Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

111–120 of 379 posts

Re: SMS is not 2FA-secure

#111

Post by vaadu »

SlowRobotAhead wrote: post #75
rckoepke wrote: post #13

My understanding is that you don't even need to do a SIM swap, because the SS7 signaling system is insecure. SIM Swap is likely the easiest way as wage-slave employees are quite pliable to bribes[0]. But if you want to be even more anonymous, you can apparently re-route texts remotely [1]. 0: https://www.nbcbayarea.com/news/local/mans-1m-life-savings-s... 1: https://www.kaspersky.com/blog/ss7-hacked/25529/ I thought…

>SS7 signaling system is insecure If people knew how telcom (and the internet) was held together with bubblegun and duct tape... Multiple proposed fixes and replacements to SS7, to the best of my knowledge none of them are going anywhere. And even if it was pushed hard, it has to be a global thing.

Governments and the security industrial complex do not want it fixed. Vulnerabilities in SS7 are features to exploit, not bugs.

Re: SMS is not 2FA-secure

#112

Post by 1996 »

StavrosK wrote: post #102
rconti wrote: post #27

Earlier quoted context omitted.

at least one of my banks cannot SMS me codes, I can't remmeber which, so I always forget, try it, and have to select another method. I THINK it's chase, but I'm not sure. They have my correct phone number, but for years now, the code just... never shows up.

Are you using Google Voice? I have the same problem with Chase on my GV number. Calling works fine, and so does email, but no SMS.

Port a number to GV, it will work, but you are at risk of losing it if you don't log in often enough. I lost an important number that way (along with my grand fathered free google apps account for my domain)

Re: SMS is not 2FA-secure

#113

Post by mumblemumble »

xenospn wrote: post #80
tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

I wish Apple added iMessage as a service to make 2FA more secure.

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent.

Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

Re: SMS is not 2FA-secure

#114

Post by 1996 »

Zenst wrote: post #55

Worth having a private number on a low or PAYG plan and use that for your security separate from your main mobile number. After all, most have a spare phone and great use for those Nokia's.

This is my conclusion too. A payg that you recharge with cash, so it is unliked to your name in the telecom operator databases is the best protection against rogue employees.

Re: SMS is not 2FA-secure

#115

Post by sairamkunala »

hocuspocus wrote: post #73

In Switzerland, we have Mobile ID: https://www.mobileid.ch/en It uses the SIM to implement a challenge-response mechanism where a PIN is prompted by your phone. While not perfect, it's vastly better than using SMS, without being less convenient. I don't know if other places leverage the fact that SIMs are smart cards which are perfectly able to perform this kind of stuff given the proper infrastructure.

In India,

if you get a SIM replaced after providing proofs of identity, residence and biometrics, it would get activated after few hours.

The kicker is that it wont get SMSes for 24 hours after the SIM is activated.

In the US, won't it be cheaper as well as secure to get a virtual phone number from Twilio for purposes of two factor authentication? (In India, there is no service at the rate what Twilio offers, but there are some which charge around $30-$40/month for virtual phone numbers with incoming SMSes)

Re: SMS is not 2FA-secure

#116

Post by theonething »

tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

> account recovery, as a sole factor, meaning you're substantially worse off with SMS authentication than you are without it at those services

But if in those cases you disable SMS auth, then you can't recover your account right? That might be considered worse off in some cases.

Re: SMS is not 2FA-secure

#117

Post by spydum »

mumblemumble wrote: post #113
xenospn wrote: post #80

Earlier quoted context omitted.

I wish Apple added iMessage as a service to make 2FA more secure.

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.

Re: SMS is not 2FA-secure

#118

Post by ossguy »

alkonaut wrote: post #48

I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Because with 99.99% certainty the person that needs to unlock the account is me, and not an attacker. Even with a dozen backup yubikeys and spare codes written down I’d still be much more likely to lock myself out than be attacked. If it’s one thing I have learned the hard way it’s that the most dangerous per…

That's how https://jmp.chat/ works, and you can make your phone number as arbitrarily secure as you want with JMP.

Any port-out requests are handled manually - you are contacted by a human to ensure that you made the request. You can ask them to put a verification code on file for you to confirm when this happens if you're concerned about the security of your XMPP account (which itself could use whatever kind of authentication scheme you like).

Re: SMS is not 2FA-secure

#119

Post by laurentdc »

Andrew_nenakhov wrote: post #6

Not in Russia. Numerous examples exist when victim's number was linked to attacker's sim card to obtain 2FA code, then linked back to victim's sim so he does not notice anything. This happened both by government-linked parties, where they are able to coerce providers to do it, mostly targeting prominent political opposition members. It also happened without government involvement, done by provider's personnel with su…

> if you do, use a foreign SIP number with SMS capabilities

Any good providers? I've tried Twilio SMS forwarding, but different services (e.g. Steam) reject it for 2FA since they're pretty much considered throwaway numbers, I suppose there's some sort of blacklist

Re: SMS is not 2FA-secure

#120

Post by taviso »

goldcd wrote: post #71
taviso wrote: post #50

Earlier quoted context omitted.

The article says "We found 17 websites on which user accounts can be compromised based on a SIM swap alone", that seems like a pretty clear indication that it can be worse than nothing. I happen to think the benefits of SMS 2FA, even when working as intended, are negligible. It seems like a bad idea to waste the finite amount of developer good will we have asking services to implement it. Literally the only attack th…

If you can compromise the account, based on a SIM swap alone, then that site has 1FA (The phone number). 2FA requires you to have 2 factors at the same time. e.g. When I log onto amazon from a new browser with valid username+password it additionally requires me to confirm via my phone number. 1or1FA (e.g. reset your password via SMS if you forget your password) is just increasing the attack area on 1FA (would be more…

Let's say that it wasn't you who logged in with a valid username and password, it was an attacker.

Under what circumstances does the phone number prompt prevent the attacker from accessing your account?

Perhaps they used phishing? Then they can just phish the SMS code as well.

Perhaps they're a MITM over an insecure channel? Then they can just wait for you to enter the SMS code.

Perhaps you installed their malware? Then they can just inject some code into the browser.

Post reply on HN