Yahoo Debuts End-To-End Encryption Email Plugin, Password-Free Logins 213
An anonymous reader writes: Yahoo has released the source code for a plugin that will enable end-to-end encryption for their email service. They're soliciting feedback from the security community to make sure it's built properly. They plan to roll it out to users by the end of the year.
Yahoo also demonstrated a new authentication system that doesn't use permanent passwords. Instead, they allow you to associate your Yahoo account with your phone, and text you a code on demand any time you need to log in. It's basically just the second step of traditional two-step authentication by itself. But Yahoo says they think it's "the first step to eliminating passwords."
Yahoo also demonstrated a new authentication system that doesn't use permanent passwords. Instead, they allow you to associate your Yahoo account with your phone, and text you a code on demand any time you need to log in. It's basically just the second step of traditional two-step authentication by itself. But Yahoo says they think it's "the first step to eliminating passwords."
I hope... (Score:4, Interesting)
Re:I hope... (Score:5, Insightful)
you can't make people care
there will be plenty that just don't care about privacy
there will be plenty that don't care and they're right: their online life is shallow crap
there will be plenty that don't care and they're wrong: their online info is used against them
some small fraction of the latter group will make an effort to correct that problem
this is, and always will be, a small percentage of people online
and honestly: it's not a problem. most people just aren't that interesting
if you want to spin frightening scenarios of government knowing everything about them, advertisers profiling their lives in every detail, the ease at which their finances and physical location can found in a snap, etc... they still won't fucking care
welcome to reality
Re: (Score:2, Funny)
Burma Shave?
Re: (Score:2)
Burma Shave?
Sorry, it's not Troll Tuesday*. Though maybe we can extend it ... :-)
(* Definition of Troll Tuesday: not really trolling (except for people with no sense of humor, who tend to get a mite upset), we "troll" to put a smile on people's faces while making relevant comments, not baiting people for emotional outbursts. Pretty much the opposite of trolling.)
Re: (Score:2)
Burma Shave?
That comment dates you to about 70 years old...
Re: (Score:2)
It's a stupid meme now.
I'm still waiting for Mail Pouch Tobacco barns to make an appearance...
Re:I hope... (Score:4, Funny)
so
don't read
Re: (Score:2)
Re: (Score:3)
Plugins are the wrong way to implement this. Plugins for browsers are generally a bad idea, and need extensive sandboxing to even begin to be secure.
There are pure Javascript implementations of public key crypto, but what it really needs is a new standard that browsers can adopt to support it. That could be extensions to Javascript or it could be something else, but a Yahoo specific plugin isn't the way to go.
Re:I hope... (Score:4, Informative)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
The real problem is that people are using web browsers to read their e-mail instead of a proper e-mail client that already supports the existing standards of pgp and s/mime This yahoo plugin is actually based on google's code for an end to end plugin. It implents pgp.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVBtrWAAoJEGgrLreJLenh890IAJMHRwdi6vN1wSFhJnDNHqIX
GTuTGo7BEFp0+4Qo9mTiYtbF8HhJy1NAClXUKQ+fsHF6NwfvqEq2Fe7909oXPSNk
DewmEMc8xHlKxp9xaz6kVNg8t3DoieJCc4JoSmkpXRPtsC/0k8bdrAaH/7dhk1ex
mKU8QLjz60a9cOSU3BoBg9bG2GJacI+1fv6JxNUuV8LaxCwwIBSP/a3TYRRBnZX9
+AW66Oljq/gf7UH+4NxuKxrZ2K2MRYDVi9N57skb8V9MfiK9livZCPNxPvGePpIk
CmCJXa9pHY9+fkIwJeHCbIEPumC5wMcUJcnvOupRbodEFI10oad0Hs0ZJXVwZec=
=xOyc
-----END PGP SIGNATURE-----
Re:I hope... (Score:5, Interesting)
This is a solved problem, although by a commercial solution. Symantec's Encryption Desktop (formerly PGP desktop) allows one to either decrypt/check signature and view what is on the clipboard or decrypt/check signature and view what is in the current window.
We don't need a Web browser plugin. This is like drilling a hole in a boat that has one hole already in it, expecting the water to drain out.
Instead, we need something with functionality similar to SED that is completely standalone from other applications and functions completely independent of the Web browser. This is tougher than it sounds. GPG4Win is a good effort, but it does not come anywhere close to the ease of use that SED has. Macs and Linux have decent utilities like GPGTools (which was pictured.) If PGP decryption is put into something, it should not be part of a Web browser, but should be in the MUA. Web browsers should have as little running as possible, just so they have as small an attack surface since they are the biggest frontline for computer compromise these days.
The beauty about the OpenPGP spec is that it is completely independent of any transport mechanism, be it Slashdot posts, E-mail, MMS, AIM, Facebook's PM, or a file saved to a ZIP drive. Tethering it to a protocol can easily render a quite secure system extremely insecure, if only for the fact that a specific program or browser extension would be needed for the decryption.
Ideally, fetching E-mail via the Web should be more of an item of last resort, where one is using another machine. A high quality MUA (Thunderbird, Mail.app, Outlook, even mutt) is a lot more secure than a Web browser.
Yea, Symantec....ok (Score:2)
I stopped reading after that. If you think Symantec is a solution to any problem that exists, then we'll just have to agree to disagree.
Re: (Score:2)
The real problem is that people are using web browsers to read their e-mail instead of a proper e-mail client that already supports the existing standards of pgp and s/mime This yahoo plugin is actually based on google's code for an end to end plugin. It implents pgp.
The problem is that the browser+javascript is the most ubiquitous platform around. It is also FAR more convenient to use.
I'd love to see a decent FOSS webmail application that supports encryption. The only options that exist right now are pretty weak compared to something like GMail.
Re: (Score:3)
The real problem is that people are using web browsers to read their e-mail instead of a proper e-mail client that already supports the existing standards of pgp and s/mime This yahoo plugin is actually based on google's code for an end to end plugin. It implents pgp.
The problem is that the browser+javascript is the most ubiquitous platform around. It is also FAR more convenient to use.
I'd love to see a decent FOSS webmail application that supports encryption. The only options that exist right now are pretty weak compared to something like GMail.
I get the feeling that very few people understand the problem here.
Both pgp/gpg and s/mime require ownership of a public/private key pair.
True, all the algorithm stuff for signing and encryption has already been implemented in javascript, but it's all useless without the keys.
How do you store and access those keys safely and securely from a web browser? That's what most of the existing webmail plugin solutions for pgp/gpg/smime do - they just provide a local keystore and make that available to the js method
Re: (Score:2)
How do you store and access those keys safely and securely from a web browser? That's what most of the existing webmail plugin solutions for pgp/gpg/smime do - they just provide a local keystore and make that available to the js methods to do the work.
Oh, I get that. However, there are a few options:
1. Store it on the server. That doesn't protect you against server compromise, but it still protects you against a lot of stuff, and there is no reason the server can't be as secure as your client would otherwise be. Keep in mind that webmail does not necessarily mean 3rd party provided.
2. HTML5 storage plus javascript. This can in theory be about as secure as a local client, but my big concern here is having some way to ensure that the javascript isn't
Re: (Score:3)
JavaScript is not a solution to this problem. To use PKI effectively you MUST trust the client. You can't trust the client if its being sent to you from the one of the men in the middle "Yahoo" every time you use it.
All it takes is for any of the following to happen and you are boned.
1) Someone SE's a CA or obtains a Yahoo.com Certificate by some other method, national security letter, hack of yahoo etc, the MITM you an Yahoo
2) Somebody hacks Yahoo and is able to alter the content on their web servers
3) Y
Re: (Score:3)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Considering that very few slashdotters in this discussion have PGP keys posted to slashdot..... I don't think that's too likely.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVBtjYAAoJEGgrLreJLenhhRwIALh3Sbcl2UVqx+pji+RCUytv
Yv11qS60cUFD387ITf4CMaxGdLFyOim5Y0XNgrCWQoxtywxidZLFaB5TIfVKE8Tr
Iyq/S9O2B4xCjxbAyhuYmjUfVNCH7renD8HoDn+uSMVLhwKuy3g9vvBwgz8UFJOf
AiLHYGGosJpBs0+rj9tT4e7cukCKJj+RVvduOG5ev84IdoU64bHfr9xkrtofgGJl
W7vV/O6jdzddk4iiLmKodkzdy2W4Y7eKPTSr
That's great if you have a mobile phone (Score:5, Informative)
Re: (Score:2, Informative)
The mobile number is just used to ensure two channels to the client, preventing a third party to sniff both part of the initial key. This is a very standard way to ensure that the encryption is actually secure. I would be more nervous if they DIDN'T require a mobile number (or secondary channel)
Re:That's great if you have a mobile phone (Score:4, Interesting)
If the phone number is exchanged on a compromised channel, it can still be attacked by a man in the middle.
Re: (Score:2)
Sure, that could work when registering the account, but you don't have any email yet at that point. The real user wouldn't even be able to log in since they would never receive an the actual SMS code. Who cares if an empty account is compromised?
Re: (Score:2)
The attacker could also relay the SMS to the real user. That way the real user does the first log in (and any others that require the SMS code), but the attacker's phone number is stored in the system for when they choose to log in.
Re: (Score:2)
The suggestion above was about a MITM attack between the end user and the server, not a compromised server.
Re: (Score:2)
Scenario at time of account signup:
Browser - MITM - Server
Scenario after signup:
Browser - (Optional MITM) - Server
User's phone - Attacker's phone - Server
1. Browser sends user's phone number to MITM
2. MITM sends attacker's phone number to Server
3. Server sends SMS code to attacker's phone
4. Attacker forwards SMS code to user (preferably masking the source number, perhaps using an internet SMS gateway)
To the user, the above process was transparent so the account is used normally. At any time the attacker ca
Re: (Score:3)
Their real goal is to prevent anonymous accounts. If they have your cell phone number they know who you are.
Re: (Score:3)
why would you do it in a way where interception of the initial communication would compromise anything? the client program can have the cert included so mitm would set off alarms, so to compromise it the initial client delivered to the handset would need to be have been compromised, in which case you would be fucked anyways?
you know why they want the phone number and so does pakistani government..
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
no, its mandatory on sign up.
Re: (Score:3, Interesting)
Re: (Score:2)
They required a mobile number.
If I needed a phone to access my email, I think I'd rather use the phone to make a damn phone call and skip the email.
Unsupported carrier (Score:3)
Can't you just make a throw-away VOIP (Skype, etc) number for this purpose, then get rid of it?
You can make it. You can try to use it. But when you do, Yahoo! will probably reject it as "unsupported carrier" the same way it does land lines.
Re: (Score:2)
I'm not sure why a luddite would also want an email account!
But in seriousness, at least in the UK, you can have SMS sent to a landline number no problem. Some magic along the way results in a phone call and a robot reading out the text message. Our banks even use an automated outbound voice messaging platform to do the same thing as the SMS for people who don't have a mobile.
I expect they'll offer this if demand is high enough.
Great, if you do not want to give away your privac (Score:2)
... privacy.
No phone number, no yahoo or google account for you. Because ... the NSA wants to know you.
Re: (Score:2)
Same with AIM.com sign ups. :( Not everyone has mobile phones. I don't own one/1 either!
Re: (Score:2)
I don't. I tried to sign up with Yahoo a few weeks ago and got cockblocked by this. They required a mobile number.
Yeah, you think that's bad, I don't even have a computer or internet access and they wouldn't let me sign up.I must have sent them a dozen faxes and letters, and I'm still waiting for my so called "free" email account. Is it really "free" if it requires an expensive computer to use it!?
You should have either sent a clay tablet, or maybe a telegram.
Public libraries offer one, not the other (Score:3)
I don't even have a computer or internet access and they wouldn't let me sign up.
I see the point you're trying to make with your sarcasm, but there's a difference: Public libraries offer Internet access. They do not offer SMS access.
Re: (Score:2)
You gave me a papercut
What's this thing called "paper"?
It's that thin stuff that you wipe with after you use the toilet. Comes in a roll. Too complicated for most men to replace :-)
Re: (Score:2)
just as a 'few' opt out of going outside
I thought technology did away with that for most people.
Pay per received text (Score:2)
There is also a middle ground between people who live on their phones and people who live without one. It's called prepaid mobile phone service, and it often carries a fee of 20 cents per sent text message and 20 cents per received text message. Having to pay 20 cents every time you log in to Yahoo! is not fun.
Re: (Score:2)
While my Mobile Phone has a lock screen, text messages are briefly displayed in it even in lock mode. Which means anyone who has my phone can briefly see the plain-text 'code' that Yahoo will text that number, even if the mobile device itself is locked for normal use. So (setting aside the legitimate issue that I may not have cell coverage all the time), it would seem rather easy to bypass the security mechanism here, because Yahoo is essentially putting my reset code out to an unsecured endpoint in a publicly visible manner.
Settings | Sound and notifications | When device is locked | Don't show notifications at all. Problem solved, at least on Android :-)
Re: (Score:2)
Can it be based on the sender? (Score:3)
Then perhaps the right way to think about it is that the cost/benefit analysis differs depending on the sender. If the sender is Yahoo! or another authentication service, show only the sender. If the sender is anyone else, show the sender and a few words.
Re: (Score:2)
AIM.com also does this for its sign ups. :(
BS (Score:2, Insightful)
End to end encryption with sending the code over an unsecure SMS so that the NSA can decrypt it anyway.
Nice.
*facepalm* (Score:5, Insightful)
Yahoo needs to understand that the purpose of 2-factor authentication was not to replace passwords, but rather to ... provide a second factor of authentication.
Remember ideally:
1. Something you know
2. Something you have
3. Something you are
Each is no more secure than the other, but together they form a far stronger system than any individual component.
Re:*facepalm* (Score:5, Informative)
I'm sure Yahoo understands this. But who wants to go through the hassle of two factors of authentication (including using a unique and difficult password) every time they want to read an e-mail ?
What they trying to do is find a way to provide good enough security that people will actually use.
Re:*facepalm* (Score:5, Insightful)
Wouldn't this ideally be presented as a choice to users?
1. I don't care who reads my email; use either password or SMS only.
2. I care only slightly who reads my email; use two factor authentication.
3. My email is actually of some importance; choose a different email provider.
4. My email contains sensitive information; cancel all my email accounts.
Re:*facepalm* (Score:4, Informative)
Wouldn't this ideally be presented as a choice to users?
Except for option 2, Yahoo offers those choices.
Re: (Score:2)
Re:*facepalm* (Score:5, Interesting)
Another idea that comes to mind is to use a feature that all web browsers have had for over 10 years (even Lynx) -- client certificates.
This way, on setup, the website asks the user if the current client certificate presented is the one he or she wants to use, then from there on, authentication is completely transparent.
It goes without saying to have SMS as a backup, but the absolute easiest way to authenticate on a "known good" computer is to have a client cert.
Re: (Score:2)
That works if the client is secure and consistent.
Not so good for an online web email service. And even less good for a phone which is easily lost or stolen.
Re:*facepalm* (Score:4, Interesting)
Passwords don't need to be unique or difficult. That's just stupidity created by people with overly aggressive password policies. If someone is going to go to the effort of using the "Something you have" route for authentication then the "something you know" is not a lot of extra effort especially if we can do away with the stupid 8+char+number+capital+symbol+unique_unicode_char_not_typable_by_a_normal_keyboard bloody combinations.
You instantly become resistant to brute forcing attempts with 2 factor authentication. The password doesn't need to be batteryhorsestaple if the max password entry rate is a password every 10 seconds. Simply horse would do. Heck Aardvark is probably sufficient too because who in their right mind would dictionary attack a password that slowly.
Re: (Score:2)
I've only used Google's implementation but it isn't much of a hassle at all. Your phone has an app that generates codes. The Gmail app doesn't need them because it's already running on your phone. When you log in to any Google app you need to put the code in, but can opt to never ask for it again on that computer. It is tied to the Chrome installation. You also only have to do it once and then you can access all Google services for that session without more codes.
Re: (Score:2)
The password could still be saved in the client and 2FA added as an additional layer. I personally won't be using Yahoo! mail for mobile much longer as their new versions require extensive additional permissions. Currently the app has no objectionable permissions, but the new version wants much more, namely: Device & App History, Identity, Contacts, Location, SMS, Wi-Fi connection info, Device ID and Call info. My current app functions as needed, WTF would I enable all that additional access? I pay for
Re:*facepalm* (Score:4, Interesting)
Out in the boonies, or in a reception-poor building in the 'burbs, SMS can take literal days to get through.
That would be an inconvenience up with which I would prefer not to put.
Now, an app that works like one of those SecureID fobs, so I'm not dependent on the vagaries of wireless reception? That would be pretty cool.
Re: (Score:2)
Now, an app that works like one of those SecureID fobs, so I'm not dependent on the vagaries of wireless reception?
Doesn't the google auth app (and other OTP based apps) work that way?
Re: (Score:2)
Re: (Score:2)
The ideal would be to use the standard TOTP method that Amazon, Google, EMC, and other companies use. The Google Authenticator is just one implementation of the standard, and there are others (Amazon has one, for example.)
I really wish Yahoo would have SMS as an -option-, but would allow TOTP as well. This way, if one has the seed keys in an app, they don't need to get a SMS, but if they are on a new machine, SMS still works.
Re:*facepalm* (Score:4, Interesting)
That's the purpose of "two-factor authentication", but not the purpose of any single factor. Yahoo is replacing the single factor "something you know" with "something you have", which is possibly an upgrade in security.
The factors themselves aren't equivalent in terms of security. "Something you have" is much easier for a normal person to secure than "something you know". That's why houses and cars use keys and office buildings use keycards and not codes. People (on average) are pretty decent at holding onto their phone and horrible at keeping their password safe (even if they pick a good password, which they wont).
how many people access yahoo mail on their phone? (Score:2, Interesting)
To the second point (Score:4, Insightful)
What if your phone is dead/stolen and you desperately need to get a message out? You're fucked.
NOTE: They just killed Yahoo! Profiles. In short, they are collecting data for themselves while making it harder and harder for Yahoo! users to search each other out.
Re: (Score:2)
Fuck Yahoo! This is just a sleazy way to collect phone numbers and associate them with email addresses.
You seriously don't think that this practice is confined to Yahoo! do you?
Re: (Score:3)
Re: (Score:2)
Actually it's 2-factor authentication on the cheap as users don't think their own security is worth spending money buying a token. It also make a shitload more sense than a recovery email address, because that's the reason I sign up for email, just so I can use a different email account and keep an old one live right?
Metadata (Score:2)
Re: (Score:2, Informative)
Re: (Score:3)
Sure there is. All you have to do is use stegnography to encode your message into a photo, then use that photo in what looks like a spam email message, then pretend your computer is taken over by a botnet and send the spam to a few thousand email addresses (including the one you actually want to send to). Absolutely no useful metadata there.
Re: (Score:2)
Re: (Score:2)
Sure there is. All you have to do is use stegnography to encode your message into a photo, then use that photo in what looks like a spam email message, then pretend your computer is taken over by a botnet and send the spam to a few thousand email addresses (including the one you actually want to send to). Absolutely no useful metadata there.
Do you know what metadata is [makeuseof.com]? It's the information like who it originated from and the destination address. That will still be
Re: (Score:2)
IMHO, the perfect is the enemy of the good. Even though metadata is not protected, data is, so if Yahoo gets hacked, people's E-mail is protected.
One doesn't have to use their OpenPGP extension, nor their authentication. I'm glad it is available.
As for metadata, we already have a way for this. NNTP and alt.anonymous.messages. There is a DEFCON report on how good/bad this security is... but if you really want privacy, this is the next step up because the messages go to nobody in particular... just the ne
They should adopt SQRL (Score:5, Interesting)
Re: (Score:2)
And everyone in the UK speaking world dies laughing / wretching.
Cheers,....
Re: (Score:2)
My best guess is the Cybex SQRL bike may be well-known there.
However, I don't really like the idea of SQRL. Neither this protocol, nor GRC, has a particularly good reputation in security circles. [SQRL doesn't seem to do what it claims very well](http://security.stackexchange.com/questions/43374/could-sqrl-really-be-as-secure-as-they-say).
Re: (Score:2)
Steve Gibson is still relevant?
Um no. (Score:2)
Hilary Clinton (Score:2)
A secure SMS ? (Score:2)
As SMS are far than secure, they just transmit the key access to your emails as readable by [nsa]body.
Re: (Score:2)
Second, you don't need to use a web browser or sms - they have an app for that.
Let's tie my comm links unseparably together (Score:5, Insightful)
Oh no, my phone is dead/stolen! Better email people and tell them not to phone me and I'll be reachable by email.
Just need to log into my email and ... ... shit...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Only the site sending the code and 'the users' phone will ever know
The phone is on all day, the logs are kept for years, lots of different groups might get the logs in bulk for official use or even local legal issues.
Thats a very long term record of a username, when created and all connected phone activity, movements over many years.
The mutitude of passwords and logins do offer a user the ability to only keep data with a
Going to be a noob (Score:2)
Please...serious answers only...I don't care if you hate/love Apple or Android.
But, what is the likelyhood of the following:
1) Malware running on your non-jailbroken iPhone?
2) Malicious scripts running in the browser talking to other apps on the device?
3) Potential for your SMS traffic to be intercepted on a non-jailbroken iPhone?
4) Ability of an app to access SMS traffic on an iPhone?
Now, apply the same questions as they apply to latest incarnation Android?
My understanding is that sandboxed nature of iOS w
Re: (Score:2)
Or the resale or fun of getting massive amounts of account logins.
Security services, federal, state gov, a local court, local gov, a private group that works for local gov, staff that has local gov access, a private group that works for contractors with access, a person who can afford to request the account be found, tracking a journalist who had a email from that brand of email provider.
Tracking back that persons phone gets t
The NSA can read your txts too (Score:2)
Re: (Score:2)
you can be compelled to give the encryption keys to the security services
In America, there would be a strong argument that this is in contravention of the Fifth Amendment of the consitution (as it would be self-incrimination). Not sure how that's played out though.
But yes, in the UK, there is a specific criminal offense of "Not disclosing your encryption key" which carries a 2 year sentence... and you can of course, be asked to disclose your key again once you've served it...
Re: (Score:2)
In the US, when the judge orders it and you don't comply, it's contempt of court. He'll have you thrown in jail until such time as you agree to unlock your phone.
There's a case going through Canadian courts where someone refused. We'll let you know what happens, if anything, because apparently this was the first time that a Canadian has refused to let Canada Border Services (CBS) look at their phone and CBS decided to make an issue of it.
Re: (Score:2)
Is that right? I assumed that US law was like UK law - there is no law against using strong encryption but you can be compelled to give the encryption keys to the security services.
You always have the right to remain silent. You cannot be compelled to give testimony, although they might try to slap you with an obstruction of justice rap.
Re: (Score:2)
Re: (Score:3, Insightful)
With phones becoming primary form of email access for many, two-factor that relies on phone defeats the purpose.
Re: (Score:2)
Factor one: Something you have - your phone.
Factor two: Something you know - the text code.
Just don't lend your phone to evil people.
Re:security (Score:4, Informative)
Also, don't lose your phone where evil people might find it.
Forgive me if I've got the following arithmetic wrong, but if they remove one factor from two-factor authentication, doesn't that make it one-factor authentication?
I don't see eliminating passwords as an important goal. Instead, the goal should be to increase security. To that end, I've recently begun to use two-factor authentication on all my important accounts. However, I'm finding that each service implements it differently, so it's a bit annoying to have to remember how to deal with each one. Also, I use one service that requires a hardware token which they mail to you, and that makes it more difficult to get the whole thing set up, compared to the more common case where you just give them your phone number and then two-factor authentication begins to work nearly instantly. So, it would be nice if we had some industry standards on all that.
Since some services make two-factor authentication somewhat difficult to set up, I get the impression that they find that the increased support costs for it to not be worth it, at least from the service's point of view. Of course, from the customer point of view, if it prevents a security breach to an important account, it's well worth the extra trouble.
Re: (Score:3)
Of course, from the customer point of view, if it prevents a security breach to an important account, it's well worth the extra trouble.
That's the problem. You can't prove it prevented a security breach so most users just see it as a PITA extra step and definitely NOT worth the extra trouble. My experience has been the harder it is to access something the less people use it. It's so hard to do some simple tasks on my current corporate network that at least half the office brings in their own laptops to get their work done. They just expense a WiFi hotspot and use it in the office.
Re: (Score:2)
That's the problem. You can't prove it prevented a security breach so most users just see it as a PITA extra step and definitely NOT worth the extra trouble.
Agreed. We've heard about high-profile cases like Target (credit card breach), Sony (everything breach), and recently Anthem (personal data breach), but I've never heard of any breaches involving investment/brokerage services, which is the category where I personally might suffer the most damage. However, in my own case, I'm just trying to be proactive by using two-factor authentication on those.
It seems like if hackers could get into one of the major investment/brokerage services, they could siphon off a
Re:security (Score:4, Interesting)
You just hit the nail on the head. As of now, if someone steals my phone in an unlocked state, they will be able to get the second factor... but they won't be able to log into the account due to the password. What having just one factor does is make a phone theft all the more crippling where a bad guy can do a lot of damage.
2FA is 2FA because it covers at least two of these properties: Something you know, somewhere you are located, something you are, and something you have. For example, a secure biometric system uses the fingerprint/retina scan as a username, then a PIN for access, or a remote access system uses a password and a OTP so that if the password gets sniffed, the OTP is still an obstacle.
On the other hand, perfect is the enemy of the good. In general, someone is going to be less likely to have their phone stolen than to have their password sniffed or cracked, so moving to a SMS message can be argued to be a security improvement.
Re: (Score:2)
In less time than it took you to type out your screed, you could have read the article that talks about the password code. It's OPTIONAL,
When you try to sign in, you'll see a "send my password" button instead of a traditional password text box if you enable the system. The new sign-on method is available now.
Be lazy - read the fine article first :-)
Re: (Score:3)
I checked out the link, there was no mention of what kind of encryption they will be implementing.
Actually, one link directly says what kind of encryption:
https://github.com/yahoo/end-t... [github.com]
Use OpenPGP encryption in Yahoo mail.
Yahoo End-To-End
A fork of Google's End-to-End for Yahoo mail.
and the other link shows it in action:
http://yahoo.tumblr.com/post/1... [tumblr.com]
If you watch the gif, you can see a PGP code block
Re:No Phone (Score:4, Insightful)
I have one, but I don't *trust* Yahoo with it. The moment i won't be able to log in without my phone is when I give up on their services...
Re: (Score:2)