Now, even hardware-based 2FA is not entirely safe — Steemit (2024)

FAQs

Now, even hardware-based 2FA is not entirely safe — Steemit? ›

Two security researchers at the recent DEFCON conference have demonstrated that even hardware-based 2-factor authentication devices are not as safe as people think they are. They managed to hack 2 popular devices - the Yubikey, and RSA tokens.

Even if the user doesn't respond to a push login request or doesn't enter a One-Time Password (OTP) when prompted, a hacker still knows they have a working password now; how, because the delay for the denied message takes longer... Most of us know where this is going; the hacker is persistent in their login attempts.

Physical theft of devices or hardware tokens can compromise the security of 2FA. If a hacker gains physical access to your device or token, they may be able to bypass the authentication process and gain unauthorized access to your accounts.

There have been instances where YubiKeys have been hacked or compromised. Common attack vectors on hardware keys include physical attacks, side-channel attacks, and firmware vulnerabilities. Physical attacks involve physically accessing the device and extracting sensitive information from it.

Benefits of 2FA Implementation

2FA provides an additional layer of security beyond traditional username and password combinations. This extra step ensures that even if login credentials are compromised, unauthorized access is prevented without the second factor.

Another way how 2-step verification can be hacked is via credential stuffing, where attackers try to breach a system using lists of compromised usernames and passwords. Bots are often used to automate the process and maximise the chances of getting a successful hit.

In summary, SMS-based 2FA is easier to set up and use, but it is not as secure as TOTP-based 2FA. TOTP-based 2FA is more secure but requires an additional app to be installed on your smartphone.

However, this isn't the first time security issues have been reported for Google Authenticator. In 2020, an Android malware strain was reported as extracting and stealing one-time passcodes generated through Google Authenticator.

If you've lost access to your 2FA device, you can recover your account by using backup codes, alternative recovery options like a secondary email or phone number, or by contacting customer support. Be ready to confirm your identity by answering a few security questions or providing proof of ID.

The primary vulnerability of current 2FA methods is their dependency on device authentication rather than true identity authentication, so any solution that promises to improve this mechanism must help machines better discern true human identities.

What is safer than 2FA? ›

Multi-factor authentication (MFA) is more secure than two-factor authentication (2FA) These two terms are often used interchangeably, but they're not quite the same thing. 2FA requires exactly two authentication types to unlock something. MFA requires a minimum of three forms of authentication.

The one true problem that keeps 2FA from really being a solid solution in my mind is that at some point, there has to be a point of authentication that is implicitly trusted. Say you have a site that sends you an email with a code to authenticate to that site.