eBay/Paypal: second authentication factor. (A little spiel for those passionate about the subject) | Safety on eBay

silicon-assistance · 2023-11-09T09:11:51.759000Z

1) Paypal - Second authentication factor via TOTP generated by a third-party app instead of an SMS For some time now, there has been an important change in Paypal's policy. Paypal long required the second factor of authentication via an SMS TOTP code, which required a mobile network connection, not necessarily convenient when you are abroad and, for roaming cost reasons, do not want to connect to the local network, not to mention the regular delivery delays. It is now possible to disable this mode and activate a TOTP (Timed One Time Password) code generated by a third-party application. You simply provide it with a permanent private key either by QRCODE or manually, and depending on the time, the application will generate a unique and predictable code thanks to the magic of the RSA algorithm. The phone must be time-synchronized; its clock should generally not drift by more than 5 minutes from official atomic clock time (this is the generally accepted tolerance, but some sites may choose to be more restrictive and require a difference not exceeding 2 or 3 minutes, which will typically cause repeated authentication failures, but this is quite rare, the 5-minute standard being fairly widely followed). On Android / iOS, Google Authenticator and Microsoft Authenticator are the best-known apps (but there are others). The apps from the two US giants offer the option of storing private keys exclusively locally on the phone (if you uninstall the apps, everything disappears) or optionally connecting to a Google or MS account to sync the keys in the Cloud and retrieve them instantly on a new device as long as you sign into the same account. It is advisable to protect these apps with fingerprints. Such apps also exist for PCs running Windows or Linux. There is at least one or two apps of this type in the Windows store, but not the official MS and Google apps, because they consider, as a matter of principle, that in a scenario where you connect to a service with a PC that will transmit the password, and thus potentially store that password, the second authentication factor must imperatively be generated via a physically separate device that does not potentially hold both the password and the TOTP private key simultaneously. That is perfectly coherent in itself EXCEPT that all these people long ignored the fact that this separation logic does not work on mobile phones when they themselves connect to those same services. When you know that Android has overtaken Windows and is being attacked more and more by hackers, it is mainly for this reason that many people pointed to the security flaws and campaigned for the ability to use a third-party application, and in that case the ideal is neither the PC nor the mobile phone but a small Yubikey 5 NFC capable of storing 32 TOTP private keys. You connect the key to your phone or to your PC via USB or NFC, even for phones, and a Yubico Authenticator app to install will read the private keys to generate the famous volatile authentication code. In this process, note that the private key is NEVER stored on the phone; it is kept safe in the Yubikey, which opens access for reading discreetly. A touch action is needed to activate the discreet opening of the vault, and to renew expired codes, you must touch the key again, so the principle of physical separation is indeed respected, except that you have complete freedom to choose the device that will read the Yubikey key. However, Paypal did not go all the way with its logic because, for practical reasons of being able to recover an account quickly in case of loss of the third-party app, they still reserve the possibility of authenticating you by SMS, so poop sandwich, that does not solve everything; everything will continue to rely on the password, since with TOTP the thief can get it whenever they want via SMS... It's the same for everyone: Gmail, Microsoft Outlook all still reserve the right to authenticate you by SMS to recover accounts, whereas in fact a backup code should be used in such a scenario... but for practical reasons, either because these services fear being flooded with requests from absent-minded customers who will not have saved these backup codes, or who will not even know what they are, we stick with this somewhat bastard solution, because no, a mobile phone cannot be considered a secure element due to the ease with which it can be stolen; a landline cannot be stolen, only a landline-connected phone should be used as a recovery method.... Google does it more or less, they are able to send a voice message stating this code (only certain landlines, notably with Orange, and with a subscription and suitable equipment, can receive SMS, hence Google's interesting approach; I also believe Microsoft has implemented a similar system). Others are lagging behind, but the fact is that more and more people no longer have a landline... so that is why the mobile phone remains the main recovery method. - it is now possible to register a FIDO key as a second authentication factor, thus replacing the TOTP code. The Yubikey 5 NFC key is a multifunction key that supports storing TOTP codes, storing a user-configurable password, and the FIDO unique identification protocol. Yubikey keys are reputed to be tamper-proof, where state-level means would be needed to break this vault; it would be within reach only of a handful of countries with high-level microelectronics expertise. That said, as with a physical key, if the thief has the key then obviously.... but in such a scenario the user is still protected by their password, which gives them time to revoke the key from their accounts (hence the importance of always keeping the TOTP option as a backup). Ideally, you even buy the keys in pairs. For the second one, you can settle for a more basic Yubikey key, no need necessarily for the 5 NFC, which will just support the FIDO protocol. Well-designed sites allow multiple hardware keys to be registered. Thus, once registered, this backup key is carefully stored in a safe and preferably unlikely place. A family safe will be directly targeted by thieves.... better to be clever and hide the key in a box that you store in an unlikely place, such as a corner of a bathroom, under a small slab, etc. etc. If you lose the main key, you authenticate with the backup key and revoke the main key, but be careful to remember all the accounts for which you registered this key. Some providers offer to connect your account only with the hardware key, which is a total heresy because it is no longer a second authentication factor. The thief who has your key can do anything, so you should NEVER enable this option, especially under certain conditions (it only works on browsers previously identified as installed on devices belonging to you, except that those devices can be stolen....). Google and Microsoft offer you this option, you must refuse it. My Google accounts are all set to refuse this option and will always require a password. Yubikey 5 NFC, the most recommended tool compatible with Windows, Linux, Mac OS, Android, IOS, around 60 EUR, the investment is worth it, durability guaranteed, it is built to withstand the worst treatment, if you are a business merchant frankly you should move to this stage, it is the bare minimum of modern security, and now many professional sites (OVH for example, Amazon professional accounts.... I believe, pending expansion to the general public) implement the protocol. Last I heard, Boursorama is the first French retail bank to have implemented the FIDO key as a second authentication factor, much more convenient than banking mobile apps; one can imagine that in the coming years the various French administrations will also offer this service, so it is an investment for the future. As a backup key supporting only the FIDO protocol, you can turn to a more economical Yubikey key around 40 EUR, for example the "blue" model. I advise you to stick with the Yubikey brand, the only one supported without any issues by all platforms; they are the pioneers, the ones who invented the concept, it is a Swedish-American company, so this is Western engineering, made in the West only, no China in it 2) ebay Our good old dear ebay... a pioneer of the internet alongside Yahoo... - for TOTP, same as for Paypal. We now have the option to choose one of three second authentication factor modes: SMS (which will always remain a last-resort option for recovering an account), TOTP via a third-party app, authentication via the ebay mobile app. - And yes, good news, eBAY is ahead of quite a few people and now offers, for the general public and not just pro merchants, the registration of a FIDO key. The only catch is that they make a weird implementation outside the standards. At ebay, the FIDO key is a substitute for the password; if the second authentication factor is not activated, that's not great if the key gets stolen. If the second authentication factor is activated, you will systematically be asked for a TOTP or validation via the phone. In fact, the model has been revised. Initially, you had to open the ebay app itself, and that sometimes caused problems on phones that shut apps down to reduce consumption. Now ebay uses a built-in Android certification authority feature. Briefly, each phone is unique because it generates its own certificates carefully stored in a safe place by encryption (even if Israeli companies managed to "break" iPhones, long considered somewhat falsely as tamper-proof, but here we are talking about "state-level" means, the maneuver is not within reach of the average Joe). Once this phone has been validated as belonging to you via an initial SMS, the phone itself becomes a FIDO-type certification authority. ebay no longer needs to intervene through its own app, ebay uses a standard Google "API" to generate the message in your notification list, you have to pull down and click approve. OVH uses the same principle. NB: last I heard, ebay authentication via FIDO key seems to work fine on Windows, but on Linux it gets stuck, the option is not offered, whereas for Paypal, OVH.... Windows or Linux, it works in all cases. I need to investigate. It is possible that ebay individualizes each session by the FIDO plus browser identifier pair, and that you therefore have to repeat the registration operation for each browser... to be checked

Discussions

eBay/Paypal: second authentication factor. (A little spiel for those passionate about the subject) | Safety on eBay | eBay France