Speak Friend and Enter – Do people use movie passwords? (2018)

Re:Speak Friend and Enter – Do people use movie passwords? (... by bawolff on Sunday February 11, 2024 @01:37AM (#39333058)

This is pretty risky given how lax sone places are with allowing customer service to be talked into removing 2fa.

[ Parent | on HN ]

Re:Speak Friend and Enter – Do people use movie passwords? (... by 8organicbits on Sunday February 11, 2024 @03:08AM (#39333351)

I've seen platforms that don't rate limit 2fa guesses. A six digit OTP has only a million possible values. Guessing once per second it only takes a couple days to guess.

This is also why a platform should never confirm that a password is correct when 2FA is enabled, only confirm if both have been solved.

[ Parent | on HN ]

Re:Speak Friend and Enter – Do people use movie passwords? (... by pintxo on Sunday February 11, 2024 @05:19AM (#39333988)

2FA is usually time limited? So this seems not to be an issue?

[ Parent | on HN ]

Re:Speak Friend and Enter – Do people use movie passwords? (... by 8organicbits on Sunday February 11, 2024 @06:14AM (#39334224)

Think about a time-based one-time passcode (OTP). Every 30 seconds you get a fresh code and the attacker tries to guess that code. There's usually a validity window of one or more OTP, so the attacker needs to guess one of several possible currently valid OTP.

This is a popular trick in CTF exercises and it's pretty quick if you can make 1000 guesses per second. Takes a couple minutes until you're in.

[ Parent | on HN ]

Re:Speak Friend and Enter – Do people use movie passwords? (... by rhysmdnz on Sunday February 11, 2024 @04:37PM (#39339012)

Because of fun probability stuff. The fact what your guessing changes doesn’t matter. It’s still a day to get a correct guess.

https://pulsesecurity.co.nz/articles/totp-bruting

[ Parent | on HN ]