2FA, WTF?

on YouTube ↗39m

" summary

Explains why an account takeover like Matt Honan’s happens and shows three concrete 2FA methods: SMS codes (easy but interceptable), time-based one‑time passwords (HOTP/TOTP libraries, 6‑digit codes, QR code provisioning) and push approvals (phone app + webhooks). Cites Ashley Madison’s 11 million broken passwords to justify adding 2FA, walks through generating/verifying TOTP, sharing secrets via QR, and a 3‑call API option to outsource verification so systems don’t hold secrets.

AI-written summary · about

" chapters (16)

1. 0:00Introduction and warning
2. 1:03What is 2FA?
3. 2:46Matt Honen hack story
4. 7:43Password security risks
5. 10:56Personal hacking experience
6. 13:00Adding 2FA to login flow
7. 14:47SMS 2FA pros and cons
8. 16:55Soft token 2FA explained
9. 19:45HOTP and TOTP algorithms
10. 23:58Sharing secrets via QR codes
11. 26:04Soft token pros and cons
12. 27:30Don't build your own 2FA
13. 28:112FA as a service with Ory
14. 30:38Push notification 2FA demo
15. 32:48Summary and recommendations
16. 35:26Q&A on privacy and data

" related talks

• 50mA tale of two sides of 2FAChristine Seeman · NDC London 2020
• 25mAuthentication Beyond SMSKelley Robinson · PasswordsCon 2018 Stockholm
• 48m2FA2Furious: New Threats to MFANathaniel Okenwa · NDC London 2024
• 50mOne Does Not Simply Add MFAChristine Seeman · YOW! Melbourne 2022
• 24m2FA in 2020 and BeyondKelley Robinson · BSidesSF 2020
• 24mTwo Factor FailureRyan Lackey · Black Hat Europe 2014
• 17m2FA in 2020 & BeyondKelley Robinson · GOTO Chicago 2020
• 17mImplementing Multi-factor AuthenticationJacob Kaplan-Moss · dotSecurity 2016