SMS is not 2FA-secure • Hacker News Board

Re: SMS is not 2FA-secure

#211

Post by oezi » Sat, Jan 11, 2020, 6:49 AM UTC

oauea wrote: post #175

xenospn wrote: post #130

Earlier quoted context omitted.

Apple has had mandatory device-based 2FA for a while now, but it only works for iCloud logins.

Yes, super annoying. Now I can no longer get into my Apple Developer account without walking to my development mac I use to run xcode builds (for a react native app), since for some bizarre reason the only 2FA they support is their own which requires Apple hardware. It's bad enough their development toolchain requires you to buy their hardware, now to log into their websites you also have to buy their expensive hardw…

Apple continues to support SMS as 2FA. It is a bit hidden when signing in.

Re: SMS is not 2FA-secure

#212

Post by vanviegen » Sat, Jan 11, 2020, 6:59 AM UTC

madeofpalk wrote: post #142

ahaseeb wrote: post #128

Earlier quoted context omitted.

OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient

I wonder how that looks like for bank apps? Banks could (and I’m sure they have) offer their own TOTP client, perhaps a bit more integrated. I’m sure that would be easier and offer a better experience than downing some random. "Google Authenticator" app.

Yes, that works well. My bank has integrated this functionality this functionality into their mobile app, allowing one to use it to login on a computer. When large amounts are to be transferred, the bank-supplied 2FA device is still needed though (which can be annoying, but seems sensible).

This scheme also works really well with payments from your computer. Just use the bank app to scan a qr-code on checkout, verify the payment details on your phone, touch a button, and you're done.

I'd guess that a majority of the bank's clients are using this method. This is in the Netherlands, by the way.

Re: SMS is not 2FA-secure

#213

Post by kdeldycke » Sat, Jan 11, 2020, 7:03 AM UTC

From the past few months I'm collecting all resources on the use of SMS as a 2FA: https://github.com/kdeldycke/awesome-iam#sms-based-authentic...

TL;DR: don't.

Re: SMS is not 2FA-secure

#214

Post by sneak » Sat, Jan 11, 2020, 7:17 AM UTC

balladeer wrote: post #209

jkepler wrote: post #157

Earlier quoted context omitted.

Why not use an open TOTP app like AndOTP. I use it all the time for sites that claim to require Google Authenticator, it works, and its easy to backup the secrets as plain text or encrypted with a password. I keep it current on my primary phone and a cheap offline backup, in addition to backing up the encrypted secrets file.

I use Authy on iPhone and Mac. I am looking for an OSS replacement but would not want to setup everything from scratch after I change device reinstall the app like Google Authenticator.

Bitwarden does a decent job of storing and syncing TOTP codes. Make sure you always use a long password with Bitwarden though, to avoid a known and unpatched issue with their password-based key derivation.

Re: SMS is not 2FA-secure

#215

Post by perl4ever » Sat, Jan 11, 2020, 7:27 AM UTC

pwg wrote: post #187

alkonaut wrote: post #48

I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Because with 99.99% certainty the person that needs to unlock the account is me, and not an attacker. Even with a dozen backup yubikeys and spare codes written down I’d still be much more likely to lock myself out than be attacked. If it’s one thing I have learned the hard way it’s that the most dangerous per…

> I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Anytime you have a human in the loop you have the risk of human failings. I.e., that human forgets to follow critical step X in the protocol. Or that human falls for the attackers emotional sob story and takes pity on the attacker and lets the attacker unlock your account. Or that particular human is amenab…

It's an iron rule that the more automation, the more important are the humans that remain.

I'm not sure you get this. Google hasn't seemed to get this in the past. They have added some customer support though.

Re: SMS is not 2FA-secure

#216

Post by rahuldottech » Sat, Jan 11, 2020, 7:31 AM UTC

adrr wrote: post #205

fastball wrote: post #196

Earlier quoted context omitted.

Photo ID seems like enough, no?

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

This is not true everywhere. There are Aadhar cards in India where you can confirm your identity with biometrics at any store using government-provided equipment that many stores have.

Re: SMS is not 2FA-secure

#217

Post by willvarfar » Sat, Jan 11, 2020, 7:37 AM UTC

adrr wrote: post #205

fastball wrote: post #196

Earlier quoted context omitted.

Photo ID seems like enough, no?

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

I’m not in the US, but the only ID card without a chip that I can think of here is a European driving license, which is just a plastic credit-card-sized thing that is often used as informal verification eg to collect a parcel.

Re: SMS is not 2FA-secure

#218

Post by krick » Sat, Jan 11, 2020, 7:39 AM UTC

Did we ever seriously doubt that? 2FA is just a made-up reason to have your phone number anyway, all the services that require that don't really want anything other than that.

Re: SMS is not 2FA-secure

#219

Post by PeterisP » Sat, Jan 11, 2020, 7:40 AM UTC

adrr wrote: post #205

fastball wrote: post #196

Earlier quoted context omitted.

Photo ID seems like enough, no?

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

That's the key problem that US needs to solve - the businesses don't really have a solid gov't ID system to fall back on. In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc.

I mean, in Europe if criminals want to get a bunch of stuff on credit from some place with a disposable identity, they generally recruit poor/homeless people with real IDs, because that is simpler/cheaper/safer than trying to do it with counterfeit IDs.

SMS hijacking, just as the core identity theft issue is so much rare elsewhere - it demonstrates that it's a solvable issue if the USA wanted to solve it. (in some sense the discussion on identity theft reminds me of https://www.theonion.com/no-way-to-prevent-this-says-only-na...) However, the straightforward way to do that would require a proper single centralized (i.e. federal) gov't ID issued to almost all people, which seems to be anathema in USA.

Re: SMS is not 2FA-secure

#220

Post by balladeer » Sat, Jan 11, 2020, 7:41 AM UTC

tptacek wrote: post #145

pxeboot wrote: post #100

Earlier quoted context omitted.

Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.

Isn't there a registration step for new SIMs with iMessage?

I think there’s an SMS sent without any visual indication and without asking for explicit permission (or I missed it if there was a tiny text warning). I noticed it when I saw an SMS, in my bill, sent to a Singapore number which, as an international SMS, was changeable (SMS is mostly free here).