4

Long story short, I'm not particularly concerned about an attacker stealing my password when I log in to a website. I don't usually log in on untrusted networks, and when I do I make a point of double-checking SSL certificates. I never keep my passwords on my computer. I always log out of websites on my laptop, which is the only computer that leaves my home. And so on.

So the only real way I can see an attacker gaining access to an online account is by either:

  1. Brute-forcing my password through a login page.
  2. Getting access to a password database from the targeted website.

In the former case, I understand how 2FA will protect me. But will it protect me in the latter case? Similarly, what about public key authentication (not 2FA, but there's no password to leak)?

Improve this question
10
  • Phishing can hit you at home too.
    – MiaoHatola
    Commented Mar 27, 2017 at 8:11
  • Another scenario to consider: attacker has malware on your computer capturing all passwords.
    – paj28
    Commented Mar 27, 2017 at 8:18
  • Good question! I think the answer will depend on what the second factor is.
    – Anders
    Commented Mar 27, 2017 at 8:22
  • @MiaoHatola I never receive phishing emails, and if I did I know not to respond to them.
    – micheal65536
    Commented Mar 27, 2017 at 8:25
  • @paj28 Highly unlikely. I use Linux and never run arbitrary code off the internet other than in a virtual machine.
    – micheal65536
    Commented Mar 27, 2017 at 8:26

1 Answer 1

Reset to default
3

It depends on what exactly was breached

If the breach is just user names and passwords, then 2FA does indeed protect you in this case.

However, if the attacker can extract passwords, who knows what else they can extract? One-time passwords are based on a secret key shared between the client and server. If the breach allows an attacker to extract the secret keys, they can then generate fake OTPs, so 2FA does not protect you.

It is good practice to hash passwords before storing in a database, which provides some protection in case of a breach. It is not possible to hash the secret key for a OTP - the server needs the original secret key to verify the submitted OTP. Because of this, it is good practice to have a dedicated microservice for OTP verification. If the main application is compromised, hopefully the microservice will not be.

Public key authentication

In this case the server only has the public key. A server breach cannot reveal the private key. In the case of a read-only database breach, an attacker cannot then login as you. However, if there was a read-and-write breach, an attacker could overwrite your public key with their own, and proceed to impersonate you.

Improve this answer
5
  • So I take it that in a typical "attacker gained access to server, databases have been leaked" situation, 2FA isn't secure but public keys are? In that case, I wonder why more services don't accept public key authentication.
    – micheal65536
    Commented Mar 27, 2017 at 8:47
  • @MichealJohnson - It's because of practicalities not security. People want to login from a range of devices, while a private key tends to remain on your home system. There are technologies to make private keys more portable (e.g. smartcards) but in the past these have been seen as a high-end enterprise solution, not for consumers. I do think we'll see more use of public key authentication in the future.
    – paj28
    Commented Mar 27, 2017 at 8:52
  • 1
    That depends what the second factor is. U2F keys are not vulnerable in this way, because the attacker can't get or create a U2F key whose key handle matches what's in the database. He can only get into the account if he gets write access to the database so that he can overwrite the saved key handle with his own.
    – Mike Scott
    Commented Mar 27, 2017 at 8:54
  • @paj28 I carry my SSH private keys around on my laptop and my phone. I'd have no problem doing the same with a private key which is used by my browser when I log into websites.
    – micheal65536
    Commented Mar 27, 2017 at 16:04
  • @MichealJohnson - Looking backwards, it's ended up this way because websites are usually designed for people who are less technical than yourself. Looking forwards, I do think we'll see more public key auth in future, like U2F that Mike mentioned.
    – paj28
    Commented Mar 27, 2017 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .