Better than 2 factor authentication

[APTI]

I for one am tired of engineers designing security and using 2fa relying on email accounts that are about as secure as an open door or a phone that is maybe not there at the time or also as secure as the email.
What I want is to create a new method of authentication that hopefully will catch on. Something that does not require email or phones. And that is not annoying to use.

My thought is a 2nd password. Something that is very different from the original one. So give a user name, then password 1 and then password 2. Seems to me this would be far easier to use than current 2fa and probably more secure. I know there are 2fa that use usb chips and that is not what I am looking for. I am hoping we can collaborate on this and come up with something then make it known.

 

[MikeRocor]

I for one am tired of engineers designing security and using 2fa relying on email accounts that are about as secure as an open door or a phone that is maybe not there at the time or also as secure as the email.
What I want is to create a new method of authentication that hopefully will catch on. Something that does not require email or phones. And that is not annoying to use.

My thought is a 2nd password. Something that is very different from the original one. So give a user name, then password 1 and then password 2. Seems to me this would be far easier to use than current 2fa and probably more secure. I know there are 2fa that use usb chips and that is not what I am looking for. I am hoping we can collaborate on this and come up with something then make it known.

I suspect that web sites that require username + password + email verification or phone/text are less interested in security than they harvesting verified contact information. In almost all cases, I think 2fa is a scam - if I present my username and password then I have authenticated sufficiently. My bank, maybe can have 2fa. But facebook?... No. Linux.org?... No.

 

[kc1di]

Found this article interesting also. There will one day come a better way I hope.

Your password manager isn't as safe as you think

Security experts have found serious security vulnerabilities in widely-used password managers. Here's what they advise users to do.

www.pcworld.com

Though I use a PW Manager is it really a safe way to do things? I don't know an hope there will be an answer soon.. If you have a different password for every site you visit that requires one, my brain is not able to keep track of the all any more so have to use something. Good luck in your project. Hope it bears fruit for all of us.

 

[deb_user]

There are several better 2fa methods than email, and most sites use them. Passkeys, physical security keys (Yubikey et al) and authenticator apps all do an adequate job. Phishermen who can get your primary password can also get a second password, and I don't think that offers much security over a single strong password. If you use P@$$w0rd for your password, then you deserve to be phished and hacked. If you supply your password once, you're likely to also supply a second one. It's a human problem, not a problem with the method.

 

[Alexzee]

I for one am tired of engineers designing security and using 2fa relying on email accounts that are about as secure as an open door or a phone that is maybe not there at the time or also as secure as the email.
What I want is to create a new method of authentication that hopefully will catch on. Something that does not require email or phones. And that is not annoying to use.

My thought is a 2nd password. Something that is very different from the original one. So give a user name, then password 1 and then password 2. Seems to me this would be far easier to use than current 2fa and probably more secure. I know there are 2fa that use usb chips and that is not what I am looking for. I am hoping we can collaborate on this and come up with something then make it known.

Agreed the 2fa is a real pain in the caboose and the captcha pictures are a mess. It's often been my experience that captcha doesn't work no matter how many images are selected. Thus leaving me no way to get into the website I need to chat with colleges/associates of mine.

So aside from looking for 2fa that doesn't use usb chips what other engines, pkg's, apk's or types of functionality would you need to pull this project together?

 

[APTI]

Agreed the 2fa is a real pain in the caboose and the captcha pictures are a mess. It's often been my experience that captcha doesn't work no matter how many images are selected. Thus leaving me no way to get into the website I need to chat with colleges/associates of mine.

So aside from looking for 2fa that doesn't use usb chips what other engines, pkg's, apk's or types of functionality would you need to pull this project together?

at this point I am looking for ideas and publicity. There are many papers written about how 2fa using phones or email are making things less secure. Perhaps as mentioned it is the illusion of security or they just want more personal information. I am just fed up with 2fa and seeing that hackers can get in with it in place easier than me (the actual authorized person) can get in.

 

[Alexzee]

at this point I am looking for ideas and publicity. There are many papers written about how 2fa using phones or email are making things less secure. Perhaps as mentioned it is the illusion of security or they just want more personal information. I am just fed up with 2fa and seeing that hackers can get in with it in place easier than me (the actual authorized person) can get in.

If you find good information let us know.
I'm willing to help, I just don't know what to look for or how to create a better system.

 

[APTI]

If you find good information let us know.
I'm willing to help, I just don't know what to look for or how to create a better system.

honestly I am looking for ideas. and the help would be to make the final idea public and used.
the requirements are...
1... should not be annoying or difficult for the authorized user.
2... Should stop or greatly cut down hackers.
3... Should not rely on any kind of physical device that can be lost.
4... Should be invisible....

Let me explain invisible. That means we follow the old saying that the best security is that which you do not see or know is there. Example. I wrote a P.O.S. system. I made a flaw in it that allowed users to appear to ring up items and then delete them before finalizing. This was done on purpose. The system was being used in a bar. The owner contacted me and told me his inventory was way off. He showed me the inventory report and the physical count. I had the differences in front of me. What was not known is that when you deleted an items from an order it was logged. When I pulled the log and we looked at it, the number of deleted items matched perfectly with the difference I was shown. The log also showed who removed the items. The owner then realized the system worked perfectly and even exposed 2 thieves he had working for him. The security worked because it was invisible. And was turned into an electronic mouse trap.

 

[Alexzee]

honestly I am looking for ideas. and the help would be to make the final idea public and used.
the requirements are...
1... should not be annoying or difficult for the authorized user.
2... Should stop or greatly cut down hackers.
3... Should not rely on any kind of physical device that can be lost.
4... Should be invisible....

Let me explain invisible. That means we follow the old saying that the best security is that which you do not see or know is there. Example. I wrote a P.O.S. system. I made a flaw in it that allowed users to appear to ring up items and then delete them before finalizing. This was done on purpose. The system was being used in a bar. The owner contacted me and told me his inventory was way off. He showed me the inventory report and the physical count. I had the differences in front of me. What was not known is that when you deleted an items from an order it was logged. When I pulled the log and we looked at it, the number of deleted items matched perfectly with the difference I was shown. The log also showed who removed the items. The owner then realized the system worked perfectly and even exposed 2 thieves he had working for him. The security worked because it was invisible. And was turned into an electronic mouse trap.

Remarkable and good work APTI.
I tip my hat to you for this type of work. We need more minds like yours for solving these kinds of things.

The only idea that I can think of is a running daemon or small application that can run in the background w/o lots of authentication. Perhaps something like this would need elevated privileges but only for a few seconds to run.

Maybe our member @GatorsFan may have some ideas?

 

[kibasnowpaw]

I use passkeys where I can, including on this forum, and honestly that is still the best direction I have seen so far.

The reason I do not think “password 1 + password 2” is the answer is that it is still the same factor twice. It is still just “something you know.” If a person gets phished, keylogged, shoulder-surfed, socially engineered, or tricked into typing both, then the second password did not really save them. It adds friction, but not a different kind of proof. To me that is the core problem with the idea.

Passkeys make more sense because they change the model. You are not just typing more secrets into a box. The login is tied to the real site and approved with a key pair, which is why they are so much stronger against phishing than normal passwords. From the user side they are also a lot less annoying when they are implemented properly. That matters, because security that is miserable to use usually gets worked around or ignored.

Where I think the discussion gets more interesting is the part about what should happen when passkeys are not available or when a site wants a stronger step-up check. In that case, I actually think something closer to how MitID works in Denmark is a much better model than email codes or SMS. Not because government ID systems should be copied blindly everywhere, but because the flow itself is better: you start the login on one device, then approve it in a separate trusted app, often by scanning a QR code and clearly seeing what you are approving. That is a lot cleaner than “we sent a code to your email” or “hope your phone number still works today.”

Steam’s QR login is another good example of the same basic idea. You try to sign in on the PC, scan the QR code with the Steam mobile app, approve it on the device already linked to your account, and you are in. That is a far better experience than juggling email codes, and it is also better than pretending two typed passwords is some major leap forward.

So if you ask me, the best path is not inventing a new secret for people to memorize. It is:

passkeys wherever possible,
QR/app approval as the next best option,
recovery codes stored safely offline for when things go wrong,
and email/SMS only as a last-resort fallback.

As for the “invisible” side of security, I do think you are onto something there, just not with the login secret itself. The invisible part should be things like session checks, unusual-login detection, rate limits, impossible-travel flags, device reputation, and good logging that helps catch abuse without making normal users jump through hoops every single time. That is where invisible security actually shines.

So overall, I agree with the frustration, especially with weak email-based 2FA and SMS nonsense. But I do not think a second password is really better 2FA. I think passkeys are the best answer we currently have for normal users, and flows like MitID or Steam QR approval are probably the best examples of how to handle the “step-up” part without turning login into a circus.

 

[deb_user]

If you want something transparent and easy to use, plus secure, passkeys are the answer. Trying to invent something on your own, and trying to convince the world that your mousetrap is better, has almost zero chance of succeeding. Very many, very competent people have worked on this problem for years. If a better mousetrap was possible, I think it would already be in use. But good luck in your windmill tilting. I have better things to do.

 

[Condobloke]

But good luck in your windmill tilting

Amen

 

[CaffeineAddict]

3... Should not rely on any kind of physical device that can be lost.

But physical device authentication is the most secure form of 2fa, like yubi key.
It can be lost but better than this is biometric authentication, (you can't lose your eye unless somebody knocks it out lol)

---

2nd password is usually used for encryption, and 1st pwd for authentication.
verifying your login biometrically can't be easily hacked.

 

[APTI]

But physical device authentication is the most secure form of 2fa, like yubi key.
It can be lost but better than this is biometric authentication, (you can't lose your eye unless somebody knocks it out lol)

---

2nd password is usually used for encryption, and 1st pwd for authentication.
verifying your login biometrically can't be easily hacked.

clearly you never watched the movie "Demolition Man" the evil Simon Phoenix figured out about the retinal scan and pulled the guy's eye out.
Physical key can be stolen or lost just like a house key so I say yes it is far better than what companies use with email or sms but still has a severe issue which is damage or loss.

 

[KGIII]

clearly you never watched the movie "Demolition Man" the evil Simon Phoenix figured out about the retinal scan and pulled the guy's eye out.

That wouldn't work in reality. For a whole variety of reasons, it won't work.

You also can't really do it with a finger, at least not for very long. (We're talking less than ten minutes.) While you can use a finger to get a fingerprint, even your bog-standard cell phone has capacitive testing involved.

Movies are a horrible source for such things, much like how cars don't just explode when they're in an accident.

 

[APTI]

That wouldn't work in reality. For a whole variety of reasons, it won't work.

You also can't really do it with a finger, at least not for very long. (We're talking less than ten minutes.) While you can use a finger to get a fingerprint, even your bog-standard cell phone has capacitive testing involved.

Movies are a horrible source for such things, much like how cars don't just explode when they're in an accident.

I know, but people believe cars explode that way. I rolled up to a small accident and 5 people in the car saw the tail light catch fire, which I snuffed out with my foot. They were out of that car in under 8 seconds yelling it's going to blow. I have been on many car fires and never saw one explode. Biggest explosion was the tire.

 

[Alexzee]

But physical device authentication is the most secure form of 2fa, like yubi key.
It can be lost but better than this is biometric authentication, (you can't lose your eye unless somebody knocks it out lol)

---

2nd password is usually used for encryption, and 1st pwd for authentication.
verifying your login biometrically can't be easily hacked.

I can see where biometric authentication is good. I use it myself.
However I'm not entirely sure how that would work on a Linux desktop.

 

[deb_user]

Fingerprint readers exist, but expecting everyone to buy, install, and configure one is far from realistic. I can't agree with any of the OP's opinions.

 

[APTI]

Fingerprint readers exist, but expecting everyone to buy, install, and configure one is far from realistic. I can't agree with any of the OP's opinions.

I never said we should go with fingerprint readers. In fact I never mentioned them. Let me constrain this a bit. Getting into your own systems should be however you want it. personally I prefer minimal security for my personal stuff.
What I am getting on is signing into banking or anything else. Those places that insist on more than just a password. That is where I am targeting.

 

[gvisoc]

My thought is a 2nd password.

If you want to create a second factor of authentication you have to change from password to something else, as you are not changing the factor, you are adding another element of the same factor.

A password is something you know, a second factor is usually something you have (but don't know), a third would be something you are (but not have --can't be stolen--, or know --can't be told or heard).

OTP and email or phone verification are second-factor ones not because the code you receive, because they use something you have (an email account, a phone) as opposed to something you know. They are not perfect because, in my opinion, many of them can be received through the same device, which (mostly) defeats the purpose of "having (another) thing". But alas.

These differences (something you know v. something you have v. something you are v. ...) are "the factors" as referred by cybersecurity folks (I am not one of them, but I do work with them).