[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHG8knAQODxtx4NOe9K8=ZhGWR4s9cu-xdvSeqMQh6CrEu4+Yg@mail.gmail.com>
Date: Mon, 4 Jul 2016 18:22:28 +0300
From: ArkanoiD <ark@...ex.net>
To: "e@...tmx.net" <passwords@...ts.openwall.com>
Subject: Re: 2-Factor vs Authentication
Yes, but it is not as simple as that -- there are different scenarios.
There are unauthorized access attacks, availability problems and
availability attacks.
Speaking on unauthorized access, say, we assume that 0.1% of potential
attackers have SS7 access (quite reasonable assumption in a script kiddie
world). And that's it: we reduce false positives one thousand times.
(In real world, it could be not as simple as that. If your potential
adversary _certainly_ has SS7 access, you may actually INCREASE the risk by
weakening password requirements due to second factor. Up to suicidal levels
if it is not second but the only one, as it has been proved with Telegram
hacks of russian political opposition activists recently. But it works for
most people.)
Random availability problems are affordable most of the time: in big cities
people always keep an eye on their phones for other reasons, and make sure
the battery is charged and the subscription is valid. That's why it works,
but there *should* be a way to opt out (and often there is -- like Google
Auth which is in fact TOTP). Though if you invent any method to bypass the
second factor, it becomes the primary attack path (as it happened all the
time with "security questions").
BTW, since your TOTP device is usually your phone, you need to keep it
charged in any circumstances.
Speaking on targeted attacks on availability, there *usually* is a reliable
way to convey more effective attack than to disrupt phone service.
On Mon, Jul 4, 2016 at 3:45 PM, e@...tmx.net <e@...tmx.net> wrote:
> On 07/04/2016 02:25 PM, Ark Arkenoi wrote:
>
>> Yes, exactly: it was meant to massively reduce false positives, while
>> keeping false negatives acceptably low.
>>
>
> false-negatives are never acceptably low, because they tend to occur in
> very critical moments.
> for example, with SMS second factor you lose access to your account when
> travelling -- suddenly the password you carry in your VERY OWN HEAD is no
> longer proof of this head identity -- this is fucking INSULTING.
>
> Your interaction with your virtual representation became dependent on
> fucking many random factors: your phone battery, your provider
> availability, your physical location.
>
> Not mentioning that the assumed attack cost against SS7 is only applicable
> to random strangers -- for the mobile phone operator this cost is ZERO.
> your SMS second factor is compromised by literally many thousands people!
>
> therefore, your initially assumed cost/benefit ratio is far from being
> obvious. for me, it seems too costly, too damaging and barely beneficial at
> all.
>
>
>
>
>
>
>> BTW sms was much less reliable back those days and inter-operator issues
>> happened all the time.
>>
>> Sent from my BlackBerry 10 smartphone.
>> Original Message
>> From: e@...tmx.net
>> Sent: Monday, July 4, 2016 14:34
>> To: passwords@...ts.openwall.com
>> Reply To: passwords@...ts.openwall.com
>> Subject: Re: [passwords] 2-Factor vs Authentication
>>
>> On 07/03/2016 07:11 PM, ArkanoiD wrote:
>>
>> The common consensus was ....
>>> SMS+password being better than password alone, thus adding extra layer
>>> won't hurt.
>>>
>>
>> This is a tremendously extraordinary statement in need of a huge proof.
>>
>> terms "extra layer" and "better" point to merely a cloud of human
>> feelings.
>>
>> I can accept the premise for this statement:
>> adding SMS to password reduces false-positive auth outcomes.
>> (no matter how much and how needed)
>>
>> But it also increase false-negative auth outcomes!!!
>> AND THIS REALLY HURTS.
>> and I speculate sometimes it hurts the security too.
>>
>>
>> and after all, as you now witnessing, when a logically inconsistent
>> bullshit becomes accepted as a part of an info system, it tends to
>> overthrow the logic of the host system and turn it into crap entirely.
>> Same goes to the password policies.
>>
>>
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
