Happened to me because I had an account on a crypto exchange. The attacker went in to my phone carrier’s store, likely with a fake ID, convinced the store they were me, then got a new SIM card and reset my password on everything they could with it. They logged in to my crypto exchange mere minutes after they got the SIM, saw the $0.03 in my account, and logged out.
Sometimes it’s less about the person that you’re targeting and more about what that access gives you.
Low level accountant? Office worker with an excel file full of passwords or has correspondence with your actual target at a different company that you can pose as to gain access into?
I’m not sure where this idea of high profile target comes from. The sim swap attack is pretty common. People just need to be in some credentials leak DB with some hint of crypto trading or having some somewhat interesting social media account. (either interesting handle or larger number of followers)
There are now organized groups that essentially provide sim swap as a service. Sometimes employees of the telco company are in on it. The barrier to entry is not that high, so the expected reward does not need to be that much higher.
The least secure part of the sign-in process is the person. It doesn’t matter what the 2FA method is.
You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because “they’re from Google”. Someone can trick you into making the financial transfer yourself because “you’re getting a deal”.
Which is why sms-based 2fa is useless if you’re being targeted by a motivated hacker. If you’re an important person (e.g. a government official, an exec on a big corp, a celebrity, etc) it’s not safe to use sms-based 2fa. Heck, even if you’re nobody, a hacker might decided to target you anyway to access the company you’re currently working at, or because you have something they want (e.g. a desirable Twitter handle). One call to your cellphone carrier to complain about losing phone, with some social engineering skill to dupe the minimum wage call center worker who doesn’t really care about being vigilant, and suddenly the hacker gain access to your cellphone number (doubly easier to with e-sim) and thus your sms-based 2fa.
Although it’s true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn’t matter. It still is doing it’s job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
That’s not quite right though, there’s the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).
That would be true for offline vaults, but for services hosted on internet I don’t think so. Assuming the victim does not use 2FA on their Bitwarden account, all an attacker needs is the victim’s credentials (email and password). Once you present the factor you know, the vault is automatically downloaded from their services.
This is something I hadn’t thought until know, but I guess password managers might(?) change the factor type from something you know (the password in your head) to something you have (the vault). At which point, if you have 2FA enabled on other services, you are authenticating with 2 things you have, the vault and your phone.
Assuming the victim does not use 2FA on their Bitwarden account
A pretty tall assumption given that we’re already talking about someone who knows to turn on 2FA for other things. If someone knows about 2FA and password managers, they’d be insane not to have 2FA set up on the password manager itself.
That’s a fair point. I just wanted to highlight that there may be cases where a password manager isn’t automatically protected by 2FA by the two factors you mentioned (The password you know and the copy of the vault) since in the case of bitwarden fulfilling one can give you the second. In order to actually achieve 2FA in this case, you would need to enable OTPs.
And yeah, I personally use Bitwarden with 2FA on the Bitwarden account, but don’t store any 2FA tokens in Bitwarden, handling them all separately. Don’t want all the eggs in one basket.
Though given I have fingerprint access on phone and computer for bitwarden, i suppose that one basket is my finger. But if someone is taking my finger, I’ve got more immediate concerns than my passwords.
It works for self hosted vaultwarden mostly also. Since you would need a way to acess the login page itself, which could be behind a VPN or other authentication service like Authentik.
Many password managers use a biometric factor to sign in (your fingerprint, for example, using some kind of auth app if needed). This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
Many password managers use a biometric factor to sign in
The only thing this does is replace the authentication mechanism used to unlock the vault, instead of using your master password (something you know), it uses some biometric factor (something you are), although it uses your biometric data, it’s still a single factor of authentication
This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing
I am not sure I understood you here. What do you mean by “instead of having each service do their own thing”? Each website using their own method of delivering OTPs?
It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
I am not discrediting password managers, they have their uses, as you mention you can have unique, high entropy password on a per service basis. The only thing I am against is the password managers themselves also doubling as OTPs generators (take a look at Bitwarden Authenticator which kinda defeats the purpose of OTPs. From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.
although it uses your biometric data, it’s still a single factor of authentication
Speaking from my experience, I use my phone for biometric authentication. At least from my point of view, I see that as two factors (what I have and what I am) since the biometric authentication only works on my phone.
I am not sure I understood you here. What do you mean by “instead of having each service do their own thing”? Each website using their own method of delivering OTPs?
Basically having multiple places where codes may be generated. This way you can use one location to get OTPs instead of having them delivered via SMS or generated by a different app/service. It ends up being easier and more convenient for the end user (which of course increases adoption).
I guess this has more to do with services adopting OTP generators than sending them via SMS though.
From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.
If logging into the password manager to get the password is sufficiently secure (locked behind MFA), then I don’t see the benefit of using a separate OTP generator (aside from maybe if your password manager has a data breach or something, which should be a non-issue except it clearly isn’t thanks to LastPass…)
I’m starting to wonder if phones (or other auth-specific devices) should just become dedicated authentication devices and passwords should just be phased out entirely tbh. Passwords have always had issues because their static nature means if someone learns your password without your knowledge, that method of authentication becomes worthless. The main concern would be what happens when you lose your phone I suppose.
Arguably, if you use 2FA to access your passwords in 1password, there’s little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it’s been compromised, and having your OTPs separated wouldn’t provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.
There is one theoretical situation I can think of where having your OTPs and passwords separate could be an advantage, and that’s if someone gained all your 1password login details, including the 2FA secret key. But for someone able to gather that much sensitive intel, I’m not sure how much more of a challenge an authenticator app would be.
If you truly feel you need a second factor though, you’ll probably want to look at something like a Yubikey or Titan. I’ve considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.
Arguably, if you use 2FA to access your passwords in 1password, there’s little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it’s been compromised, and having your OTPs separated wouldn’t provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.
As you said if you have both the password manager and the OTP manager in the same device it goes against the concept of 2FA, and you can throw most of guarantees out the window.
I think one distinction worth making is that the encrypted vault itself is still only protected by one factor, the password. The OTP 1Password asks you is part of their service authentication mechanism. If for some reason the attacker manages to get an encrypted copy of your vault (Via App cache, Browser add-on cache, mitm, 1Password’s servers, etc…), “all” the attacker needs is to brute force your password and they can access the contents (Password and OTP seeds) of the vault without requiring the TOPT token. Yes you can mitigate this with a good password/passphrase, but as GPUs/CPUs get faster will that password continue to be good enough in few years time? If your master password becomes “easily” brute forceable, now the attacker has access to all of your accounts because you had the password and OTP seeds in one vault.
If you truly feel you need a second factor though, you’ll probably want to look at something like a Yubikey or Titan. I’ve considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.
I have one, but unfortunately the amount of services that support U2F as a 2FA mechanism is relatively small and if you want to talk about FIDO2 passwordless authentication even less.
Bulk download a shit ton of research papers through the university’s educational license and distribute them for free on the internet, cutting out the completely unnecessary profit driven middle man leading you to eventually do away with yourself due to the pressure from the government and corporations to make an example out of you with a strong sentence.
No and stop using SMS it’s not secure.
deleted by creator
Authenticator to the left of me, SMS to the right, here I am Man In The Middle Attack.
Happened to me because I had an account on a crypto exchange. The attacker went in to my phone carrier’s store, likely with a fake ID, convinced the store they were me, then got a new SIM card and reset my password on everything they could with it. They logged in to my crypto exchange mere minutes after they got the SIM, saw the $0.03 in my account, and logged out.
Sometimes it’s less about the person that you’re targeting and more about what that access gives you.
Low level accountant? Office worker with an excel file full of passwords or has correspondence with your actual target at a different company that you can pose as to gain access into?
They’re just a step in the process.
I’m not sure where this idea of high profile target comes from. The sim swap attack is pretty common. People just need to be in some credentials leak DB with some hint of crypto trading or having some somewhat interesting social media account. (either interesting handle or larger number of followers)
There are now organized groups that essentially provide sim swap as a service. Sometimes employees of the telco company are in on it. The barrier to entry is not that high, so the expected reward does not need to be that much higher.
Hahah… of course, phishing doesn’t exist, right? Your SMS app knows that the website you paste your code into is the legit one, right??
The least secure part of the sign-in process is the person. It doesn’t matter what the 2FA method is.
You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because “they’re from Google”. Someone can trick you into making the financial transfer yourself because “you’re getting a deal”.
Sim swapping
Which is why sms-based 2fa is useless if you’re being targeted by a motivated hacker. If you’re an important person (e.g. a government official, an exec on a big corp, a celebrity, etc) it’s not safe to use sms-based 2fa. Heck, even if you’re nobody, a hacker might decided to target you anyway to access the company you’re currently working at, or because you have something they want (e.g. a desirable Twitter handle). One call to your cellphone carrier to complain about losing phone, with some social engineering skill to dupe the minimum wage call center worker who doesn’t really care about being vigilant, and suddenly the hacker gain access to your cellphone number (doubly easier to with e-sim) and thus your sms-based 2fa.
TOTP or hardware based tokens ftw
On some websites, it is the only option.
Although it’s true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn’t matter. It still is doing it’s job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
That’s not quite right though, there’s the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).
Admittedly, I don’t use that feature either, but, it’s not as bad as it seems at first glance.
That would be true for offline vaults, but for services hosted on internet I don’t think so. Assuming the victim does not use 2FA on their Bitwarden account, all an attacker needs is the victim’s credentials (email and password). Once you present the factor you know, the vault is automatically downloaded from their services.
This is something I hadn’t thought until know, but I guess password managers might(?) change the factor type from something you know (the password in your head) to something you have (the vault). At which point, if you have 2FA enabled on other services, you are authenticating with 2 things you have, the vault and your phone.
A pretty tall assumption given that we’re already talking about someone who knows to turn on 2FA for other things. If someone knows about 2FA and password managers, they’d be insane not to have 2FA set up on the password manager itself.
That’s a fair point. I just wanted to highlight that there may be cases where a password manager isn’t automatically protected by 2FA by the two factors you mentioned (The password you know and the copy of the vault) since in the case of bitwarden fulfilling one can give you the second. In order to actually achieve 2FA in this case, you would need to enable OTPs.
Certainly fair.
And yeah, I personally use Bitwarden with 2FA on the Bitwarden account, but don’t store any 2FA tokens in Bitwarden, handling them all separately. Don’t want all the eggs in one basket.
Though given I have fingerprint access on phone and computer for bitwarden, i suppose that one basket is my finger. But if someone is taking my finger, I’ve got more immediate concerns than my passwords.
It works for self hosted vaultwarden mostly also. Since you would need a way to acess the login page itself, which could be behind a VPN or other authentication service like Authentik.
This is why we require second factor on the password manager too, otherwise you’re exactly right.
Many password managers use a biometric factor to sign in (your fingerprint, for example, using some kind of auth app if needed). This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
The only thing this does is replace the authentication mechanism used to unlock the vault, instead of using your master password (something you know), it uses some biometric factor (something you are), although it uses your biometric data, it’s still a single factor of authentication
I am not sure I understood you here. What do you mean by “instead of having each service do their own thing”? Each website using their own method of delivering OTPs?
I am not discrediting password managers, they have their uses, as you mention you can have unique, high entropy password on a per service basis. The only thing I am against is the password managers themselves also doubling as OTPs generators (take a look at Bitwarden Authenticator which kinda defeats the purpose of OTPs. From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.
Speaking from my experience, I use my phone for biometric authentication. At least from my point of view, I see that as two factors (what I have and what I am) since the biometric authentication only works on my phone.
Basically having multiple places where codes may be generated. This way you can use one location to get OTPs instead of having them delivered via SMS or generated by a different app/service. It ends up being easier and more convenient for the end user (which of course increases adoption).
I guess this has more to do with services adopting OTP generators than sending them via SMS though.
If logging into the password manager to get the password is sufficiently secure (locked behind MFA), then I don’t see the benefit of using a separate OTP generator (aside from maybe if your password manager has a data breach or something, which should be a non-issue except it clearly isn’t thanks to LastPass…)
I’m starting to wonder if phones (or other auth-specific devices) should just become dedicated authentication devices and passwords should just be phased out entirely tbh. Passwords have always had issues because their static nature means if someone learns your password without your knowledge, that method of authentication becomes worthless. The main concern would be what happens when you lose your phone I suppose.
Arguably, if you use 2FA to access your passwords in 1password, there’s little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it’s been compromised, and having your OTPs separated wouldn’t provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.
There is one theoretical situation I can think of where having your OTPs and passwords separate could be an advantage, and that’s if someone gained all your 1password login details, including the 2FA secret key. But for someone able to gather that much sensitive intel, I’m not sure how much more of a challenge an authenticator app would be.
If you truly feel you need a second factor though, you’ll probably want to look at something like a Yubikey or Titan. I’ve considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.
Get it. Stop procrastinating;-)
As you said if you have both the password manager and the OTP manager in the same device it goes against the concept of 2FA, and you can throw most of guarantees out the window.
I think one distinction worth making is that the encrypted vault itself is still only protected by one factor, the password. The OTP 1Password asks you is part of their service authentication mechanism. If for some reason the attacker manages to get an encrypted copy of your vault (Via App cache, Browser add-on cache, mitm, 1Password’s servers, etc…), “all” the attacker needs is to brute force your password and they can access the contents (Password and OTP seeds) of the vault without requiring the TOPT token. Yes you can mitigate this with a good password/passphrase, but as GPUs/CPUs get faster will that password continue to be good enough in few years time? If your master password becomes “easily” brute forceable, now the attacker has access to all of your accounts because you had the password and OTP seeds in one vault.
I have one, but unfortunately the amount of services that support U2F as a 2FA mechanism is relatively small and if you want to talk about FIDO2 passwordless authentication even less.
Stop using 2fa where its not needed. My university library logs me out every 45 minutes and requires microsoft authentication to log in.
Seriously, whats a hacker going to do if tgey get my password,download a PDF? Send a citation to my Favorites list?
Bulk download a shit ton of research papers through the university’s educational license and distribute them for free on the internet, cutting out the completely unnecessary profit driven middle man leading you to eventually do away with yourself due to the pressure from the government and corporations to make an example out of you with a strong sentence.
But wait it has to be double secure, it has two s’s in its name!!