Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

31–40 of 379 posts

Re: SMS is not 2FA-secure

#31

Post by 0xff00ffee »

rckoepke wrote: post #13

My understanding is that you don't even need to do a SIM swap, because the SS7 signaling system is insecure. SIM Swap is likely the easiest way as wage-slave employees are quite pliable to bribes[0]. But if you want to be even more anonymous, you can apparently re-route texts remotely [1]. 0: https://www.nbcbayarea.com/news/local/mans-1m-life-savings-s... 1: https://www.kaspersky.com/blog/ss7-hacked/25529/ I thought…

> I thought both these vectors were already common knowledge to HN readers.

One person can't know everything... that's why I come here. Thanks for the info!

Re: SMS is not 2FA-secure

#32

Post by thephyber »

RcouF1uZ4gsC wrote: post #11

The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did not back up their TOTP. With SMS authentication, even if the user loses a phone, they can go down to the local cell phone store and get a new phone on their number and be back in business without the website having to get involved.

Double-edged sword.

Your website is outsourcing security to any company which can service a cell phone account, which may be better than your website security or worse.

Re: SMS is not 2FA-secure

#33

Post by jeltz »

KingMachiavelli wrote: post #19
theonething wrote: post #5

The answer is no, but is it more secure than no 2FA? Of course there are much better 2FA options, but for the general public, they are probably too complicated to use. Everyone understands SMS.

Well if that's the case they could still offer true MFA. Make at least SMS 2FA mandatory but offer OTP/token based MFA. Obviously banks are a place with a lot of low-value targets and a few very high-value targets, but the cost to implement MFA is the same so they might as well do it.

Yeah, the by far biggest cost of 2FA is the recovery process which you need anyway, not actual 2FA implementation.

Re: SMS is not 2FA-secure

#34

Post by reaperducer »

HN seems to be getting a lot of these submissions lately where the question asked in the title is the same as the domain name. Sometimes the content of the page doesn't even answer the question.

Feels like some kind of spammy PageRank manipulation going on. I'm happy to be wrong about this, but I wanted to see if anyone else has noticed. Maybe I'm just smoking crack waffles again.

Re: SMS is not 2FA-secure

#35

Post by 0xff00ffee »

RcouF1uZ4gsC wrote: post #11

The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did not back up their TOTP. With SMS authentication, even if the user loses a phone, they can go down to the local cell phone store and get a new phone on their number and be back in business without the website having to get involved.

> What happens if the user loses a yubikey.

Always buy two. ;-)

Joking aside, I've moved almost every 2FA to hard token, soft-token, or google voice. But the root of trust is still LastPass & Google. I don't see an easy way out of dependency other than power of attorney. Even worse: I worry what happens to my protected assets as I age and possibly face memory loss.

Re: SMS is not 2FA-secure

#36

Post by jetzzz »

Andrew_nenakhov wrote: post #6

Not in Russia. Numerous examples exist when victim's number was linked to attacker's sim card to obtain 2FA code, then linked back to victim's sim so he does not notice anything. This happened both by government-linked parties, where they are able to coerce providers to do it, mostly targeting prominent political opposition members. It also happened without government involvement, done by provider's personnel with su…

Just google for "форум пробив" and you will find black market for accessing any kind of information, including SMS, phone location, etc and associated services for hacking accounts (VK, Gmail, etc). You don't need to be a government, it is open for everyone.

Re: SMS is not 2FA-secure

#37

Post by Kalium »

theonething wrote: post #5

The answer is no, but is it more secure than no 2FA? Of course there are much better 2FA options, but for the general public, they are probably too complicated to use. Everyone understands SMS.

Have you seen the prompt system, as used by Google, Micosoft, Okta, et al.?

In my strictly personal opinion, responding to a notification that asks if a login attempt is you is clear enough that people need minimal training to make use of it. This might just be me, though.

In my career, I've definitely seen people actively choose SMS over other factors on offer. It was easier for them, and in many cases shouldn't have been offered. Your point about SMS being better than nothing is wise and true and insightful, but it's perhaps not always the question as faced in practice.

Re: SMS is not 2FA-secure

#38

Post by woodruffw »

goldcd wrote: post #9

Compared to what? Better than not having it? Yes. Better than committing a 4,096Kb PK to memory and confirming all interactions with mental arithmetic? No.

Compared, presumably, to the other two popular 2FA methods: TOTP and WebAuthn (f/k/a U2F).

Re: SMS is not 2FA-secure

#39

Post by ebg13 »

People always focus on SIM swaps and signal security, but neither of those apply to Google voice numbers. So in the context of Google voice, is there still any reason to not use SMS 2FA?

Re: SMS is not 2FA-secure

#40

Post by dmoy »

0xff00ffee wrote: post #35
RcouF1uZ4gsC wrote: post #11

The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did not back up their TOTP. With SMS authentication, even if the user loses a phone, they can go down to the local cell phone store and get a new phone on their number and be back in business without the website having to get involved.

> What happens if the user loses a yubikey. Always buy two. ;-) Joking aside, I've moved almost every 2FA to hard token, soft-token, or google voice. But the root of trust is still LastPass & Google. I don't see an easy way out of dependency other than power of attorney. Even worse: I worry what happens to my protected assets as I age and possibly face memory loss.

Backup access in a bank safety deposit box is what I do.
Post reply on HN