Cybercriminals stealing the Oauth2 tokens after users authenticate with 2FA:
Fuck the 2 factor bullshit. I’ve lost many accounts just because I moved to another country and changed my number. I still know the password, It is my account but I can’t login just because the asshole who created 2 factor authentication never moved out of his parent’s basement.
Unfortunately, it’s often implemented as two-step authentication though. Like asking for a password and an answer to a security question. Those are both something you know. Two-factor authentication would involve two of these factors: something you know, something you have, and something you are.
I do live in a state of constant dread of losing my phone, or having it break down, or getting a new phone now, but at least things are “secure” again *sigh
I was all for it and even bought a USB dongle to make it super easy. Turns out this shit doesn’t work anywhere. Fuck 2FA if nobody implements decent mechanisms.
Basically, you have:
- TOTP - no particular investment needed, so very popular, but a bit onerous
- Various MFA vendors that tie into their cloud services. I hate these since it means I generally have to get additional apps, with uneven platform support
- Webauthn/Passkey - Cool, integration with my phone, a Fido usb key, windows hello if applicable, no need for external service, uses asymmetric encryption so it’s not shared secret and it’s more convenient… Almost no one bothers to implement it for their service though, despite it being pretty damn easy.
2-factor would be fine if it didn’t have to involve my phone. It’s such a pain in the ass. Like a second password would be fine, so my password manager could just do both at once.
I don’t think you get why 2fa is more secure. That would be basically the same as having one password.
Here’s a little scenario that played out at work the other day…
Dramatis personae:
M - who is Me. Customer service agent extrodinaire.
C - who is a dumbass cranky customer
Our scene opens on your humble narrator diligently toiling at his work station
M: Thank you for calling The Company, my name is M, may I have your name please?
C: yeah yeah, my name is C, and I got a lot of problems with you people! Do you know how many times that damned robot voice tried to send me messages? I just want to talk to a person dammit!
M: I’m so sorry to hear you’re having a bad experience sir! I’ll be happy to help you with anything you need, but it does appear you have enabled two factor authentication, so I’ll need to send a link to your phone so I can access your account
C: THIS IS FUCKING RIDICULOUS! YOU CAN’T JUST TELL ME WHAT I WANT??? I PAY YOU PEOPLE A FORTUNE EVERY MONTH AND I CAN’T EVEN ASK A DAMNED QUESTION??? THIS COMPANY IS A FUCKING JOKE!!!
M: Yes sir, I know the enhanced security requirements can be frustrating, but unfortunately we’ve had to update them in order to make sure our customers accounts remain secure. It should just take a moment for me to send the message though and all you have to do is click the link! Can I go ahead and send it to your number on file?
C: are you fucking kidding me here? Is this what I pay for every goddamned month??? ALL I WANT TO DO IS ASK A QUESTION AND YOU ARE REFUSING TO HELP ME!!! GET ME YOUR SUPERVISOR! NOW!
M: again sir, I understand how frustrating this can be. Unfortunately in order to protect your security, I cannot give you any information or transfer you to anyone else until we have verified your account. If you would prefer not to verify the account that is certainly your right though. Was there anything else I can help you with today?
C: (sighs dramatically) fine… just send me the goddamned thing… I’m leaving this joke of a company tomorrow though.
M: well sir I would hate for you to have to go to a competitor who doesn’t value your security as much as we do here at The Company. I’ll send that message out. You should be getting it right… now
(Mr C grumbles incoherently as he clicks the link. It takes him all of two seconds.)
C: THERE! I did what you ORDERED! Now will you PLEASE help me with my account???
M: Absolutely sir! What can I help you with today?
C: I have gotten at least 20 messages from you people today telling me some bullshit about approving an order being placed on my account! I DIDN’T ORDER ANYTHING!!! DO YOU PEOPLE EVEN KNOW WHAT YOU’RE DOING OVER THERE???
(I pause to take a brief respite and collect my thoughts as I feel a little piece of my soul dying)
M: That is a very serious issue sir! It appears someone was attempting to access your account online, and nearly managed to place an order for almost $5000 worth of equipment! It looks like the order was canceled because they couldn’t get past your (here it comes) enhanced two factor authentication requirements.
C: …oh. Thank you have a nice day (click)
(I scream internally, yet god does not listen)
END SCENE
I do miss Tales from tech support.
