05:20 PM, Yoha wrote:
>
>> Le 02/07/2016 à 17:10, e@...tmx.net a écrit :
>>
>>> On 07/02/2016 04:47 PM, Yoha wrote:
>>>
>>>> Definitely agree with the most common form of 2FA.
>>>>
>>>
>>> the emphasis is:
>>> the most common variant of any "new technology"
>>> advocated for by the major market players
>>> with a choir of "experts" and "gurus"
>>> is always a very harmful piece crap,
>>> guaranteed to compromise users security;
>>> and the populus plays along happy and trustful.
>>>
>>>
>>>
>> Sorry, I was not clear. I meant: I agree with your point of view,
>> regarding this approach (sending a confirmation code), which seems to be
>> the most common one from my personal experience.
>>
>
> for the sake of a rant i must add:
> all modern days security "innovations" are founded on a multitude of
> wildly deranged assumptions.
> people simply overlook all those assumptions: if we call "my" phone number
> "my", it must be really mine, doesn't it?
>
>
> [TOPT](
>>>> https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm)
>>>>
>>>> are very easy to use, more secure than confirmation codes, *and* much
>>>> faster (there are sometimes delays of a few minutes before the
>>>> confirmation codes is received). Additionally, they allow better
>>>> flexibility (e.g. when using multiple phones).
>>>>
>>>
>>> in other words, the second factor is defined here as:
>>> preshared piece of software.
>>>
>>> seems ok, but i am devoid of any deep insight on that.
>>>
>>>
>> Well, there is not deep insight, it just look like the correct way to do
>> any 2FA since, as you described previously, sending a confirmation code
>> may not add that much security.
>>
>>
> so far, it very difficult for me to determine if a well designed and
> perfectly safe second factor actually improves anything at all.
>
> i _FEEL_ as if a hardware second factor (something i carry in my pocket)
> may have improved auth procedure in the sense of further reducing
> false-positive authentications.
>
> taking that a basis (like an ideal second factor)
> we may claim that a piece of preshared software may in theory be
> equivalent to the hardware token. _IF_ customised to be sufficiently
> unique, and run on a secure device. But here is the trap -- all commonly
> available devices are absolutely ANTI-secure. All your phones are hijacked
> by google and apple since the conception. so the software approach to the
> second factor is seriously undermined.
>
> in addition to my theoretic question, i began with: "if it actually add
> security at all? in the ideal world"
> we now have another, practical, question:
> does it add any significant amount of security, given that your CUSTOM
> software is shared with the entire google corp.
>
> -e
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
