Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

121–130 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#121

Post by distances »

tialaramex wrote: post #89
distances wrote: post #65

Earlier quoted context omitted.

2FA has always been a requirement in my country, as far as I remember all the way from the start. The new EU legislation made things worse : one-time pad paper key list isn't accepted any more. My second factor now needs to be my phone (app or SMS).

The written list of one-time passwords (not a "pad" the One Time Pad is a specific crypto design that largely exists to compare things to rather than as a practical gizmo) fails the requirement in 2018/389 because it doesn't end up verifying the specific transaction. Suppose you have password '47BF-38AP-3M99' on the list. You get a plausible email from your friend Barry saying he needs €40 urgently. You send €40 usin…

Thanks for the in-depth explanation. My reaction has maybe been a bit knee-jerk, it's not like this is a major annoyance. The attack scenario is quite convoluted with needing both access to the account and a phishing attack for the one-time key, but I suppose it is plausible. At the same time this does open users to new attack vectors though, especially with SMS.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#122

Post by celticninja »

floatboth wrote: post #77
ninjaoxygen wrote: post #59

Earlier quoted context omitted.

I feel like a time delay would help with this too. If it takes an extra 24 hours and you get notifications by SMS and email during that period with the chance to call "fraud" it stops most of these attacks which take control of e-mail and phone simultaneously. I get that makes life much more difficult when you are travelling and have your phone (and therefore SIM) stolen, but given the severity of the current issues…

Porting takes over a week in Russia. You get a new SIM instantly, but it has a temporary number. Then you get notifications via SMS on your old SIM, you usually get a call from your old carrier trying to get you to stay, offering discounts and shit. Then after 7-14 days the new SIM gets the old number and the old SIM stops working. The U.S. system sounds horrifically irresponsible. // Replacement with the same carrie…

In the UK it is usually 24-48 hours but both numbers gets texts about the impending switch to a new SIM.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#123

Post by celticninja »

Cthulhu_ wrote: post #55
spuz wrote: post #41

Earlier quoted context omitted.

How does this work? You have to send in your old sim before you can receive a new one? What if you lose your old sim?

> What if you lose your old sim? I'd say it's pretty simple then: you can't transfer your number and just need to get a new one. I mean at some point you have to draw a line; losing your password and resetting it via email is already a pretty gracious thing, and most support desks will help you beyond the default password reset as well if necessary. But at some point you have to draw a line - key's lost? Access is lo…

That's ridiculous to suggest as a solution and that's why it won't be adopted. Better to work on an alternative solution that has a better chance of adoption.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#124

Post by celticninja »

matwood wrote: post #112
scep12 wrote: post #42

Earlier quoted context omitted.

OP's intent was clear, at least to me: never transfer my number on the phone. Require it to be in person with some stronger form of identification.

The problem is, I think a lot of these hacks have an internal connection. How much access do these 3rd party carrier stores have to transfer numbers?

It could be done remotely but only if the store had signed off that ID had been viewed and the port confirmed in person. Of course this could be gamed but an employee would need to put their name on the line to say they had met the person and viewed the ID

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#125

Post by [deleted] »

michaelt wrote: post #117
Slimbo wrote: post #99

Earlier quoted context omitted.

What's the universally accepted alternative?

There is no universally accepted second factor. * SMS (and automated voice call) are bad for people who live in areas with poor phone coverage, people with international phone numbers, and people who want good security. * TOTP is bad for people who don't have smartphones. * FIDO U2F is bad for people who don't have $20, safari/iOS users, and people whose devices don't have USB. * Vendor-specific apps are bad for peop…

[deleted]

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#126

Post by jwr »

Slimbo wrote: post #99
jwr wrote: post #64

Earlier quoted context omitted.

Unfortunately, the current corporate thinking in Poland is that 2-factor authentication means SMS. I see banks and other companies introduce this in spite of known vulnerabilities. SMS is NOT a secure second factor!

What's the universally accepted alternative?

TOTP (using Authy, Google Authenticator, or other apps) with a printed set of emergency recovery keys.

And please, people, stop saying that this is not good for people who do not have smartphones. To a first approximation, everybody has a smartphone.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#127

Post by theandrewbailey »

cdumler wrote: post #119

Please do not allow people to call SMS 2FA. For it to be 2FA, it must be: something I know alone, something I possess alone, something I am alone. Otherwise, it's just another account identifier (and likely spoof-able). SMS and phone numbers are none of these. In same vein, I wish security questions would die in a fire. Always treat them like additional passwords: use nonsensical words and store them in your password…

Don't forget to change your birthday, mother's maiden name, fingerprint, and face regularly.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#128

Post by [deleted] »

eswat wrote: post #108
nailer wrote: post #61

Earlier quoted context omitted.

How could one save a TOTP code in a password manager and use it later? It would be useless in 30 seconds time. Am I misunderstanding something? Or did you mean OTP rather than TOTP?

The main benefit behind TOTP is that you can tie its value creation to a second factor, such as something you own like a device (instead of something you know like a password). It’s arguable that you’re removing that second factor when you store the parameters needed to create the TOTP in the same place as you store your passwords.

[deleted]

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#129

Post by [deleted] »

DCKing wrote: post #100
stirlo wrote: post #7

While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed. The government agencies that setup the mobile number portability system need to realise the seriousness of this flaw and allow a “Never transfer my Number” flag to be set in their databases. Until then even the lowest rung service desk agent at any telco has the ability to transfer numbers. A system l…

The problem is when a phone number is the only factor that is used. That is what Twitter allows. If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better th…

[deleted]

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#130

Post by nailer »

Klathmon wrote: post #66
nailer wrote: post #61

Earlier quoted context omitted.

How could one save a TOTP code in a password manager and use it later? It would be useless in 30 seconds time. Am I misunderstanding something? Or did you mean OTP rather than TOTP?

The setup string which generates the time codes is basically a second password. If something can read that setup string, they can generate their own TOTP codes for your account whenever they want.

Oh you're discussing storing the seed, not the TOTPs themselves.
Post reply on HN