Authentication for my work email: Enter 28 character password, receive sms, enter message, log in
Authentication for my Battle.net account:
-Enter email made before 2000 because they don’t let you change email
-Enter password
-Get rejected
-Solve CAPTCHA
-Try backup passwords, get rejected
-Request new password
-Send request to 24 year old email
-Try to log on to 24 year old email, email is suspicious and sends Authentication request to my newer email
-Open newer email, Authenticate older email
-open old email, Put in code to battle.net
-Battle.net requests Authenticator code from Battle.net app
-Open battle.net app (no requests)
-Try manual code, doesn’t work
- Realize Battle.net app Authenticator not connected
-Try to connect Battle.net app Authenticator to account
-Realize you cannot connect Authenticator without signing in AND signing in requires Authenticator
-Close Battle.net app
-Open Blizzard Authenticator
-Close warning that this app got depreciated in January
-Enter manual code
-it works
-Attempt to change password to password I first attempted
-Won’t let me use same password
-Try logging in using that password
-Still doesn’t work - Solve one more CAPTCHA
-Change password to backup password and back to original password - have to solve 2 more Captchas
-Finally works
-Log in
That just kept going. I feel you, but maybe try a password manager? You open it up, type blizzard and it tells you exactly what password you used. Even better, it can generate really good passwords for you.
I use bitwarden.
It didn’t accept the password that was set.
NIST has been saying since 2016 not to use SMS for MFA. It’s always been horribly insecure.
@return2ozma @technology
10 years ago, the Feds wanted backdoors to all of phones so they could read all of our text messages. Now, the Feds want everyone not to use software that has backdoors so the Chinese cannot read our phones. The Feds don’t want competition.The backdoors they use are there for freedom and justice, the backdoors the “others” use are tools of evil and security risks!
“They’re the same picture”
Why do you hate America’s children?
For real, I bet this guy didn’t back the “Definitely Don’t Maybe Not Almost Probably Save The Children ACT.”
Braindead take of the day.
Your comment applies more to your own than the one you responded to. It’s a crazy form of recursion.
Nah that’s just your own wishful thinking.
The backdoors they use are there for freedom and justice, the backdoors the “others” use are tools of evil and security risks!
did you forget to add “/s” or do you really believe what you wrote?
Sometimes sarcasm is clear enough without signalling it. I guess not for everyone.
It was a joke, bruh!
Edit: Huh. Guess people downvoting didn’t read up on Poe’s Law posted above. Shocked! Well, not that shocked.
For clarity, I was being satirical.
Yes
-signed, DefinitelyNotAFed@Federal.Bureau
Absolutely. They were so arrogant they never thought it would happen to us. After all, we are in charge of our own networks so why would we expect the enemy to be at the gates? Let’s make those gates out of cardboard so it’s easier to spy on everyone.
Of course then you have things like CALEA mandating a back door, you have cheap telecom companies that will happily buy cheap lowest bidder Chinese hardware and install it "everywhere* without concern for security (after all, it’s not their data being stolen) and now the enemy isn’t just at the gates but inside the walls.
A decade ago, making sure the feds could read everyone’s mail was the national security priority. Suddenly when the Chinese can read everyone’s mail, good security is the national security priority.
It’s too bad there was no way to predict this in advance. Oh wait…
So many services still don’t even offer 2FA at all. Any service that stores payment information and PII without any 2FA options, let alone a secure one, at this point are a disgrace.
Banks, I’m looking at you
I hate forced 2FA that you can’t disable anyway. I don’t want to waste time waiting for an insecure text, I don’t want to input an unencrypted code you sent to my email, I don’t want to click your damn notification that runs through Play Services, and no I’m not enrolling in passwordless auth. I don’t need to be babied into securing my accounts. Any account I do actively and willingly secure is already using TOTP. Let me put in my username and password, then kindly fuck off.
Yeah. So you, myself, and some others are the exception to the rule. But, you can’t look at it that way because its a ‘lowest common denominator’ problem. The least secure of us means we are all only as secure. Others need to be hand held.
It’s definitely time to raise all boats and drop SMS 2fa like a hot rock.
The most natural authentication mechanism for humans is a key. That thing you carry with yourself. A physical key containing, well, the actual secret (shouldn’t be retrievable, should be used for decrypting access request and signing the response) that, maybe combined with your password (another natural for humans authentication mechanism) or maybe, yes, TOTP, gives you access.
Like those “security keys” Imperial officers in Jedi Outcast carry with them. Maybe a bad example.
Phone numbers are used as identifiers because governments like it, nerds don’t like it, and normies explicitly like what nerds don’t like and also want everything to be insecure, they call it “having nothing to hide”.
Also “normal and social” people have that idea that their social prowess is more elegant, smarter at ensuring their security that those dumb and boring nerd technical solutions. So them always choosing things logically opposite of sane, like social media instead of forums, and phone numbers instead of any other identifier, is literally a matter of principle. It’s really not that hard to use something else. They do the stupidest possible thing technically to prove a point that you only have to do the smart thing socially. I mean, in Galileo Galilei’s case the other side of the disagreement is generally considered right, but that’s not an argument effective in society.
I should admit that I’ve been doing the opposite - the stupidest possible thing socially to prove a point that only technical sense matters, which is why nobody would send me encrypted mail except Facebook with its notifications, and nobody would write me in Tox, and nobody would even contact me via XMMP. Which is why I’m now using TG, VK, FB, WA and Signal for communication, of these Signal is secure, and WA is kinda better than the rest of them.
You can apply this logic to nearly anything with very bad consequences.
is already using TOTP.
A lot of things are moving to phishing-resistant technologies like FIDO2/WebAuthn or passkeys. All my important accounts, like my password manager, are secured using Yubikeys (one that I keep with me and one as a backup in a secure place).
The end of an era.
Or actually, probably not until we redo whole cellular phone technology works and kick out all the bad actors using SS7 vulnerabilities for stuff like spoofing numbers and stealing messages. We really shouldn’t be using a 45 year old system for almost all communications.
In their defense, they JUST applied an update in March 1993, so they’re knocking on the doors of cutting edge technology updates -_-
Edit: added link
Use Telegram.
Not the app, the 200 year old wire radio messaging system based on Morse code, E2EE (Elderly man to Elderly man Enciphered)
I guarantee you that is the opposite of a solution, old man encryption is very easily hacked by other old men for spoofing, redirecting, or listening.
if you count whiskey and cigars as hacking
Why the hell is this in 4K HDR?
Only the best for the worst hack in history.
We here at Lemmy are professionals
Oh it turns out we needed NSA to do its actual fucking job after all rather than holding onto exploits for the surveillance state.
Now — for the second time — we have an adversarial administration eager to weaponize government departments while Americans are vulnerable. Why? Because America is the good guys and would never abuse its extrajudicial powers (say, by detaining, rendering and torturing Americans with names similar to those of POIs.)
We could have had twenty-four years of robust communications security developments if NSA didnt sell the public out like Judas.
rendering
Wait, are they melting people down to make soap now? Fight Club wasn’t just a meme then…
Extraordinary Rendition is the euphemism from the aughts from which the movie Rendition was titled. It means taking your detainee somewhere else, often across national borders, to a black site, usually to do things there for plausible deniability (e.g. we don’t torture in the United States )
Looks like I missed that movie, I’ll have to check it out.
And I don’t think I’ve ever heard the term “rendering” used in that context, I guess we just used other terminology. Thanks!
Oh man it sure would be nice if the feds had the power to regulate something like this /s
They did. That’s the reason for this hack, they wanted Lawful Interception, they got their backdoor. It’s what professionals and privacy advocates said all along, if it exists it will be abused.
This isn’t a hack in the way you’re thinking of, nor is it a product of government mandated interception, or a back door. The salt typhoon event you’re referring to is nothing more than the tip of the iceberg of a much bigger problem, which is abuse of the dated SS7 system we’ve known about for decades.
Do you have a source for this claim? I’d like to repeat it elsewhere…
I.e. this article from October: https://www.techradar.com/pro/chinese-hackers-allegedly-hit-us-wiretap-systems-to-hit-broadband-networks
In an all too predictable turn of events, Salt Typhoon, an infamous Chinese state actor, has reportedly hijacked government systems to breach several American broadband providers and gain access to the interception portals required by US law.
Thanks for bringing receipts. In stark contrast to my experience on Reddit, Lemmings usually seem allergic to showing their work for some reason.
Yeah, I don’t get it. I go out of my way to provide sources even before being asked.
What’s really frustrating is when others users criticize me for providing evidence that could be used to counter my claim. I’m not trying to win arguments, I’m trying to show my work so others can correct me if I missed something. I’m here to learn and educate, in that order, yet so many only seem interested in engaging in discussion that jives w/ their existing opinions. That was a problem on Reddit too, but at least someone would chime in w/ sources much of the time.
Its essentially what the apple vs FBI encryption legal battle was about years ago:
https://en.m.wikipedia.org/wiki/Apple–FBI_encryption_dispute
I’m not really a fan of apple, but I was very happy they stood their ground on that one. They were absolutely right to do so.
The public broohaha surrounding that event makes me think Apple is providing a back door and this psyop was to make people comfortable trusting Apple.
Just a theory though. But apple is all proprietary so nothing is stopping them from doing whatever they want or what ever FISA order said.
I still don’t trust them, especially when they announced they were scanning images. I don’t really care their reasons for it, that’s intrusive. I can’t trust any closed source tech, no matter what they say.
Always has been
Been saying that for years. It’s about damn time.
SMS spoofing and SIM swapping have been around for ages. It was never secure and that’s always been known. The number of companies that rely on it despite sending me a zillion other fucking useless emails is too damn high! Email, or better yet, an authenticator app, are far more secure. Not perfect, but better.
One big reason I’m hesitant to keep my money in banks is because banks think the best form of two-factor authentication is text message based 2FA and I’m like that’s barely any 2FA at all.
My banks are like that too. Of course I can’t speak to anyone who might influence that decision. Steam has better security than almost any other account I have. I appreciate them for that but it also seems ludicrous to me that my video games are more secure than my bank accounts.
I keep my money in Monero. That way, it’s me who has to be targeted instead of an institution. And if I fuck up and lose it, it’s my own damn fault.
I have some crypto, some stocks, etc. For many things I still need standard banking though. Crypto just isn’t there yet. Maybe someday… But having money distributed is still smart either way, so I have many baskets for my eggs.
I keep a little bit in the bank, like enough to pay my bills and such, but any extra I put into Monero.
Wait, how is email more secure than SMS?
https://en.m.wikipedia.org/wiki/SMS_spoofing
So, it’s not that the message itself is insecure, but the inability to verify the sender makes phishing attacks possible or similar things. I get a text from a random number saying “click this link to pay your bill!” And I don’t have any way to trust its legit.
SIM swaps make it so people can take over your phone number temporarily and then generate 2fa requests to gain access to accounts. Doing the swap usually involves bribing someone or gaining access to a providers database by other means, but its been done a lot.
There are ways to prevent this, but the most straight forward is using a MFA app. Barring that 2FA via email is the next best thing.
Forgive my ignorance, aren’t emails sent in plain text that can be read by any of the networks they are passed between? I’ve always been taught email is the least secure of any communication.
I’m not a security expert so my ability to explain is limited, but no, emails have long used encryption protocols like SSL to prevent such problems. However, your email provider may scan and read your emails. That’s not much different than a text message service reading those messages, but you can choose your provider. From what I can tell proton.me is the way to go for resolving that issue - they provide encryption which prevents their own machines and employees from being able to read your messages and other data. Otherwise, your email is basically as secure as your passwords are.
OK, I had no idea what I was talking about, lol. Thanks for responding!
No prob, this stuff is difficult to keep up with. I’m still always learning and hoping I’m doing it right
Since when was sms ever secure? My understanding is that messages are sent in the clear, meaning your carrier and the recipient’s carrier both have the opportunity to intercept messages.
I mean that’s the message content, not the authentication, but still, sms is the opposite of secure, always has been.
Not true. SMS is encrypted in 3G, LTE, 5G. Block cyphers like Kasumi and A/9 are used. SMS is reasonably secure, because it’s hard to infiltrate telecom systems like S7
because it’s hard to infiltrate telecom systems like S7
cough You can pay a few grand and get access to SS7 networks.
Might be out of reach for most of us, but we can rest assured that any and all security firms and goverrnment agencies have access to this information at a moment’s notice.
Simply paying is not sufficient. You need to be a telecom company, or a researcher afaik.
In what world would the US gov care to get into your bank account? Or your Facebook account when it’s already tightly controlled?
it’s hard to infiltrate telecom systems like S7
Telecom systems can be (and are) infiltrated though, which is what the FBI is warning about.
SS7 is very insecure. See this video, too: https://www.youtube.com/watch?v=wVyu7NB7W6Y
Watch the video again to see how hard it was for Derrick to get access. He got it via his telecom/academia researcher contact.
It’s hard, but not hard enough from what I’ve been able to gather. We should want something better IMO. I’m surprised that TOTP isn’t more common.
S7 will be retired or extended with access control. TOTP apps don’t work for edge cases like broken phone. Dedicated token devices get lost. SMS will continue being the main solution for 2FA.
Nah what we need is good privacy-focussed companies getting into the public IAM space.
You know how you can sign into stuff with your Google or Facebook account? And get a 2FA push to your phone?
Like that. Except by a company with a shred of ethics and morality. Like Proton.
I do also think that we all should have a cryptographically secure federally issued identity for official uses such as signing documents or signing into financial accounts and other things that must use your official identity, and not an online pseudonym. Like SSN but on a smartcard. Basically CAC or ECA but for general civilian use.
Proton is already used for identity management: OTP via email. They’ll implement OAuth if there’s enough demand for it. A company’s purpose is to be profitable, ethics side is largely irrelevant.
Many countries already have digital government ID: Australia, Estonia, Russia.
A company’s purpose is to be profitable, ethics side is largely irrelevant.
Maybe so, but companies such as Proton’s biggest asset is their reputation…a reputation of being privacy-focussed. Without that they are nothing, and they know that. As a result, they try to live up to that reputation as well as possible.
Being as it was started by Sir Tim Berners-Lee (among some of CERN’s other founding fathers of the web) is just icing on the cake.
Proton gives data to governments if requested. Why are you trying to shill it?
You can use TOTP with multiple devices. For example with an app on your phone and something like KeePass on your laptop/desktop.
Still not convenient since you don’t walk around with this in your pocket - but it doesn’t have to be just one point of failure.
What about people who only have one device? Kids, elderly, people with only work computer.
I agree, it’s not a perfect system. Even if you do have multiple devices - you may be locked out if you lose your phone while traveling, can have multiple failures.
Although I don’t know what is remotely secure and is elderly friendly. Email or SMS 2FA would have been the closest in mind, but it’s not secure, and plenty of elderly struggle with both.
Pedantic types always mention that secure is only relevant in the context of a particular threat model. The elderly can use hardware authentication like those RSA devices or ubikey. Unfortunately, this is expensive, and banks don’t believe there’s demand for that. Would you switch banks for this feature?
Incoming forced 4-factor authentication
Something you know, something you are, something you have, and something you saw in a dream once when you were a kid at summer camp during a feverish Dr Pepper-overdose-driven fitful sleep at age 12.
of course it is. forced 2fa BY SMS OF ALL THINGS is one of the stupidest ideas
I assume businesses only jumped at the chance to enable SMS 2FA to get their greedy little fingers on our phone numbers.
It was the simplest/cheapest form of 2FA to implement. Grandma will never understand how to setup TOTP.
Capitalism requires regulations, otherwise it will ALWAYS do what is cheapest or most profitable, regardless of how dangerous or destructive.
Even stupider is supporting hardware keys for MFA, but having SMS fallback which can’t be disabled (looking at you, Vanguard). I’d much rather have email as my second factor than SMS, and I literally abandoned a bank (Ally) for removing email as an alternative to SMS.
'nuf said
