Astryr Cyberfæ 

A robust alternative to 2FA has to take into account three super common scenarios:

- you are in a foreign city and have been mugged, your wallet and phone have been stolen from you

- you have dropped your keys down the drain

- you are homeless, your phone has just died, and your only computer is a public access library computer running Internet Explorer 6. you are not able to afford a monthly subscription to Bitwarden

Apr 27, 2023 at 2:51amWeb
Show threadAstryr Cyberfæ Apr 27, 2023
I really do not give a shit what 2FA solution you think you have, it cannot cope with at least one or more of these scenarios that happen, literally, every day
Show threadAstryr Cyberfæ Apr 27, 2023
like so many people are responding with their 2FA solution. but no, sorry, it is not robust
Show threadJason Petersen (he)Apr 27, 2023
@alexandria robust as compared to what?
Show threadAstryr Cyberfæ Apr 27, 2023
@jason read the first line again
Show threadJason Petersen (he)Apr 27, 2023
@alexandria (if the answer is “as compared to just passwords”, then there is no actual discussion here)
Show threadAstryr Cyberfæ Apr 27, 2023
@jason It's not a discussion because I'm not discussing with anyone
Show threadAstryr Cyberfæ Apr 27, 2023
@jason My post was not up for discussion
Show threadBenAvelingApr 27, 2023
@alexandria @jason Sir, this is a Wendy’s.
Show threadAstryr Cyberfæ Apr 27, 2023
@BenAveling @jason I'm not a sir and you are now instance blocked
Show threadBenAvelingApr 27, 2023
@jason @alexandria fair, very fair.
Show threadclar fonApr 27, 2023

@alexandria honestly there is no version of 2FA that feasibly can solve all of these problems, since at the end of the day… if you lose all of your belongings, "something you have" will be included in those belongings

imho the only acceptable solution here is:

  • any 2fa solution should accept registering multiple factors, any of which are accepted
  • 2fa should be disableable with a time limit in exceptional circumstances (e.g. any/all 2fa tokens are lost), in which case it'll notify the account owner and within some reasonable time frame (like, a day or two) remove the 2fa token. this way someone can't easily just "hack their way in" but also it helps ensure that you can get in with just a password if you need to
    • Show threadCassandrichApr 27, 2023

    @clarfonthey @alexandria The only acceptable solution is: any 2fa solution must allow opting out of 2fa and authenticating solely with "something you know", the only thing that can't be taken away from you*

    * without extreme violation of longstanding norms about physical harm to a person's body

    Show threadKevin Karhan Apr 27, 2023

    @clarfonthey @alexandria

    Basically that's a classic TAN:
    https://mstdn.social/@kkarhan/110271086419549862

    Kevin Karhan :verified: (@[email protected])

    @[email protected] that basically only allows #iTAN as method, since those can be printed out or stored otherwise. https://en.wikipedia.org/wiki/Transaction_authentication_number#Indexed_TAN_(iTAN) If necessary, the system would generate a new iTAN each time after successful login and demanding it for the next login, and so forth.

    Mastodon 🐘
    Show threadeasrng Apr 27, 2023
    @alexandria I have encrypted backups of my totp secrets and other backup codes stored in a bunch of places so I can access them even if I were to lose all my devices. IE 6 wouldn't be a problem as long as I could run 7zip (which might not be an option on a library computer...). But expecting everyone to have a setup like I do isn't realistic.
    Show threadCassandrichApr 27, 2023

    @alexandria Don't leave out:

    - you are a refugee and you just crossed a border.

    Show threadKevin Karhan Apr 27, 2023

    @dalias @alexandria

    and:
    - you're forced to flee someplace and everyone around you will try to KOS you if they identify you.

    Again: #TAN or rather #iTAN is the next best option.
    https://mstdn.social/@kkarhan/110271086419549862

    Kevin Karhan :verified: (@[email protected])

    @[email protected] that basically only allows #iTAN as method, since those can be printed out or stored otherwise. https://en.wikipedia.org/wiki/Transaction_authentication_number#Indexed_TAN_(iTAN) If necessary, the system would generate a new iTAN each time after successful login and demanding it for the next login, and so forth.

    Mastodon 🐘
    Show threadHaelwenn /элвэн/ Apr 27, 2023
    @dalias @alexandria Reminds me of Paypal apparently not allowing to change your country…
    Show threadIIVQApr 29, 2023
    @lanodan @alexandria @dalias It does. Once. I moved from NL to BE (had to send in passport copies) and back a few years later. My paypal is still on Belgium, which is no problem at all in practice except I pay a higher sales tax on European sales.
    Show threadKevin Karhan Apr 27, 2023

    @alexandria that basically only allows #iTAN as method, since those can be printed out or stored otherwise.
    https://en.wikipedia.org/wiki/Transaction_authentication_number#Indexed_TAN_(iTAN)

    If necessary, the system would generate a new iTAN each time after successful login and demanding it for the next login, and so forth.

    Transaction authentication number - Wikipedia

    Show threadDieuApr 27, 2023
    @alexandria we could even hand out smart cards for free, but the darned library pc wouldn't be able to use them. 😡
    Show threadLuna Macrosystems✡️🤖🏳️‍⚧️Apr 27, 2023
    @alexandria I think about this a lot and know there are some situations where all my digital stuff will be lost. Losing access to my email even without 2FA would spell the end of many of these accounts.

    But also, the defaults of many of these systems are so bad. Anything that requires 2FA but only via SMS (very common), anything that requires the app installed on your phone and you have to transfer phone to phone (what, you think phones never get stolen or broken?), anything that expects your average user has written down their 2FA backups and can actually retain and find them when they need them.
    Show threadGrant GouldApr 27, 2023
    @alexandria Some coworkers of mine ran into the delightful "The industrial site from which you need to log in prohibits all external electronic devices including phones and yubikeys; the 2fa timeout is just a hair shorter than the time required to sprint to the parking lot, get a code from your phone, and sprint back."
    Show thread🎓 Doc Freemo  🇳🇱Apr 27, 2023
    @alexandria All 2fa already has provisio s for this. You simply backup securiely the shared secret you use when creating your 2fa. You can store thrm in a password manager and if you loose your 2fa you can thrn just restore it from the backup shared secrets.
    Show threadFaisal MisleApr 27, 2023
    @freemo @alexandria ok, how do you access that shared secret or pw manager if you have no phone or wallet and are away from home?
    Show thread🎓 Doc Freemo  🇳🇱Apr 27, 2023
    @faisal @alexandria You go to the library and download the git repo you have it stored in :)
    Show threadᘻσᘉᖽᐸ σᖴ ᖶᕼᘿ ᕲᘿᘻσᘉApr 27, 2023
    @alexandria You can engineer scenarios like this for basically any authentication method. The security benefits of 2fa outweigh not being able to log in under specific scenarios.
    Show threadMatt CampbellApr 27, 2023
    @alexandria Do library computers running IE6 still actually exist?
    Show threadrequiem 🦫Apr 27, 2023
    @alexandria this sounds like a setup for a text adventure.
    Show threadEmily SApr 27, 2023

    @alexandria

    To add a few (if that's ok)
    - Your kid has hidden your keys somewhere, you are pretty sure they are still in your house but won't find them for a few days/weeks

    - Your kid dropped your phone in the toilet to see what it sounds like

    - You've been involved in a car accident and your phone is now in an evidence locker somewhere because it was being your GPS.

    Show threadLars Marowsky-Brée 😷Apr 27, 2023

    @alexandria "The police has seized your phone".

    Honestly our "phones" are such crucial parts of our lives these days it's ridiculous and a horror scenario to recover from.

    Show threadResunaApr 27, 2023
    @alexandria Homeless people routinely lose access to resources behind a mandatory 2FA wall as it is. :(
    Show threadPiers CawleyApr 27, 2023
    @alexandria @chrisjrn that third one implies that a truly robust alternative to 2FA has to start by destroying the patriarchy and eliminating homelessness. A big task, but I'm here for it.
    Show threadChristopher NeugebauerApr 27, 2023

    @pdcawley If you want to make an initial contribution that will last beyond the dismantling of the patriarchy, why not volunteer to help libraries keep more up-to-date with technology? 🤔

    @alexandria

    Show threadPiers CawleyApr 27, 2023
    @chrisjrn @alexandria that would involve being up to date with technology myself, and I think that ship has long sailed :)
    Show threadDHeadshot's AltApr 27, 2023
    @alexandria I guess you could give your second factor to a trusted friend who is contactable on IRC (so it works on an ancient machine or as an IE6 ActiveX control), but then proving your identity to them could be difficult?
    Show threadsilentwApr 27, 2023
    @alexandria seems like the only solution that actually takes these into account (AND is not vulnerable to law enforcement compromise) is a passphrase.
    Show threadmothcubApr 27, 2023
    @alexandria THANK YOU I really worry about this stuff tbh, the fear of losing access to everything is way more real for me than the fear of getting defrauded etc
    Show threadMatandoApr 28, 2023

    @alexandria only possible solution I can think of is password plus a hardware auth device that is embedded in the users body so it can't be stolen.

    It's extremely impractical but I think it might be the only thing that would actually work so long as it can't be breakable.

    Show threadDakedresApr 28, 2023
    @alexandria bitwarden is free?
    Show threadAstryr Cyberfæ Apr 29, 2023
    @dakedres TOTP on bitwarden requires paying them. You're the fifth person ive had to say this to, really wish people would double fucking check first
    Show threadDakedresApr 29, 2023
    @alexandria Sorry but you didn't specify and I wasn't even aware bitwarden had TOTP. I'm grateful for the clarification and I agree with your post, but honestly it might serve you better to just turn off notifications for a while if you're that frustrated.
    Show threadSeedy Three SixtyApr 28, 2023
    @alexandria Your mobile/cell carrier killed your SIM card against your will and now you have no phone service.
    Show threadsimon.oldApr 28, 2023
    @alexandria Or your phone is just in the other room because you put it there to get rid of distractions, or your partner is sleeping in there and you don't want to go get it, or you couldn't pay the bill this month and can't get SMS 2FA codes, or you just don't *have* a phone, or or or or
    Show threadAstryr Cyberfæ Apr 29, 2023
    @simon yeah, "you have an abusive partner that requires 2FA to control your access to online"
    Show threadF.U. 🅭…Apr 29, 2023
    @alexandria
    And don't forget scenario 4:
    - the bad guys have already seen a movie where 2FA based on or implanted in a body part can be circumvented by stealing the body part.
    Show threadMennoApr 30, 2023
    @alexandria
    The Dutch tax office for years told people: "Please turn on 2FA, it's so much safer."
    And then, once you had it turned on: "Would you like to log in the old way, or by using one of the new 2FA methods?"
    At least they have started blocking logging in without 2FA to certain extra sensitive functions, such as changing your bank account for refunds.
    Show threadcryo2go :unverified:May 2, 2023
    @alexandria bitwarden isn't free?
    Show threadAstryr Cyberfæ May 5, 2023
    @BenjaminHimes once again i am asking people to look at bitwarden's offerings under the "paid" tier and notice that 2FA support in bitwarden is a paid feature
    Show threadCrystalsJul 18, 2023
    @alexandria solution:
    Proton drive or something, storing an encrypted zip with backup codes and your pass db. Make sure the account with the drive has no 2fa, and a password you remember.
    Now, everything goes to shit, you get on the library computer, get and decompress the zip, and your recovered.
    Show threadAstryr Cyberfæ Jul 18, 2023
    @Crystals the drive was on the keychain with the keys