Hot answers tagged

119

Your password was not stolen. As you pointed out, Opera Mini uses proxy servers. Per the link provided in thexacre's answer, Google incorrectly identifies the servers as being in Nairobi, Kenya: When you use Opera Mini, you're connected to Opera servers, which download websites you want, compress and transform them, and at the end they are sent to ...


82

As you noted, the main three are: Something you know Something you have Something you are I'd argue that there are others: Something you can do, e.g. accurately reproducing a signature. Something you exhibit, e.g. a particular personality trait, or even neurological behaviour that could be read by an fMRI. These are not strictly "are" features, as ...


46

The answers I've gotten have been good, but I wanted to provide a bit more depth, going specifically in to why the system exists at all, which should explain a bit more about what it's good for. Disclaimer: While I now work for Google, I don't work on anything related to this project, and I have no proprietary knowledge about any of this stuff. ...


42

Seeing as you're using Opera Mini this is a likely explanation: Unlike straightforward web browsers, Opera Mini fetches all content through a proxy server and reformats web pages into a format more suitable for small screens. https://en.wikipedia.org/wiki/Opera_Mini Of course it's difficult to be certain, and 2FA is still vulnerable to certain ...


32

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...


32

Absolutely! Somewhere you are is quite widely used in corporate IT. In many environments, if you are on an office network, you can login using only a password, but if you are out of the office you must use an additional factor, usually a token. The current time is arguably another authentication factor, a classic example being a time delay safe. Office ...


30

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...


29

U2F is capable of using an encrypted channel using public key crypto to ensure ONLY the right server can get the one time token. This means plugging it in when on a phishing site means nothing happens, they can't get into your account. Instead they have to rely on technical attacks like XSS and local malware. It is supposed to be able to hide the fact that ...


24

Passwords and biometrics have distinct characteristics. Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...


24

Nope. There are three. All others mentioned here either: can be reduced to one of canonical three (e.g. "something you can do" is a personal feature, so classified as "something you are"; "someone you know" means you can present a proof of connection to someone - that's "something you have"!) are not part of authentication, but authorization (time, network ...


23

This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system: Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy. Using 2Factor auth ensures that an ...


21

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily. If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.


20

I have not yet fully explored the spec. But: In what way is U2F fundamentally different from OTP? U2F is not using an OTP. It is really about site authentication and using possession of a private key as a factor. How does U2F affect the feasibility of phishing attacks in comparison to OTP systems? Time-bound OTP systems do an excellent job of combating ...


19

Specifically for Google, if you use two-factor authentication it is safe to "weaken" your password "from a 16-character password with a search space on the order of 1030 to an 8-character password with a search space on the order of 1014" as long as you use a good 8-character password (i.e. completely random and not re-used across sites). The strength of ...


18

Abstracted across a network, most biometrics implementations can still be boiled down to the category of "something you know". For a discussion of how that happens with "something you have," take a look at How is "something you have" typically defined for "two-factor" authentication?. Biometrics suffers from a problem where once a ...


17

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


17

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”. To use one of my favourite buzzwords… it all comes down to Threat Modelling. What exactly are you trying to protect against? Is it a technical attacker who might be able ...


16

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


15

If you're willing to delegate your user authentication function to someone else, then Google's two factor authentication is a good option.


15

Biometrics can be effective as authentication or as identification, but not both at the same time. According to Wikipedia, retinal scans are accurate to approximately one in one million, meaning on the earth today there are approximately 7,000 individuals who will be identified as you in a retinal scan. Assuming no further authentication is necessary, ...


14

A weak password + two-factor authentication might still be safer than a strong password alone but it will be less safe than a strong password + two-factor authentication. It all depends on how weak you go: if you go all the way and make the password trivial you effectively end up with one-factor authentication (the Google text message to your phone). But ...


14

I think this works a bit like a home alarm system sign. Just the sign itself in your front lawn will deter burglars from even trying to get into your home because of how much more difficult it looks like it will be. In a similar sense, having this achievement acts like the sign: if an attacker saw this they might not even try to get into this account ...


13

I'm assuming that you mean for logon (or unlocking). I believe three factor is supported natively in Windows 7 with: Windows Biometric Service (requires attched device) PIV-compliant smart card (requires attached device) Password (Kerberos V5 for AD, and NTLMv2 for local) Windows Vista and Windows 7 have the same interactive logon architecture. They use ...


13

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users. So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to ...


13

I just read some of the specs because I wanted to know if the device stores the actual (private) keys. I can try to answer some of the questions. OTP are simply one-time tokens, while U2F is based on public key cryptography; more specifically, the Yubico Fido U2F key seems to use elliptical curve cryptography. U2F should help to protect against phishing ...


12

There are significant problems with all of these as a primary identifier. For example: Fingerprints/Palm - What happens if I fall off my bike and scuff my hand across the ground? My fingerprints are ruined for some time - possibly permanently. DNA - have you seen how easy it is to pick up blood or other material containing DNA? Typing - this has some ...


12

"Biometrics" and "100% accuracy" are distracting the other people answering from the core question: "Are there any other benefits to MFA?" and that the answer is in fact Yes, there are other security benefits to MFA. You're 100% certain you can identify everyone connecting to your site. You correctly reject an attacker attempting to brute force their way ...


12

There are a few benefits that persist in 2FA: A keylogger can't make use of my 2FA passwords for later. I can't share my 2FA with somebody on an ongoing basis. I'm more likely to know my 2FA credentials are compromised (e.g., because my token is missing) than somebody simply copying my sticky note hidden in my wallet. Somebody who phishes you will be have ...


11

There's a few other reasons: Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics. User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks. Security best ...



Only top voted, non community-wiki answers of a minimum length are eligible