181–190 of 251 posts
I wonder how nobody sees the elephant in the room. 2FA by SMS is terribly insecure. Numerous security researchers recommended never using it. Using phone numbers as primary authentication mechanism is insecure and never should be used. Phone numbers can be spoofed, SMS messages can be intercepted, SIM port attacks can and will happen. If your email or banking accounts depend on 2FA by SMS, especially when SMS can be…
Earlier quoted context omitted.
>Many password managers (at least KeePassXC/KeePass with plugin) can store and create TOTPs. Personally I don't really like this feature and urge people to avoid it for "high security accounts". It's not a "second factor" if it's stored and input using the same device and authentication information as your "first factor" (your username and password). That's not to say it's useless, at the very least it's another laye…
What's a good secondary service to store the TOTP codes separate from passcodes? Authy, from what I understand, requires a phone number as backup, meaning it could be compromised by the same method Google authenticator can't be backedup, which is royally annoying when you change/lose devices Lastpass has some security issues, and one well known comment here has recommended no one use it. I heard someone say they use…
Earlier quoted context omitted.
It's a reminder that crypto is fundamentally dangerous due to its lack of regulation and compliance requirements, its fundamental irreversibility and lack of authority/censorship. It's a lesson we should all take to heart about what makes for a functional financial system and what doesn't. It's also a lesson about the security of phones. IMO its great to learn about what goes well but super valuable to learn when peo…
Traditional financial regulation and compliance is a joke and mostly security theatre from the perspective of a security engineer or cryptographers. - credit cards with secrets printed and shared in plain sight - hacked banks - hacked atms It only works because most involved are somewhat trustworthy and the damages are small enough that it’s still worth to have the system. But the latter also seems to be true for cry…
So while the infrastructure may be fundamentally insecure, quite frankly that's not my problem. If it was a crypto wallet I would have had zero legal recourse and of course never would have seen that money again - as we're seeing again and again.
I do hold some ETH but I don't see it replacing my bank anytime soon.
I'd like to see more companies introduce "time locks" into various big aspects of accounts. Want to port a SIM? I'll put your request in now but it will wait for 5 business days before it happens, and at any point if you or someone claiming to be you calls up to stop it, we stop it, no questions asked. Want to change 2 factor information for an account? We can put in the request now and it won't take effect for a wee…
> Want to port a SIM? I'll put your request in now but it will wait for 5 business days before it happens, and at any point if you or someone claiming to be you calls up to stop it, we stop it, no questions asked. Funny because that's exactly what happens in France when you do so. I must have sounded a bit dumb when I asked when my number would be active when I changed from Tello to Verizon. I couldn't believe it was…
The goal was to help beginners in security and technology as a whole understand why SMS based two-factor is insecure and should be avoided.
It's just a couple of paragraphs in a larger post on securing your SSH sessions but hopefully it's of interest.
The most notable example is when a certain person's SIM card was reissued 4 times within 2 days in different cities by criminals while the owner was trying to restore access to her phone.
To prevent it, some Russian banks have agreements with carriers that allow them to check SIM card's identifier and detect whether it was reissued. If such situation is detected, the bank doesn't allow to use new SIM card to confirm operations.
Some carriers block new SIM cards from receiving SMS for 24 hours and send a SMS with notification to an old SMS card so that the owner can restore access. Also, one can restrict a list of locations where your SIM card can be reissued.
It's an extremely odd decision by the author to publish this piece. Port attacks on cryptocurrency accounts is nothing new, and outside of publishing the number ($100k!) there is nothing special about this account of events vs the countless other near identical articles that have been published on Medium on the same old attack. The reason I say it's odd is that he's an engineering manager at BitGo, which is a leading…
It's a reminder that crypto is fundamentally dangerous due to its lack of regulation and compliance requirements, its fundamental irreversibility and lack of authority/censorship. It's a lesson we should all take to heart about what makes for a functional financial system and what doesn't. It's also a lesson about the security of phones. IMO its great to learn about what goes well but super valuable to learn when peo…
Earlier quoted context omitted.
Google offers 2FA using TOTP, and has for several years.
And U2F tokens, which are even better than TOTP as they are immune to phishing. TOTP codes can be and commonly are phished. U2F is the current state of the art for 2FA. App/Device-based 2fa (krypton, Google App’s “approve on other device”, authy’s “approve on other device”, keybase, et c) are second. TOTP is in a lot of ways more trouble than it is worth.
I still don't get one thing: how could the attacker port OP's number without proving he owns the sim? Where I live (in EU) it's mandatory, isn't it the same in the US?
Earlier quoted context omitted.
It's a reminder that crypto is fundamentally dangerous due to its lack of regulation and compliance requirements, its fundamental irreversibility and lack of authority/censorship. It's a lesson we should all take to heart about what makes for a functional financial system and what doesn't. It's also a lesson about the security of phones. IMO its great to learn about what goes well but super valuable to learn when peo…
If a bank uses SMS to confirm operations and doesn't check that card was recently reissued then this attack would work against traditional bank too.