+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+---- Forum: Suggestions and Ideas (https://hackforums.net/forumdisplay.php?fid=134)
+---- Thread: Implement FIDO U2F for 2Factor Authentication (/showthread.php?tid=5532144)
Implement FIDO U2F for 2Factor Authentication - Disparity - Jan 23, 2017
I was looking around to see if HF already had this implemented or if it was possible to somehow do it with the gauth system HF already has, but I don't think it is, and I think it would be a great feature to have.
FIDO U2F is an authentication standard/system that uses USB/NFC systems. So essentially, you have a special USB stick, and without physically possessing it you cannot login to your account. Implementing FIDO U2F would essentially make accounts un-hackable.
Obviously there would be issues like users losing their keys, but that would just be the price a user would have to pay for being a dumbass.
It's worth noting that many reputable sites have already implemented it such as Github, Google, and Dropbox.
Wikipedia on U2F
Yubikey
Sigilance (Alternative but similar system; also opensource)
* - vaiperboy - Jan 23, 2017
honestly looks like too much work, ppl r lazy to turn on 2fa n u want them to have a usb everywhere they go? lol
* - Disparity - Jan 23, 2017
(Jan 23, 2017 06:14 PM)vaiperboy Wrote: honestly looks like too much work, ppl r lazy to turn on 2fa n u want them to have a usb everywhere they go? lol
HF uses sessions and cookies, so you wouldn't need to carry the device everywhere you go, unless you logout of your account whenever you step away from your PC or put your phone in your pocket.
As far as the difficulty goes, that's a valid point. I know I would personally use it and happily post a tutorial on how to use it if it was implemented. However, physical keys like this are a more anonymous and secure option for 2factor authentication than mobile devices and it's gaining popularity pretty quick, so I think it would catch on.
* - Egregious Jr. - Jan 23, 2017
Idiotic suggestion. Most accounts are stolen via RATs, and they'll already be logged in. Would be a ton of work for nothing. And for sold accounts they can just disable 2FA.
* - (╯°□°）╯︵ ┻━━┻ - Jan 23, 2017
(Jan 23, 2017 06:31 PM)Zachary. Wrote: Idiotic suggestion. Most accounts are stolen via RATs, and they'll already be logged in. Would be a ton of work for nothing. And for sold accounts they can just disable 2FA.
This or accounts are being sold.
I don't agree with this.
* - Disparity - Jan 23, 2017
(Jan 23, 2017 06:31 PM)Zachary. Wrote: Idiotic suggestion. Most accounts are stolen via RATs, and they'll already be logged in. Would be a ton of work for nothing. And for sold accounts they can just disable 2FA.
Calm down. Calling this an idiotic suggestion is like suggesting 2factor as a whole is idiotic. The point is, this is another, in my opinion superior alternative to traditional 2factor methods with an app on your phone, making you invulnerable to loads of other jacking methods, including android RATs and people using the same password as those in leaked dbs.
I'll never get why dumbasses get so worked up over things like this when they don't even stop to think. 🤦♂
(Jan 23, 2017 06:36 PM)(╯°□°）╯︵ ┻━━┻ Wrote: This or accounts are being sold.
I don't agree with this.
See my response to the user you agree with. Accounts being sold can't really be combated without inconveniencing users, but other issues can.
* - Egregious Jr. - Jan 23, 2017
(Jan 23, 2017 06:44 PM)Disparity Wrote: people using the same password as those in leaked dbs.Why would it be necessary to implement this system in this case? You DO realize regular 2FA prevents that as well?
And accounts stolen via android RATs are pretty rare.
This is a moronic suggestion.