Off Topic: Two Factor Authentication?

[Deleted User]

The user and all related content has been deleted.

dendy

@SevenSystems said:

@dendy said:

@SevenSystems said:
If I have a secure (i.e., non-trivial, long enough, non-dictionary) password, and I don't put it on a yellow sticky note on my monitor or anything else stupid, it should be 100% secure no matter what happens.

Did you ever heard about "man in the middle" attack ? :-)

This is how the world worked between roughly 1950 and 2010. Why is stuff like 2FA suddenly necessary?

Becasue of "man in the middle" attack :-)

I've heard about this... just glanced at the first paragraph of the Wikipedia article. Shouldn't this be impossible with HTTPS, which is what literally 100% of websites and APIs that process sensitive information use?

Well, it’s not that easy .. their malicious proxy may push to your web client invalid certificate (own) but then yeah, you can notice in your browser warning about invalid certificate .. most of people will notice it, some may not

they can also infect your computer with malware which allows them sniff https connection and decipher yours https data (they basically steal public key received by your browser so they can decipher data which is your browser sending to web server)

Of course, this is advanced technique and may not happen to you .. but 2FA is simply another level of protection agains more advanced attacks .. personally, i use 2FA only for crypto exchanges and my main e-mail account, other than that i don’t have any sensitive data and all i may loose by hack is backed up on cold storage :-)))

Really sensitive data (for example crypto wallets private keys) NEVER enter any computer, just paper (short term keys) or HW wallet (multi year wallets)

I mean - if you have anything you want to be ABSOLUTELY rock solid sure not even best hacker on planet can steal from you - just NEVER store it on computer or any digital storage device. That simple it is. Including photo

It’s always about searching compromise between convenience/ease of use and security…

What pisses me a lot is that many pages are forcing you to create password like “A3blaba!” - you know the shit like “one capital, one number, one special character, at least 8 chars” - Such passwords are hard to remember and are COMPLETE shit in terms of security. Much better is simply use short sentence like 3-4 words (something what makes sense to you) - it’s counter intuitive but such passwords are much hard to guess from cryptographic point of view, but super easy to remember

dendy

@tja said:
The newest TLS versions seems to be able to prevent this, why those companies may not use it.

I did not research freshly

TLS is used just for SMTP (e-mail sending) service.. not completely sure but i think it’s not useable for www traffic.. (but do not quote me on this, not completely sure)

[Deleted User]

The user and all related content has been deleted.

wim

@SevenSystems said:

@dendy said:

@SevenSystems said:
If I have a secure (i.e., non-trivial, long enough, non-dictionary) password, and I don't put it on a yellow sticky note on my monitor or anything else stupid, it should be 100% secure no matter what happens.

Did you ever heard about "man in the middle" attack ? :-)

This is how the world worked between roughly 1950 and 2010. Why is stuff like 2FA suddenly necessary?

Becasue of "man in the middle" attack :-)

I've heard about this... just glanced at the first paragraph of the Wikipedia article. Shouldn't this be impossible with HTTPS, which is what literally 100% of websites and APIs that process sensitive information use?

Not impossible, but much more difficult if the hacker isn't on the same local area network. The technique involves tricking the target into thinking it's establishing the encrypted session with malicious system that then acts as a pass-through. It wasn't terribly difficult. I used to know the LAN techniques back in the day, but have forgotten more than I know at this point.

If someone can successfully trick your computer into establishing the HTTPS flow initially with their computer then they can pass traffic through while being able to read it. Extremely unlikely, but no, not impossible.