"The man-in-the-middle attack (often abbreviated MITM, MitM, MIM, MiM, MITMA) in cryptography and computer security is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances."
At the moment we write this on the fist page of HN there is an article about the MTM currently used by Chinese:
Where they don't even bother to remain undetected. I didn't think it would be much more complicated for the government which already does MTM to do the real-time query through the victim's SMS. The queries of the SMS would happen very rarely and need much less resources compared to the internet traffic.
Reading the conversation before I joined the discussion, I've also believed that worklogin also worried about the MTM as he wrote, many messages before: "With SMS-based 2FA, the token is sent via insecure channels to the user BEFORE auth, which is an opportunity for state actors and telecom to intercept it before use." I believed he wouldn't need to discuss when the token is sent otherwise and that his "intercept" was in the MTM-implied meaning "to take, seize, or halt (someone or something on the way from one place to another); cut off from an intended destination:
to intercept a messenger."
So, per your discussion, the existence of 2FA is irrelevant as soon as the internet is MTM-ed, that is, as soon as somebody plugs in your TLS session? I honestly have never considered how irrelevant it is then. Thanks. I still have some other view of the 2FA ultimate goals.
Like, there is this: https://news.ycombinator.com/item?id=8487115 on the first page now where Google exactly tries to avoid the SMS channel. I can imagine that you'd consider that more than 2FA which you discuss, it's also OK.
Just to summarize, I entered because the concern was about cleartext passwords being sent via SMS. This is almost never the case, typically it's a token.
As a mitigation tactic for full MTM, 2FA is basically without teeth. Same applies for the new item Google is trumpeting.
I'm not saying someone couldn't do a MTM with both SMS and full network, I'm saying it's overkill and redundant. There's no advantage. If you're already funneling the data, you have what you want.
> As a mitigation tactic for full MTM, 2FA is basically without teeth.
What I believe is that a mechanism can definitely be made where without having the second authentication item of the 2FA the MTM on the internet channel would be automatically deactivated (or the user would recognize the existence of the MTM since it would reject the connection). Namely, the MTMI (internet) point from my scenario wouldn't be able to keep the connection to the server active since it doesn't have the key which is needed to even have the (encrypted) communication: the key given from the entity with the server to the user, but not using the internet, and therefore impossible to be used by the MTM interceptor. I believe such a mechanism can be made as soon as we assume the existence of such a key. That some simpler forms are currently still more popular doesn't mean we should dismiss the properly implemented mechanism as "without teeth." Maybe you'd say that such a mechanism isn't 2FA at all. How would you call it?
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
"The man-in-the-middle attack (often abbreviated MITM, MitM, MIM, MiM, MITMA) in cryptography and computer security is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances."
At the moment we write this on the fist page of HN there is an article about the MTM currently used by Chinese:
https://news.ycombinator.com/item?id=8482119
Where they don't even bother to remain undetected. I didn't think it would be much more complicated for the government which already does MTM to do the real-time query through the victim's SMS. The queries of the SMS would happen very rarely and need much less resources compared to the internet traffic.
Reading the conversation before I joined the discussion, I've also believed that worklogin also worried about the MTM as he wrote, many messages before: "With SMS-based 2FA, the token is sent via insecure channels to the user BEFORE auth, which is an opportunity for state actors and telecom to intercept it before use." I believed he wouldn't need to discuss when the token is sent otherwise and that his "intercept" was in the MTM-implied meaning "to take, seize, or halt (someone or something on the way from one place to another); cut off from an intended destination: to intercept a messenger."
So, per your discussion, the existence of 2FA is irrelevant as soon as the internet is MTM-ed, that is, as soon as somebody plugs in your TLS session? I honestly have never considered how irrelevant it is then. Thanks. I still have some other view of the 2FA ultimate goals.
Like, there is this: https://news.ycombinator.com/item?id=8487115 on the first page now where Google exactly tries to avoid the SMS channel. I can imagine that you'd consider that more than 2FA which you discuss, it's also OK.