1

Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that required 2nd factor, you can use a 2FA browser plugin just as well (instead of a smartphone app).

You bind yourself to one exclusive machine. It will prevent people from other machines to login on your account from the internet. But you will also limit yourself to this restriction. Convenient, if it's the only machine where you need it; useless, if you need it somewhere else, too.

You may argue about the security of the implementation of such plugins itself. But you may also have this argument about your phone's hardware, operating system and of course the 2FA app as well. The same goes for 2FA accounts, which can be used on multiple machines (and hacked), but still remain a 2nd factor.

Last but not least, nothing prevents you from logging into your account from your smartphone's browser, using the 2FA app on that very same smartphone.

A compromised machine is one of many malicious scenarios where it might get dangerous. But then the attacker might just as well wait for you to perform the login.

Since it's called 2-factor authentication, not 2-devices-authentication, a 2FA browser plugin will fulfil that purpose. And if your security level needs don't require you to follow the Truecrypt password length recommendation of at least 20 random characters you should be fine.

However, there are people, who caution against such plugins, because a 2FA browser plugin is on the same machine and therefore isn't separate from the login process. Hence, they reject the idea and forbid the usage of such a plugin. Are they right?

PS: I'm not arguing that an additional 2nd device wouldn't provide extra security. But it's not a requirement for 2FA.

6
  • A specific example: The application is Docker Desktop, which uses the web browser for the account settings. The web broser ist Edge. The plugin is Authenticator: 2FA Client from mindstorm. Nov 28, 2023 at 14:54
  • 2
    As always, the question when you use a phrase like "sufficient security" is: sufficient security for what? If your threat model is random untargeted password guessing then you may come up with a very different answer from if your threat model is a nation state attacker.
    – Gh0stFish
    Nov 28, 2023 at 15:09
  • @Gh0stFish My threat model is any scenario, that a 10k-20k employee, private, finance business company should expect. ─ The 2FA has add security to developer accounts, accessible on the internet (there is no customer data involved). The machine with the browser plugin has guarded internet access, no admin rights, operating system policies and software updates are handled by the company exclusively and other classified security mechanisms are in place. Nov 28, 2023 at 17:04
  • @JonathanRoot welcome to the community. Let's rephrase the question: what threat actors are you afraid of? Inside threats etc?.. Nov 28, 2023 at 17:27
  • @SirMuffington About outside threats. For inside threats other mechanisms are in place. However, even an admin shouldn't be able to simply pass by this without the knowledge of the user. Though, if the user allows remote access, then that's not of any concern for this question. As well if any of the internal security mechanisms should fail in a way, that will render the plugin useless (e.g. user shares login credentials). Nov 29, 2023 at 8:56

1 Answer 1

1

However, there are people, who caution against such plugins, because a 2FA browser plugin is on the same machine and therefore isn't separate from the login process. Hence, they reject the idea and forbid the usage of such a plugin. Are they right?

So, as a refresher, what MFA does is it makes the attacker have to compromise both your username/password combination, as well as your OTPs and/or MFA secrets in order to get access to your account. That's realistically it. If an attacker gets sufficient access that they're keylogging or able to view your clipboard, you were already in massive trouble.

So, technically speaking, browser extensions, depending on threat model, might be fine. You might be using a single computer with a single browser at all times, and if everything is offline in terms of your MFA tokens, you're golden. Online sync for 2FA gets considerably trickier, because if your syncing account gets compromised, an attacker only needs to compromise your passwords, which can be done through phishing.

Also, since we're working with browser extensions here, what happens if the user visits a website that pops off an XSS attack and the browser doesn't sandbox things right? Is the browser extension safe? Those are questions that might take some further security research to answer. Offloading MFA to a mobile application or hardware token alleviates a good portion of this concern, as an attacker would have to compromise the authenticator device itself (seeing as it's in a separate app) in order to gain anything.

Then there are usability considerations. What if a user has to switch browsers or use a second device or their mobile phone? Would they have to install that browser extension everywhere? How would tokens get synced? Would they have to manually port things over? Is there a backup in the cloud? Lot of questions to answer, all dependent on which you use.

At the end of the day, while in theory 2FA browser extensions could very well add some extra layer of security beyond passwords, there is a reason why MFA that uses a smartphone or hardware token is preferable: It offloads the MFA secrets to a secondary device and/or app, increasing the threshold for compromise, and it centralizes the MFA tokens such that if a user installs a new browser or migrates devices, they only need to maybe restore a backup of their old authenticator app at worst. The latter is in contrast to the browser extension approach, where you might have to do the old song and dance of installing the extension, authenticating, backing up, restoring, etc.

Hope this answered your question!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .