I thought this was going to be one of the otherwise-plaintext black and white web pages with NO. centered in the middle, but interestingly it's actual research, and a nice read (even if nothing new) at that.
[deleted]
SMS is not 2FA-secure
221–230 of 379 posts
Re: SMS is not 2FA-secure
#222Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…
Use Authy. Can be transferred to a new device.
Re: SMS is not 2FA-secure
#223My understanding is that you don't even need to do a SIM swap, because the SS7 signaling system is insecure. SIM Swap is likely the easiest way as wage-slave employees are quite pliable to bribes[0]. But if you want to be even more anonymous, you can apparently re-route texts remotely [1]. 0: https://www.nbcbayarea.com/news/local/mans-1m-life-savings-s... 1: https://www.kaspersky.com/blog/ss7-hacked/25529/ I thought…
In the future, the term SIM Swap will likely be replaced with something like "SIM identity theft" so that banks and telecoms are not liable. Then we can all buy SIM identity protection.
Re: SMS is not 2FA-secure
#224Earlier quoted context omitted.
TOTP has a secret which is basically the seed of the calculation. The security basically comes from that secret being only on the phone you have and not being copyable. Moving it to the server removes that proximity. At least thats how i see it, but you could do it very easily server side if you wanted with equivalent security loss.
Having the secret only exist on a single phone is the most secure, but keeping a backup of the secret for recovery if you lose the phone only lowers security a negligible amount if you are careful about it. If it is an account you set up from home, probably the simplest thing to do is print the setup page before you scan the QR code for the secret. Even better, print the page, and then scan that QR code from the prin…
People chasing perfect security by only putting their TOTP codes in one place seems like perfect being the enemy of good. Back up you codes people! Put them in an encrypted file and back that file up in a bunch of places.
Encrypting a file is a bit arcane, but not difficult:
openssl enc -aes-256-cbc -pbkdf2 -iter 1024 -in plaintext.txt -out cryptotext.dat
openssl enc -aes-256-cbc -pbkdf2 -iter 1024 -d -in cryptotext.dat -out plaintext.txt
Re: SMS is not 2FA-secure
#225Earlier quoted context omitted.
> account recovery, as a sole factor, meaning you're substantially worse off with SMS authentication than you are without it at those services But if in those cases you disable SMS auth, then you can't recover your account right? That might be considered worse off in some cases.
What worries me isn’t that I might not be able to recover my account if it uses some other form of authentication, it’s that I might not be able to recover my account because it requires authentication from a phone number I lose access to.
And by the time you regain access to the phone number, the account might already be using a different one...
Re: SMS is not 2FA-secure
#226Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…
> Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome.
It doesn't offer export in the app UI. It's not doing anything to prevent you from backing up the tokens yourself; they're stored in the clear in the sqlite database for the app.
If that's too much for you, there's a good chance https://github.com/puddly/android-otp-extractor can get them automatically.
Re: SMS is not 2FA-secure
#227I don't really trust Authy being used as much as I think anyone else would. For the sites that I have used it with, an Authy account, or just the app is not required. Therefore codes are just sent over plain SMS.
Consider this scenario. Twitch now enforces the use of all accounts that want to stream all require the use of 2FA, after the whole artifact fiasco. Anyone over the age of 13 is able to do this. I don't expect everyone at this age to have a phone number, and I assume these people would rely on their parents phone to pass this.
As authy is completely optional, people may choose to not require another app for their account, in effort of just quickly jumping through another hoop blocking them from going live, or the device owner not wanting to have an app installed.
It just feels weird knowing that this can be a point of failure for a service that solely relies on a single 2FA method that could from an attack like this down to the individual and how they operate.
Re: SMS is not 2FA-secure
#228Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.
> aren't TOTP authenticators like the cheapest 2FA option to begin with??
They are precisely equivalent to asking for two passwords on login instead of one password. "Something you know" and "something else you know". So pretty much, yeah. SMS may not be especially secure, but it is at least an actual second factor.
Re: SMS is not 2FA-secure
#229This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…
So how SHOULD this problem be solved? How should account recovery work?
What about setting up two mobile phone numbers for recipients of the recovery code: 123 sent to phone #1 and 456 sent to phone #2? (Phone #1 is yours and phone #2 is your elected trusted partner’s)
Won’t this work?
Re: SMS is not 2FA-secure
#230Earlier quoted context omitted.
You can run TOTP in javascript sure http://blog.tinisles.com/2011/10/google-authenticator-one-ti... But how do you protect access to the website - with a username and password? Or do people now need to remember another code like "JBSWY3DPEHPK3PXP" to set up the authenticator everytime they visit? Mobile apps were one way to solve this although the hardware U2F tokens like Yubikey provide another authentication factor…
That's right, in fact if people remember that secret then it's not a "second factor" it's just another part of their password. A "factor" in the context of authentication means one of the various ways that can be used to verify someone's identity: "something you know" (password), "something you have" (non-duplicatable object, eg a SIM card or OTP token containing a secret that cannot be easily guessed or extracted),…
> in fact if people remember that secret then it's not a "second factor" it's just another part of their password.
This is more generous than it should be. Your TOTP secret is just another part of your password regardless of whether you personally remember it or not; what matters is that, if I would like to be you, I only need to know the secret.