![Page 1: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/1.jpg)
![Page 3: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/3.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
It means multi-factor authentication.
In certain cases it is called “2FA” for two-factor authentication.
What does “MFA” mean?
![Page 4: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/4.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
1. For ordinary users?
2. For knowledgeable users?
3. In terms of the actual security properties it offers?
What does it mean …
![Page 6: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/6.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
What do you believe?1.Does MFA mean that you need all factors to
authenticate?
![Page 7: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/7.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
What do you believe?1.Does MFA mean that you need all factors to
authenticate?
2.Does MFA help protect you if your computer is compromised?
![Page 8: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/8.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
What do you believe?1.Does MFA mean that you need all factors to
authenticate?
2.Does MFA help protect you if your computer is compromised?
3.Does MFA protect you if the server is compromised?
![Page 9: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/9.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
What do you believe?1.Does MFA mean that you need all factors to
authenticate?
2.Does MFA help protect you if your computer is compromised?
3.Does MFA protect you if the server is compromised?
4.Does MFA make make it safe to reuse passwords?
![Page 10: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/10.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
What do you believe?1.Does MFA mean that you need all factors to
authenticate?
2.Does MFA help protect you if your computer is compromised?
3.Does MFA protect you if the server is compromised?
4.Does MFA make make it safe to reuse passwords?
5.Does having a second factor help you if you need to reset a forgotten password?
![Page 11: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/11.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Mind the gaps
1. ∃ gaps twixt ordinary user understandings and actual security properties of MFA
2. ∃ gaps twixt expert user understandings and actual security properties of MFA
3. These gaps can lead to dangerous behavior
Claims
![Page 15: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/15.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Evidence for claims
•Anecdotes
•Hearsay
•Divine revelation?
![Page 16: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/16.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Evidence for claims
•Anecdotes
•Hearsay
•Divine revelation?
“Anecdote” is the singular of “data”, right?
![Page 17: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/17.jpg)
![Page 18: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/18.jpg)
![Page 19: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/19.jpg)
![Page 20: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/20.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
AuthenticationAuthentication is the process of proving
that you are who you say you are.*
You provide your proof to a verifier, who either accepts it or rejects it. If V accepts it,
they will grant you access to something.
*“Who you say you are” may mean the owner of some anonymous account. It doesn’t have to be a legal identity.
![Page 22: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/22.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Classic Authentication
V asks P for her username
![Page 23: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/23.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Classic Authentication
V asks P for her username
P tells V her username
![Page 24: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/24.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Classic Authentication
V asks P for her username
P tells V her username
V checks that there is such a username
![Page 25: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/25.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Classic Authentication
V asks P for her username
P tells V her username
V checks that there is such a username
V asks P for her password
![Page 26: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/26.jpg)
What does “MFA” mean?Jeffrey Goldberg [email protected]
Classic Authentication
V asks P for her username
P tells V her username
V checks that there is such a username
V asks P for her password
P tells V her password.
V checks that P provided
V verifies that the password is correct and grants her access if it is
![Page 27: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/27.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Classic problems• V learns P’s secret
• Eavesdroppers learn P’s secret
• P’s secret is guessable
• P never learns if V is really V
• P’s secret, if captured, can be used to enter this castle
• P’s secret, if captured, might be usable at other castles
![Page 28: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/28.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Modern password problems
• What V stores may be used for cracking
• P is not informed when some tries to enter the castle using her name
• P’s password is the only thing required to gain entry
![Page 29: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/29.jpg)
Security properties
![Page 30: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/30.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Useful security properties• P proves identity to V
• V proves identity to P
• No-one learns any secrets during authentication
• Big H: Long term secrets are unguessable
• Long term secrets are unique
• What V stores long term is not usable for guessing P’s long term secret.
• More than one kind of secret required
![Page 31: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/31.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Useful properties (continued)
• P is made aware of any attempts to use her name
• If P loses or forgets one of her long term secrets, she can get it reset using the one that she maintains
![Page 32: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/32.jpg)
Non-Authentication security properties
Some security properties have little to do with authentication.
![Page 33: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/33.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Once more into the breach!Penelope’s precious stuff, stored within the
castle, is kept safe from
• A breach in the walls
• Dragons flying over the wall
• Treachery from within the walls
![Page 34: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/34.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Bewitched
Penelope’s precious stuff, stored within the castle, is kept safe even if …
Penelope is bewitched so that she is under the control of an evil wizard after she
enters the castle
![Page 35: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/35.jpg)
Major misunderstanding
![Page 36: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/36.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Forgetting the auth
With (proper) MFA the authentication process remains secure as long as at least
one factor remains secure.
![Page 37: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/37.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
“A keylogger on my device”
“With the speed zero day malware are created these days and with the tools and the many advanced techniques they have available, […] users are at risk almost on a daily basis. […] I am not even sure I can trust that my own computer is truly secure despite the fact that it is behind an IDP/Firewall device.”
—Other forum user, January 2017
![Page 38: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/38.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
“A keylogger on my device”
“If I happen to have a key logger on my computer or if I use a public computer to access my account, my entire account key could be copied by someone. [...] I have 2FA set up on my email account, so I have to authenticate using 2FA any time I'm not at home.”
—Forum user, January 2017
![Page 39: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/39.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Alternative Auth
If a service uses access to a single factor for recovery or reset it is making it easier
for attackers
![Page 40: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/40.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Weakening other factors
Using a second factor may give people confidence to use a weaker primary factor
than they otherwise might.
![Page 41: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/41.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Weakening is fine
If the factor that people chose to weaken is important for more than just
authentication, they may do serious damage
Except for when it isn’t
![Page 42: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/42.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Conclusions?
• The security properties on any give MFA system depend on many subtle things about the implementation, service, and threats
• Using MFA in some circumstances may add only tiny improvements to authentication security, but may encourage users to behave in ways that substantially weaken there security
![Page 43: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/43.jpg)
Jeffrey Goldberg [email protected] What does “MFA” mean?
Call for help
• Can we give customers what they demand without harming their security?
• Can my speculations about user behavior be studied and tested to see if my worries are justified?
![Page 44: What does · reset a forgotten password? What does “MFA” mean? Jeffrey Goldberg jeff@1Password.com Mind the gaps 1. ∃ gaps twixt ordinary user understandings and actual security](https://reader034.vdocuments.us/reader034/viewer/2022050105/5f437bc7f4773264011e6c61/html5/thumbnails/44.jpg)
Table 1Security Properties of different authentication
schemes