BitPirate
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 238
Merit: 100
RMBTB.com: The secure BTC:CNY exchange. 0% fee!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 28, 2013, 07:50:57 AM Last edit: May 28, 2013, 08:03:25 AM by BitPirate |
|
E-mail is usually the easiest vector to compromise a user's login ID in the first place.
Many attacks go like this: - Get access to e-mail - request password reset (is done via e-mail usually) - Log in
Two-factor authentication is on the verge of becoming mainstream; passwords are increasingly futile.
In 2 years, users who don't use 2FA will be in the minority -- it is really quite scary to consider how insecure passwords alone are. Not just because of keyloggers, but because most are ridiculously easy to brute-force. Let's face it: Passwords are better at locking out legitimate users these days than attackers. Most user's passwords are one or two common names or words from a dictionary, some numbers, probably between 1 - 1000 and likely consecutive or repeated numbers, and maybe one symbol. An average computer can run through all possible combinations of those in less than the time it takes to make a cup of tea.
2FA needs to be a combination of "something you know" and "something you have" -- any other way just doesn't provide much additional security.
On the site's side, they can provide some additional security for the users who don't want to use 2FA: identifying and blocking or slowing down brute force attacks, using heuristics based on IP geolocation, etc... and, of course, properly salting and hashing passwords for storage. But the onus is still on the user... as the weakest link just becomes another site they are using with the same password.
|