How should 2FA/MFA be implemented so it isn't easily bypassed?

Question

At least twice now I heard most sites implement 2FA/MFA poorly and after X amount of attempts it should lock you out. They didn't give clear enough information for me to know what they're talking about, actually they were complete shit at articulating their words so I suspect they have no idea about anything but hearing it enough made me wonder

How should 2FA/MFA be implemented? What are common threats? I heard from bad sources that people bypass TOTP by creating a phishing site and basically MITM the password and code. Another source said some attackers do credential stuffing and if they find hits they'll send codes, which I'm assuming isn't TOTP but an activation link a user can click on to grant access? I have no idea why people mention locking out after X tries since neither attacks seem to be trying many times.

So far from what I can tell I should do the following

• Rate limit the password so an attacker can't try 10+ passwords for a specific user, or 100s of passwords from a single IP address
• Don't send SMS links unless maybe they have to click confirm allow the user in after clicking the link?

I'm not sure what else I should do related to multi factor authentication

Answer 1

If a site does 2FA, by asking you to enter a passcode that they send you, nobody knows the passcode. But someone can try to log into the website on one computer, and trick you into entering the passcode into a spoofed site, and then type what you entered into the real website. In that situation, the attacker wouldn't enter 10 or 100 passwords but at most the one or two that you would enter.

So the rate limiting will help against stupid brute force attacks and should be done. What would be excellent would be if you don't count the same incorrect password used multiple times (I'm entering a password meant for another site). Sending a password through text message that the user has to enter, that's dangerous because an attacker might get hold of that message. What's reasonably safe is a tool installed on the user's device that shows a different password every 30 seconds, and your server and my device agree about valid passcodes without communication after the tool is installed.

Answer 2

Some methods of 2FA, like TLS client certificates on smart cards, and WebAuthn (e.g., YubiKeys), are unphishable. If you use such a method to log in to a phishing site, it won't be able to pass your credential to the real site to impersonate you.

Answer 3

I don't believe there is any way in the current way TOTP or SMS codes are implemented of preventing man in the middle attacks. TOTP codes are setup once and from then on are independent of the originating web site. Two factor using TOTP or SMS is better than nothing, but are easily bypassed by tricking the user into using a fake intermediary site. TOTP and SMS codes as security are dead ends. Some would argue they provide a false sense of security by lowering a users inhibitions from interacting with a MITM site.