News: 1633077005

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

2FA? More like 2F-in-the-way: It seems no one wants me to pay for their services after all

(2021/10/01)


Something for the Weekend, Sir? "Buy me a beer?" Sure, I buy beers for perfect strangers all the time. But you will have to wait your turn. There is a queue, and the other strangers are more reluctant to accept my hospitality.

It is already 11pm and I am still sprawled across the sofa. I had been hoping for an early night but fat chance now. Pride is at stake. I will absolutely not go to bed until someone somewhere takes money from me.

So much for good intentions. Shortly before 10, I had settled down with my smartphone and a mug of vaguely chocolate-smelling chemicals dissolved in hot water to check my tasks for the next day.

[1]

Mmm tasks. I have been trying out a variety of taskmaster apps on my handset. This is because I had been told by colleagues that I would achieve greater efficiency at work and even obtain a warm glow of personal satisfaction by organising my obligations into a set of to-do lists and ticking off each item as I carry them out.

[2]

[3]

So there I am, scrolling downwards with a warm glow of personal satisfaction past three screenfuls of P1 flags, exclamation marks, and the word "OVERDUE" repeated in Roboto Black 900 upper case #E10600 until I find the tasks for tomorrow. Ah, here we go: an early start. Better sup up and go to bed.

At that moment, a message slides down from the top of the screen. It reminds me that I am on trial and I will shortly be due for committal. For a few seconds this sends me into a panic as I could have sworn I had thrown the police off the scent. Damn that court-appointed lawyer!

[4]

Oh, hang on, I mis-read that. It's telling me I am nearing the end of the app's free trial period and now is the time to commit to a subscription payment or lose the "pro" features I have been "enjoying."

I tap on the button labelled PRO to be reminded what those features might be and evaluate the pleasure I may obtain. There are two columns of ticks, with loads more ticks in the PRO column than the FREE column. Mmm ticks. I don't understand what the features refer to but the sheer number of ticks must mean my enjoyment of the PRO version borders on the obscene. Rock and roll! I'm ready to pay!

Tapping on PAY NOW exits the app, launches the app developer's webstore in my default browser and asks me to sign into my account. Naturally, I don't remember either the username or password I plucked from the ether on the day I installed the trial. I kind of wish the app – into which I had already been signed a few moments ago – would have done this for me but I guess it's all for the security best. So I launch my trusty open-source password database app to hunt for it.

[5]

"Buy me a beer?"

Although the password app is free, the German volunteer developer who wrote and maintains it always asks his users for modest donations at this time of year to coincide with Oktoberfest. Hence the "beer" request pop-up as soon as I launch the app. I can choose to send him the monetary equivalent of a large beer, or a half-litre, or just coke-and-fries.

Oh, go on, I'm feeling generous, so a large beer it is. I tap PAY NOW.

I am back in my default browser, a new tab prompting me to choose my method of payment. PayPal or credit card? Well, I am curled up on the sofa in my jim jams and can't be arsed to set off on a credit card hunt, nor do I remember the new PayPal credentials I set up recently for work-related software purchases. No worries, all this information is hashed away in my password app, so I switch back to it.

"Buy me a beer?"

My finger hovers over the NO button just so I can get past the message but I decide to do the right thing and act like an adult. Muttering "pissbuckets," I slide off the sofa and stomp noisily upstairs to my office, snatch my wallet petulantly from drawer and trudge back down while huffing as demonstratively as I can.

[6]Nothing works any more. Who decided that redundant systems should become redundant?

[7]So I’ve scripted a life-saving routine. Pah. What really matters is the icon I give it

[8]You walk in with a plan. You leave with GPS-tracking Nordic hiking poles. The same old story, eh?

[9]A speech recognition app goes into a bar. Speak up if you’ve heard it already

I transcribe the credit card details into the payment page and tap CONFIRM. The screen changes to something apparently designed by a MySpace fan: clunky fonts, non-adaptive layout, impossibly tiny text (some of it underlined, some of it – gulp – flashing ), 3D-chisel-bevel buttons… in other words, an authentic banking confirmation page. I pinch and zoom four times so I can read what it says: it's telling me I have to enter a six-figure code that has been sent to my handset by SMS.

Naturally, this does not arrive. I tap on RESEND SMS. It still fails to arrive. I proceed to tap on this button repeatedly while yawning and only give up when it begins asking me to choose matching photos from a Captcha puzzle. Stick your fucking blurry traffic lights and motorbikes up your arse, I'm not playing.

Still no SMS has been received. No surprise, really: SMS as a means of 2FA never works at night-time. I'm not sure why this is, but it has always been thus. Oh well, I'll take a pot-shot at guessing my PayPal password. This will be no mean feat as I chose a password 24 characters long containing a mix of uppercase, lowercase, digits, special characters, emojis (one food, one vehicle, one building) and an animated GIF taken from an episode of Seinfeld that I have never seen because I have never watched any episodes of Seinfeld because it is not funny.

Right first time, back of the net!

PayPal is now asking me to enter a six-figure code generated by the Authenticator app on my handset. Ah yes, I remember switching to this method of 2FA for as many sign-ins as possible after being let down by SMS too often. Returning to my home screen, I also now remember that I have installed more than one app called Authenticator: in fact, I have a whole folder of them.

This is due to the big software publishers developing their own, keeping it all in-house. Microsoft has one, so does Adobe, and so do a whole bunch of others. They are all called Authenticator and none of them have icons to indicate which software company they're hardwired to. So I launch them all to find out.

By the time I get to the grey G icon, I realise I should have tried this one first. Scroll through and… here we go, my new PayPal account, and the number is… oh, it's changed. Right, now the number is… press and hold to copy the number… switch to my PayPal sign-in page… weird, my phone isn't responding… dammit, a dozen new notifications just loaded in at the top… swipe the bastards away!… At least my phone is responding again… I'm on the PayPal page… I press and hold to paste the number into the field… but it is too late and the code has already changed.

Buggeration, I will have to do it all again. But more notifications pile into the bar at the top, interrupting the flow just long enough again to render the code out of time for a second occasion.

I make a third attempt. Just for a moment it fools me into thinking it has worked, then the PayPal sign-in screen refreshes with a Captcha puzzle and asks me to click on the photo squares that depict a mugging.

Arse knobs. Shitey bollocks.

Enough of this. If you don't want my money, I won't insist. I'm off to bed for my early night and slurp down the last of my mug of cocoa. The drink is unpleasantly – and unexpectedly – cold which only darkens my mood. I swipe downwards, angrily, determined to uncover which buttock-brained app was interrupting me with notifications at this time of night… what, 11pm already??

It's a list of overdue tasks. ®

[10]Youtube Video

Alistair Dabbs is a freelance technology tart, juggling tech journalism, training and digital publishing. He would have sent this column in on time if only he could find a to-do app that makes overdue tasks stand out from all the other overdue tasks. He has now set a new task in his task app to search for a new task app. More at [11]Autosave is for Wimps and [12]@alidabbs .

Get our [13]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YVbcdVvE8cisdPWASnRjOwAAAJc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVbcdVvE8cisdPWASnRjOwAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YVbcdVvE8cisdPWASnRjOwAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVbcdVvE8cisdPWASnRjOwAAAJc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YVbcdVvE8cisdPWASnRjOwAAAJc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2021/09/24/something_for_the_weekend/

[7] https://www.theregister.com/2021/09/17/something_for_the_weekend_/

[8] https://www.theregister.com/2021/09/10/something_for_the_weekend/

[9] https://www.theregister.com/2021/09/03/something_for_the_weekend/

[10] https://youtu.be/k37WOBvc6vU

[11] https://autosaveisforwimps.substack.com

[12] https://twitter.com/alidabbs

[13] https://whitepapers.theregister.com/



I will raise my hand and admit…

brotherelf

I looked what particular shade of red #E10600 is. Because Friday. Unexpectedly, the color picker I installed didn't have 400MB of extra dependencies.

Re: I will raise my hand and admit…

Dan 55

[1]That's not a friendly colour , it doesn't make me want to donate anything apart from blood.

[1] https://duckduckgo.com/?q=%23E10600

To be fair

chivo243

There are one or two Seinfeld's that are funny as hell.... Master of your own domain anybody? Lie detector? It's not a lie Jerry if 'you' believe it...

I'm glad it's not just me

Dabooka

I've never understood the fascination with Seinfeld either. Didn't make it to the ad break, never been back.

Re: I'm glad it's not just me

Tom 38

This is verging in to internet-taste-flame style territory, but I quite like Seinfeld. The characters are delicious - they are mostly amoral and never grow as people, and the situations their lack of morality gets them into is usually some excellent farce. Most of the humour is based around their morality, which makes it very human and timeless.

The other great thing about Seinfeld that has made it more durable is that there is very little in terms of long term story - as I said, these characters don't grow or evolve - so each episode is fairly standalone. Therefore, you can watch any episode in any order, George is still George, Jerry is dating someone new each episode, Kramer is nuts. You don't have to track if they were "on a break".

Re: I'm glad it's not just me

Chris G

I always thought it was only the other actors that made it watchable, Seinfeld is not funny and lacks character, in or out of the show.

French Bank 2FA

Dr_N

Do you not have the card reading code generator that you have to insert your carte into and tap your PIN. So as to get an authentication code for each transaction, Mr Dabbs?

The one you don't travel with. And then work out you can use someone else's. From a completely different UK bank.

Re: French Bank 2FA

the spectacularly refined chap

That's not an issue, indeed my bank actually say that, presumably to head off endless requests for additional or replacement units. The crypto stuff actually works on the card's chip, the reader is just a user interface to the functionality on the card.

"Alternative authenticator app". This is the way.

Dan 55

Configure your MS account to use an "alternative authenticator app" then remove the MS authenticator.

Same for Adobe.

Same for everyone.

What's this mysterious "alternative authenticator app"? One which does with six-digit TOTP codes and has backup, e.g. FreeOTP+ on Android. I just checked and it's not available in Tim Apple's walled garden though.

A brilliant demonstration of how phones can become useless annoyances

Pascal Monett

Damn smartphones and the apps that go with them.

Damn the companies that pre-install useless shit I don't need and don't want but can't get rid of.

I hate smartphones.

Re: A brilliant demonstration of how phones can become useless annoyances

Anonymous Coward

"Damn smartphones and the apps that go with them."

The worst is security 2FA apps that require a postal mail to be scanned by your app. Because any time you loose/break your phone, you'll need to request this mail.

And if, like Dabbsie, you're unlucky enough to live in France, you already know you only receive 90% of postal mail addressed to you, so this one can be lost, while you need to work on your bank account fast ...

Re: A brilliant demonstration of how phones can become useless annoyances

Chris G

I don't hate smartphones but I do hate more than half of the crap they come preinstalled with.

Crap that is cunningly crafted so that if you disable it, important parts of the OS will no longer function.

In other news, the video was a piece of post punk, punkjunk, contrived and made to market to an audience, none of the genuine spontaneity of the original. I feel a little qualified to criticise having worked on the door at a couple of Sex Pistols gigs in the 70s.

I had been told by colleagues

Mage

After a 1/2 a lifetime in Computer Journalism, and training surely you know:

1) Random advice from colleagues is dangerous

2) Unless you have a team of more than 15 or a project the size of building & outfitting a hospital you know you don't need any Task List program (or Project manager sw, which I had to keep explaining to people that it's sw for a project manager of giant projects, it doesn't manage).

SMS and 2FA

Mage

1) Nothing wrong with good passwords, different for every site. Money related ones in the paper address book kept safely (never with phone/tablet/laptop), others in the browser with a master password. So only need to remember two, but written in the book in case you die suddenly; note some kinds of deaths destroy your phone too.

2) SMS is not secure. Someone can either intercept it or even setup your number.

3) SMS has no guaranteed delivery or latency.

4) What happens to the 2FA when your phone is lost, broken (stupid model with virtual SIM) or stolen? A backup phone can't easily get the same number unless you are the expert criminal in item 2. A backup phone/tablet/computer can use the same email address as a broken one

5) properly done email can be safer than SMS or an App.

Authentic banking confirmation page

Boothy

Quote: "The screen changes to something apparently designed by a MySpace fan: clunky fonts, non-adaptive layout, impossibly tiny text (some of it underlined, some of it – gulp – flashing), 3D-chisel-bevel buttons… in other words, an authentic banking confirmation page. I pinch and zoom four times so I can read what it says: it's telling me I have to enter a six-figure code that has been sent to my handset by SMS."

Had the above thanks to Verified by Visa just yesterday.

Picked up the car from the garage after a successful MOT, but their card reader system wasn't working and they asked if I could pay-online instead? I said yes.

Typical options, Visa, Paypal etc and I selected Visa. After entering card details, this inevitably triggered the Verified by Visa screen.

So on a typical phone screen, ~6" diagonal, so about 7cm wide, the Verified by Visa screen itself was at most, about 2cm wide, surrounded by white space. Zoom in, some text, and a Next button. Click Next, hmm, it's tiny again, so zoom in, it now want's to send an SMS, click yes, it's tiny again, zoom in, we now have a box to paste the 6 digit code into and so on.

Seems Verified by Visa simply ignores the fact you're on a mobile device, and scales to a desktop screen instead, so zoom, click, zoom, click, zoom click, aaarrrhhh!

Icon --> As that's what should happen to the devs who created the abomination that is Verified by Visa UI.

Nusbaum's Rule:
The more pretentious the corporate name, the smaller the
organization. (For instance, the Murphy Center for the
Codification of Human and Organizational Law, contrasted
to IBM, GM, and AT&T.)