1y ago

The OTP you want to use was already used

36 comments

No and stop using SMS it's not secure.
- The least secure part of the sign-in process is the person. It doesn't matter what the 2FA method is.
  You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because "they're from Google". Someone can trick you into making the financial transfer yourself because "you're getting a deal".
  
  Sim swapping
- On some websites, it is the only option.
- Although it's true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn't matter. It still is doing it's job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
  I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
  
  That’s not quite right though, there’s the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).
  Admittedly, I don’t use that feature either, but, it’s not as bad as it seems at first glance.
  
  Arguably, if you use 2FA to access your passwords in 1password, there's little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it's been compromised, and having your OTPs separated wouldn't provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.
  There is one theoretical situation I can think of where having your OTPs and passwords separate could be an advantage, and that's if someone gained all your 1password login details, including the 2FA secret key. But for someone able to gather that much sensitive intel, I'm not sure how much more of a challenge an authenticator app would be.
  If you truly feel you need a second factor though, you'll probably want to look at something like a Yubikey or Titan. I've considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.
  
  This is why we require second factor on the password manager too, otherwise you’re exactly right.
  
  Many password managers use a biometric factor to sign in (your fingerprint, for example, using some kind of auth app if needed). This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
- Stop using 2fa where its not needed. My university library logs me out every 45 minutes and requires microsoft authentication to log in.
  Seriously, whats a hacker going to do if tgey get my password,download a PDF? Send a citation to my Favorites list?
  
  Bulk download a shit ton of research papers through the university's educational license and distribute them for free on the internet, cutting out the completely unnecessary profit driven middle man leading you to eventually do away with yourself due to the pressure from the government and corporations to make an example out of you with a strong sentence.
- But wait it has to be double secure, it has two s's in its name!!

They're gonna fail that ISO27001 audit...
- Only if they tell this to their auditor tbh
  
  We just put the auditor under the floorboards whenever a new one arrives. Saves a lot of hassle. We have around 6 auditors stored this way.

USPS’ website does this, sort of.
If their text service is down it’ll let you know and just skip the 2FA process even though normally they offer an option to get the code via email.
The fact that they do this is bad enough, the fact that this happens so often that I’ve seen this at least a dozen times is even worse.

Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
Please just dont do anything you arent supposed to, my boss will kill me
- Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
  The password you have entered is already used by user RandoMcRandom123, please use another password.

I appreciate the quick hack, but with a little more foresight you could have just put up a blurry jpeg with that number and changed the prompt so it looks like a CAPTCHA. Nobody would have given it a second thought.

36 comments