Google Pushes 2-Factor Authentication

 Am a long time proponent of the idea. Its not perfect security, but is a big step forward.

Google Gets Serious About Two-Factor Authentication. Good!  in Wired

The tech giant wants to push its billions of users—and the rest of the industry—to enable multifactor authentication by default.

“TURN ON TWO-FACTOR authentication” is solid advice, and WIRED has repeated it for years. Doing so ensures that your password isn't the only line of defense against unauthorized access to your accounts. The only problem? The onus was always on you to figure out how to make it happen. Now, Google is taking its first steps toward enabling two-factor by default for all its users—and where Google goes in web security, the rest of the industry often follows.

The company said in a blog post this week that it will begin asking users who already have enabled two-step verification to authenticate by tapping a prompt on their smartphones whenever they sign into their Google or Gmail account. (Gmail has about 1.8 billion users).  .. ' 

MFA as Security

 Good overview piece abut 2FA and beyond. 

Is MFA Needed to Improve Security?

By Keith Kirkpatrick   Commissioned by CACM Staff    February 25, 2021

Many corporate and consumer-based systems and applications deploy short message service (SMS)-based two-factor authentication technology to help protect users from being hacked. This method of two-factor authentication is fairly simple; a user will log onto an app or system using their username and password, and then a unique security code is generated by an algorithm within the app, which is then sent to the user's phone via a text message. If that code is correctly entered into the system when prompted, it theoretically will authenticate the person trying to log into the system.

However, SMS-based authentication is rife with security holes. Alex Weinert, Microsoft's director of identity security, published a blog post in early November highlighting the immense risk of continuing to use SMS-based codes to authenticate users, given the ability of hackers to either intercept the codes while they're being sent (basic SMS messages are unencrypted), or to simply carry out a scheme known as subscriber identity module (SIM)-card swapping, or SIMjacking.

SIMjacking is a technique through which a criminal will call a user's wireless company and use information gathered about the user (including personal data garnered via phishing schemes, guessing answers to challenge questions, and exploiting the empathetic nature of humans) to have a phone's SIM card transferred to their account, giving them access to the user's SMS messages, including authentication texts.

"SIM-based multi-factor authentication is probably one of the most popular MFA methods on the Internet, if not the most popular, meaning that almost every company you deal with uses these SMS-based MFA solutions, and you really don't have a choice," says Roger Grimes, author of Hacking Multifactor Authentication, and a Data-Driven Defense Evangelist at KnowBe4, a security awareness education company. "Not only is [SMS] a poor authenticator, it is fairly easy to hack, but many times you can't opt out of it."

That's why security professionals suggest the use of multi-factor authentication applications, which are designed to reside on each physical device and do not require the use of SMS-based authentication codes. Authentication applications, which have been released by both large companies (Google Authenticator, Microsoft Authenticator) and independent software vendors (Twilo Authy, LogMeIn LastPass Authenticator, and Duo Mobile) generally only require a data connection during the initial set-up process, which involves installing the application on a smartphone, then configuring it to work with each account to be protected. Each account provides a secret key that is shared over a secure data channel to the authenticator app, and is used for all future logins.

To log into such a site, the user will provide credentials (a username and password to the site); an algorithm then generates codes using the current time on the device and the shared secret key, in order to generate a one-time password, then asks the user to enter it. The user runs the Authenticator app, which independently computes and displays the same password, which the user types into the site, authenticating their identity.  ... " 

Sim Swapping Insecurity

Had read about this.   The details here are that those responsible for the most minimal security are not taking it seriously. Poor security is not the right term,  nonexistent was too often the case.

SIM Swapping, Poor Web Security Put Millions at Risk
New Scientist
Chris Stokel-Walker
January 22, 2020

Researchers at Princeton University have found that two-factor authentication (2FA)—a security measure recommended by many websites and apps—is easily hackable and could put millions of people at risk. If a bad actor can compromise a user's phone, that will give them access to that user's online accounts. "SIM swapping" attacks allow hackers to port phone numbers to new SIM cards. Mobile phone networks should have security measures in place to prevent this, but the Princeton researchers found that five major U.S. networks do not have sufficient protections in place. Once hackers have control of a phone, they can reset passwords to online accounts by redirecting the 2FA confirmation texts. The team also analyzed 140 websites for their vulnerability to SIM swapping, and found that 17 major websites were "doubly insecure," meaning they did not ever require a user to insert their password to gain access to accounts, asking only for a telephone number..... '

2 Factor Authentication Compromised

Had always known it had vulnerabilities,  here is an example.   Still a good approach to utilize.  Note the approach requires theft of software tokens. 

Chinese Hacker Group Caught Bypassing 2FA
By ZDNet, January 2, 2020

Dutch cybersecurity firm Fox-IT said in a report that a hacker group associated with the Chinese government has been bypassing two-factor authentication (2FA) in a recent series of attacks. 

The chief target of the recent attacks by APT20 group, which is believed to operate at the behest of China's government, were government entities and managed service providers in fields including aviation, healthcare, finance, insurance, and energy. The Fox-IT analysts said the group used Web servers as the initial point of intrusion, with special emphasis on the JBoss enterprise application platform often found in large corporate and government networks.

The analysts determined the hackers linked to virtual private networks shielded by 2FA, theoretically by stealing an RSA SecurID software token from a hacked system, then using the token on its computers to produce valid one-time codes and bypass 2FA at will.

From ZDNet 
View Full Article

Use 2-Factor Authentication for Home

Am a big proponent of 2 Factor Authentication, should be in general use

Protect your Ring camera from hackers by setting up two-factor authentication
A rash of takeovers of Ring cameras is a good reminder to lock down your security devices.

Laura Hautala in CNET

 ....  Passwords aren't good enough
Telling consumers not to reuse passwords is unrealistic. First of all, many people have dozens or even hundreds of accounts, and only a robot could memorize unique, complex passwords for each of them. There are tools to make this easier, like password managers, but they can be challenging to use. That's a disincentive for many people to rely on them. ...

Two-factor authentication is one way companies could secure smart-home tech for their customers even if they use bad passwords. If 2FA were required, consumers would need a second form of identity, often a one-time code sent to a phone after a username and password are entered, or a physical token that's plugged in.   ... "