Who would cross the Bridge of Death? Answer me these questions three! Oh and you'll need two-factor authentication
- Reference: 1624609807
- News link: https://www.theregister.co.uk/2021/06/25/something_for_the_weekend/
- Source link:
I am trying to sign into some services I set up ages ago but the Login Lords are having none of it. Quite possibly they are punishing me for having the temerity to disable two-factor authentication, triggering a Spitefulness subroutine which requires them to express their consequential existential crisis by taking it out on me. You're not who you claim to be , they whisper. We think you're lying .
Great. It's 4:00am and I'm being dissed by uppity electrons 6,000 miles away.
[1]
So I'm a liar. What's new? Much of what I write in this column is made up. But then… if that's true, what I just said might be untrue.* Ho ho, it's one of those entertaining conundrums! I must write a LinkedIn post about it to demonstrate what an insightful smartarse I am.
[2]
[3]
I only disabled 2FA because it was texting validation codes to a mobile phone number I haven't owned in years. No standard alternative was offered: no authentication app, no email check, no password reminder prompts, nothing. All I was allowed to do was log a support request and wait 72 hours.
Apparently, me asking to disable my 2FA marks me down as such a drastic security risk that the only way I can do it is by emailing my request to a faceless minion at a generic support address along with a scan of my passport as a file attachment.
[4]
It occurs to me that this is akin to dropping my trousers in the middle of a crowd, bending over and shouting: "Could a qualified person please check that my arse is secure?" But naturally I comply. I wouldn't want to represent a security risk to the company running those online services, would I?
Looking at the problem from the company's point of view, I could be anybody. I could be trying to circumvent my own login by only pretending to be me. Some people are good at imitation. This guy, for example…
[5]Youtube Video
[6]
I am not so good at this sort of thing. I am so bad at it that I can't even impersonate myself adequately.
This is made plain to me three days later, shortly after receiving the notification that 2FA has been removed from my account. Still suspicious of my motives, the Artificially Intelligent Angels of Authentication have inserted a CAPTCHA into my new sign-in procedure.
Buggeration.
It begins harmlessly enough with a tick option. Just as daleks can't climb stairs and 1960s self-aware computers hell-bent on world domination can't answer the question "Why?" without spontaneously combusting, it seems that robots don't know how to tick.
[7]
Don't click on me. I am not a robot. I'm a screenshot
Evidently, neither do I. The Californian robot that is evaluating whether I am also a robot is unconvinced by my ticking. It is now asking me to click on impossibly indistinct photos that might contain pedestrian crossings. This suggests that robots must have a tendency to step off the pavement without looking. I make a note to contact Boston Dynamics and claim my bug-finder's fee.
The CAPTCHA doesn't like my photo selections. It appears I'm not very good at recognising the flaky splatterings of ground paint that indicate where pedestrians are supposed to cross the dirt-caked, crumbling, potholed bitumen that Americans call "roads". So CAPTCHA loads up another set of photos and asks me to click on bits that contain traffic lights. No luck. Then it asks me to click on road signs. Then motorcycles.
[8]What job title would YOU want carved on your gravestone? 'Beloved father, Slayer of Dragons, Register of Domains'
[9]Whatever you've been doing during lockdown, you better stop it right now
[10]How many remote controls do you really need? Answer: about a bowl-ful
[11]Whoop! Robot/human high-fives all round! Oh, my fingers have disintegrated
From these tests, I am led to believe that robots don't know what roads, traffic lights, road signs, or road vehicles look like. Good job nobody in their right mind expects a robot to drive their car for them or we'd be in real trouble.
It's now asking me to click on pickup trucks. Then it's chimneys. Burger stands. Apple pies. Corn dogs. Hmm, no wonder I'm getting them wrong: these images seem to be culturally particular to north America. It may as well show me photos of school playgrounds and ask me to click on all the squares containing semi-automatic weapons.
[12]I'm with this guy on the pros and cons of CAPTCHA. The UX friction doesn't bother me – it's a type of gamification and that's all the rage I hear – so much as the uniform cultural assumptions made by those asking the questions. It's like when I see this kind of thing…
I don't care if you're double vaccinated, just stay away from me
… I can't help imagining what it's like if you are colour blind. For example, someone suffering from protanopia is likely to see things a bit like this:
Hug, marry, avoid. It's all in the wrist… if you can see the difference
On a whim I switch CAPTCHA to audio mode and somehow eventually trick the bastard into letting me in. Except, of course, it shouldn't really count as a trick to be allowed in to your own login, should it?
By now, I expect my 2FA cancellation and subsequent difficulties in signing in have put me in the crosshairs of security services worldwide. The Keychain Kings will have started gossiping among themselves, I'm sure, and soon enough I will be locked out of everything until I send my fingerprint and DNA records via open email to support@supportymcsupportface.net.
When Alan thought up his AI variant of the "imitation" parlour game, he imagined humans would try to determine whether they were conversing with a robot. Somehow we have stumbled into a dystopia in which robots are allowed to determine whether or not we are human.
I'm not very good at imitating one of those.
[13]Youtube Video
Alistair Dabbs is a freelance technology tart, juggling tech journalism, training and digital publishing. More at [14]Autosave is for Wimps and [15]@alidabbs . He promises he will get around to writing new stories for 'Wimps' just as soon as he overrides the password block. And can be arsed.
*Rest assured, dear reader, everything is this column is the gospel Liber AL truth, as Thoth is my witness. Everything is permitted. Call me Aleister.
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNWpOTO1kse8Bg@5rJADagAAANE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNWpOTO1kse8Bg@5rJADagAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNWpOTO1kse8Bg@5rJADagAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNWpOTO1kse8Bg@5rJADagAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://youtu.be/bKmwb41gZTE
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNWpOTO1kse8Bg@5rJADagAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://regmedia.co.uk/2021/06/24/captcha-tick-only.png
[8] https://www.theregister.com/2021/06/18/something_for_the_weekend/
[9] https://www.theregister.com/2021/06/11/something_for_the_weekend/
[10] https://www.theregister.com/2021/06/04/something_for_the_weekend_/
[11] https://www.theregister.com/2021/05/28/something_for_the_weekend_/
[12] https://www.theregister.com/2021/06/22/to_use_captcha_or_not/
[13] https://youtu.be/ecvToqHd-qE
[14] https://autosaveisforwimps.substack.com
[15] https://twitter.com/alidabbs
[16] https://whitepapers.theregister.com/
Re: You're absolutely right, Dabbsy
Like Microsoft endlessly claiming that a 4 digit PIN stored in their "cloud" is more secure than a complex password.
Who would cross the Bridge of Death?
I thought there was already a thread about Windows 11
Robots and boxes
I remember reading that a bot trying the CAPTCHA always clicks in the exact center of the box, something no human can possibly do...? Perhaps Dabsy got lucky and did hit the exact center?
Ah yes, the chimneys.
2021 is the year of Google Robot Santa.
Am experiencing exactly the same
My iPhone decided that with the last update that it would remove all Google Authenticator data and none of my 2FA settings had been backed up (it has to back up to Google cloud, not the Apple cloud). So just now I tried to log into a client portal and it wouldn't allow me in. Never mind the "Is it done yet?" Teams messages which I have circumvented by saying "Tech issue - ticket raised".
Now waiting on a nice lady in Manila at ServiceNow to unblock 2FA and let me manage to screw it all up again.
Fuck CAPTCHA's.
That is all.
Re: Fuck CAPTCHA's.
You'll feel better if you fuck people.
Re: Fuck CAPTCHA's.
Exactly, get a job in politics.
Ah Captcha!
That strange game where I'm asked to tick squares with fire hydrants, yet there's no sign of a cast iron lid or a yellow "FH” plaque! (Other styles are available in those countries that have fire hydrants.)
Traffic lights are more uniform around the world, but is the pole part of the traffic light or not? In contrast, a tiny triangle of white paint in an adjacent square is apparently not part of a pedestrian crossing!
Surely we can do better!
Re: Ah Captcha!
But if we do, how are all the self-driving cars supposed to know what's what?
I'm personally convinced that all this Captcha stuff is really just for the crowd-sourced data that their cars are using to identify stuff on/around the road.
So maybe Tesla need to push for a few more Captcha's featuring semi trucks and trailers?
Re: their cars are using to identify stuff
USA Roads.
Re: Ah Captcha!
Captcha, the bot-check that leaves you with the weird sense of foreboding that you're going to get hit by a bus you didn't see coming whilst crossing the road.
From these tests
They are not really about validating you. It's crowd funded machine learning.
I put on my web form, in different places:
The Subject must be at least a ten character phrase.
Please enter a sentence of at least ten characters as your message:
and the CAPTCHA is a simple addition question like 3 + 2 =
Spam has dropped to zero.
Yes, it useless for people that can't read and write English, but I as the recipient can only read and write English. I did upgrade to HTTPS: which has increased page hits by about x100, though I suspect bots, even though my counter is supposed to ignore bots. How does that code know?
https://xkcd.com/2228/
and
https://xkcd.com/1897/
You're absolutely right, Dabbsy
All these websites that are pretending to "secure" my login by asking me my phone number for 2FA, and then they get hacked by miscreants and where's my security now ?
If I wanted my phone number to be available to the general public, I'd not have chosen to subscribe to the liste rouge , the French version of Do Not Call.
You're just a website. I can manage my own security better than you, thank you very much.