Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

171–180 of 379 posts

Re: SMS is not 2FA-secure

#171

Post by jdeibele »

Terretta wrote: post #158
kccqzy wrote: post #131

Earlier quoted context omitted.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

Don’t put them in google authenticator. https://support.1password.com/one-time-passwords/

That sounds good but put them in Authy. That lets you have multiple devices whereas Google limits you to one device.

It's great that people use can use one app for both factors but it seems less secure than two apps.

For example, use Authy for TOTP and LastPass for long passwords. That's two things that have to be compromised. And both of them allow you to have multiple devices (for example iPhone and iPad).

Re: SMS is not 2FA-secure

#172

Post by Pfhreak »

ben509 wrote: post #152
Pfhreak wrote: post #143

What's with all the redacted entries? Without some context, I assume that these are companies that threatened some sort of legal action if their name was published?

Later in the paper they mention that they're temporarily redacted due to responsible disclosure rules.

They say there are 361 sites pulled from TwoFactorAuth.org's list of sites, and they were able to access 145 of them.

In describing the set they initially drew from, it seems like they've described the 17 redacted sites simply by describing their complementary set (the 128 sites that are secure).

Re: SMS is not 2FA-secure

#173

Post by tempestn »

lutorm wrote: post #160
kccqzy wrote: post #131

Earlier quoted context omitted.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

Isn't that solvable by not requiring 2fa for "registered" devices?

Exactly. You should only have to enter the second factor on a given device once, at least optionally.

Re: SMS is not 2FA-secure

#174

Post by dredmorbius »

potatoz2 wrote: post #76
fiddlerwoaroof wrote: post #70

Earlier quoted context omitted.

The issue with using permanent characteristics for auth is that you lose the ability to revoke one credential in favor of another.

That's not a problem if you have to physically show up though, since no one can spoof that.

Your DNA can show up all over the place.

Re: SMS is not 2FA-secure

#175

Post by oauea »

xenospn wrote: post #130
peruvian wrote: post #99

Earlier quoted context omitted.

I could see Apple offering 2FA as a core feature, at least on iOS. In fact, Apple should redesign Keychain into a user friendly, 1Password-lite product with 2FA built-in (1Password offers this too) or as a separate app that works with Keychain.

Apple has had mandatory device-based 2FA for a while now, but it only works for iCloud logins.

Yes, super annoying. Now I can no longer get into my Apple Developer account without walking to my development mac I use to run xcode builds (for a react native app), since for some bizarre reason the only 2FA they support is their own which requires Apple hardware.

It's bad enough their development toolchain requires you to buy their hardware, now to log into their websites you also have to buy their expensive hardware.

Re: SMS is not 2FA-secure

#176

Post by kccqzy »

Terretta wrote: post #158
kccqzy wrote: post #131

Earlier quoted context omitted.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

Don’t put them in google authenticator. https://support.1password.com/one-time-passwords/

Yes that's what I've been doing after being burned by Google Authenticator once. Not to mention I actually prefer the UI design of 1Password.

Re: SMS is not 2FA-secure

#177

Post by ridaj »

Maxious wrote: post #147
jv22222 wrote: post #127

Earlier quoted context omitted.

My brain isn't working right now... Can you tell me why something like google authenticator could not be executed as a website? Does it have to be an app? Just wondering if there could be an easier non installed version that was always available. Apologies if it's a really silly question!

You can run TOTP in javascript sure http://blog.tinisles.com/2011/10/google-authenticator-one-ti... But how do you protect access to the website - with a username and password? Or do people now need to remember another code like "JBSWY3DPEHPK3PXP" to set up the authenticator everytime they visit? Mobile apps were one way to solve this although the hardware U2F tokens like Yubikey provide another authentication factor…

That's right, in fact if people remember that secret then it's not a "second factor" it's just another part of their password. A "factor" in the context of authentication means one of the various ways that can be used to verify someone's identity: "something you know" (password), "something you have" (non-duplicatable object, eg a SIM card or OTP token containing a secret that cannot be easily guessed or extracted), or "something you are" (biometrics).

Re: SMS is not 2FA-secure

#178

Post by xenospn »

3fe9a03ccd14ca5 wrote: post #168
xenospn wrote: post #80

Earlier quoted context omitted.

I wish Apple added iMessage as a service to make 2FA more secure.

Why the downvoting? iMessage is a hundred times more secure than SMS. It’s got E2E encryption and a published security paper. https://techcrunch.com/2014/02/27/apple-explains-exactly-how...

Unclear.

Re: SMS is not 2FA-secure

#179

Post by jorvi »

Terretta wrote: post #158
kccqzy wrote: post #131

Earlier quoted context omitted.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

Don’t put them in google authenticator. https://support.1password.com/one-time-passwords/

Its great functionality but it reduces your security. Say someone somehow figures out your 1Password password and security key - if you store your OTPs in Authy, your passwords are useless (well, less useful anyway). If you store your OTPs in 1Password, they have the keys to the kingdom.

Re: SMS is not 2FA-secure

#180

Post by cortesoft »

tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

So how SHOULD this problem be solved? How should account recovery work?
Post reply on HN