Two factor authentication is nothing more than a massive vulnerability. We've seen people somehow change our listed contact numbers through unknown exploits, then hijack ownership of properties using the new number to prove they are us. This wouldn't be possible if not for 2nd factor authorization schemes.
Without the settings in your authenticator you're locked out of accounts that require a 2-factor token from it, unless you've got backup tokens printed out.
Two factor authetication is dumb. It invites poor disipline with reusing passwords and with 500 pound gorilla corps, losing your second factor is losing your account permanently.
Phones get hacked too. If you ever access a site with your phone, it's not two factor auth. Malware can read your 2FA key and read your password as you type it in.
That's only in regard to a phishing attack, but two factor authentication protects you in the case that you lose your password to an adversary who tries to log in themselves.
If said adversary can steal your password through other means (for example, you use the same password over multiple sites, and the adversary happens to run one of them), they still would have to coerce you into giving the Allow on your phone.
Two-factor is getting to be a necessary feature for sites...
HOWEVER, there are always ways around two-factor auth. Some sites have some special codes that you are advised to print and carry around with you. Some sites let you verify your personal information to turn it off.
What it comes down to is how secure are:
- the methods of disabling two-factor auth
- the methods involved when you lose your two-factor auth token/device
And let's not forget:
- the methods invovled when you forget your password
- customer service intervention methods (i.e. social engineering)
Putting a "Look we support two-factor auth! We are super secure!" message out there is always a red flag for me, as to how they have counter measures in place for the above scenarios are very important... as that is what the evil people will do.
So instead of having a physical device you own act as a second factor, you are now vendor-locked to a proprietary authentication solution for the entire login process. No thank you!
The entire point of two-factor authentication is to have, well, two factors: something you know and something you have. Using the PC itself as token was already problematic enough as it has a massive code base and runs all sorts of untrusted code so it is likely to be compromised at some point - but at least that was somewhat excusable due to convenience making it accessible to way more people. But getting rid of the rest of the credential and solely relying on the OS is just insanity.
Two factor won't protect you from a spear-fishing attack.
The attacker can submit your info to GitHub the moment you submit to the malicious site. You receive the token via SMS as expected, enter it on the second page of the malicious site, granting them access.
reply