The OTP you want to use was already used
The OTP you want to use was already used
30 comments
-
-
USPSā website does this, sort of.
If their text service is down itāll let you know and just skip the 2FA process even though normally they offer an option to get the code via email.
The fact that they do this is bad enough, the fact that this happens so often that Iāve seen this at least a dozen times is even worse.
-
Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
Please just dont do anything you arent supposed to, my boss will kill me
-
Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
The password you have entered is already used by user
RandoMcRandom123, please use another password.
-
-
I appreciate the quick hack, but with a little more foresight you could have just put up a blurry jpeg with that number and changed the prompt so it looks like a CAPTCHA. Nobody would have given it a second thought.
30 comments
No and stop using SMS it's not secure.
Happened to me because I had an account on a crypto exchange. The attacker went in to my phone carrierās store, likely with a fake ID, convinced the store they were me, then got a new SIM card and reset my password on everything they could with it. They logged in to my crypto exchange mere minutes after they got the SIM, saw the $0.03 in my account, and logged out.
Sometimes it's less about the person that you're targeting and more about what that access gives you.
Low level accountant? Office worker with an excel file full of passwords or has correspondence with your actual target at a different company that you can pose as to gain access into?
They're just a step in the process.
I'm not sure where this idea of high profile target comes from. The sim swap attack is pretty common. People just need to be in some credentials leak DB with some hint of crypto trading or having some somewhat interesting social media account. (either interesting handle or larger number of followers)
There are now organized groups that essentially provide sim swap as a service. Sometimes employees of the telco company are in on it. The barrier to entry is not that high, so the expected reward does not need to be that much higher.
The least secure part of the sign-in process is the person. It doesn't matter what the 2FA method is.
You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because "they're from Google". Someone can trick you into making the financial transfer yourself because "you're getting a deal".
Sim swapping
On some websites, it is the only option.
Although it's true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn't matter. It still is doing it's job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
Thatās not quite right though, thereās the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).
Admittedly, I donāt use that feature either, but, itās not as bad as it seems at first glance.
Many password managers use a biometric factor to sign in (your fingerprint, for example, using some kind of auth app if needed). This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
This is why we require second factor on the password manager too, otherwise youāre exactly right.
Stop using 2fa where its not needed. My university library logs me out every 45 minutes and requires microsoft authentication to log in.
Seriously, whats a hacker going to do if tgey get my password,download a PDF? Send a citation to my Favorites list?
But wait it has to be double secure, it has two s's in its name!!