Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

251–260 of 379 posts

Re: SMS is not 2FA-secure

#251

Post by riffraff »

justincormack wrote: post #243
riffraff wrote: post #240

Earlier quoted context omitted.

AFAIK, in the EU all banks are required to have "strong authentication" which usually means using 2FA via biometric authentication on your phone. Classic Google Authenticator does not seem much more friction than that.

That is not true. Banks in the EU seem to vary a lot, as the definition of “strong” is not defined (plus many banks have not introduced it yet). Biometric is definitely not required. I use hw tokens but at least one of my banks is trying to move to weaker auth.

I didn't say biometric is required, I said it's normal to have 2fa with friction, an hardware token is just as much friction as TOTP or biometric.

I am surprised your bank is moving to a weaker auth, what does that mean?

I have 3 bank accounts in 2 countries and they all switched to biometric because it's just a simpler experience then the hardware token or "mobile token" they used before.

Re: SMS is not 2FA-secure

#253

Post by chewz »

adrr wrote: post #188
cortesoft wrote: post #180

Earlier quoted context omitted.

So how SHOULD this problem be solved? How should account recovery work?

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.

> Walk into a store and provide a government ID and the original SIM card.

This is how it works in Poland since September 2019, after some recent SIM-swap attacks. You can swap SIM or get a replacement if stolen only at store showing government ID. It is free of charge with Orange and not always free with T-mobile.

But this has some downsides in real life.

1) I had to walk my 88 yo Mom to the store to swap SIM card.

2) Every clerk at every shop can do that so for a determined criminal it is possible to bribe or threaten one.

3) Virtual operators (MVNOs) usually do not have physical locations and there is a dozen of them.

Re: SMS is not 2FA-secure

#254

Post by fauigerzigerk »

cortesoft wrote: post #200
adrr wrote: post #188

Earlier quoted context omitted.

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.

I meant for the services currently relying on SMS for account recovery... for example, how should you recover your gmail account if you lose access?

Use backup verification codes and a recovery email address.

Also, remember the date when you created your Google account. The best way to find that date may be to look at the first email you received in the account.

Re: SMS is not 2FA-secure

#255

Post by C14L »

TheDong wrote: post #134
mceachen wrote: post #98

Earlier quoted context omitted.

Know that if your single phone dies with all your totp credentials, you're sunk.

Only if they neglected to offer backup codes (which anyone who does TOTP should). Otherwise, you can just grab a few backup codes out of your fireproof safe and register your new totp code, or go to the bank and get them out of your bank vault. Sure, the fireproof safe costs as much as a few yubikeys, but if you go the yubikey route you both need the yubikeys and a fireproof safe and bank vault for your spare yubikey…

Fireproof safe? Just use a text file and encrypt it.

Or a password manager file only for TOTP backups.

Re: SMS is not 2FA-secure

#256

Post by scintill76 »

adrr wrote: post #205
fastball wrote: post #196

Earlier quoted context omitted.

Photo ID seems like enough, no?

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

$200 and greater risk of getting caught -- that's still a step forward. Right now it only takes sitting at home spending a few cents to call customer service and social engineering them.

Re: SMS is not 2FA-secure

#258

Post by fyfy18 »

Uptrenda wrote: post #162
rckoepke wrote: post #13

My understanding is that you don't even need to do a SIM swap, because the SS7 signaling system is insecure. SIM Swap is likely the easiest way as wage-slave employees are quite pliable to bribes[0]. But if you want to be even more anonymous, you can apparently re-route texts remotely [1]. 0: https://www.nbcbayarea.com/news/local/mans-1m-life-savings-s... 1: https://www.kaspersky.com/blog/ss7-hacked/25529/ I thought…

Yep, the security problems with the mobile system are ghastly. - Stingrays... - Operator app pushes to SIM cards... - Secret GSM processors and software internals - Voice / text / data "ciphering" - Protocol-level "emergency" tracking features - Silent SMS (sounds like its from a bad cop show but its actually a real thing it turns out.) "They do not show up on a display, nor trigger any acoustical signal when receive…

> sounds like it has a completely legit use...

The original purpose of silent SMS was to send voicemail or missed call notifications to handsets, which would trigger an icon to be displayed on the device. Sending a regular SMS would be annoying as the user would have to delete it - after you've listened to your voicemail, another silent SMS can be sent to turn off the notification. Also originally SMS was stored in the SIM itself which had limited memory, so it would be not be very convenient if you didn't receive a voicemail message as your SIM was full. Remember this is a 28 year old feature of GSM.

The tracking argument seems somewhat mute, maybe when this first came to light 10 years ago it wasn't the case, but nowadays I would be very surprised if operators do not keep detailed logs of all the IMEI (unique identifier for a given device) and IMSI (same, but for the SIM) that connect to their towers.

Re: SMS is not 2FA-secure

#259

Post by choppaface »

Word of warning if you know somebody who uses Bank of America: their customer support has a mechanism to push you a 2nd factor code over SMS and then they actually ask you for the code over the phone. The text message looks 99% identical to the 2nd factor code you get when normally logging in to your bank account.

Support does this to 'verify your identity' and authorize doing arbitrary things like even moving $100,000 out of your bank account.

And no, their security team won't fix this.

Re: SMS is not 2FA-secure

#260

Post by alkonaut »

pwg wrote: post #187
alkonaut wrote: post #48

I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Because with 99.99% certainty the person that needs to unlock the account is me, and not an attacker. Even with a dozen backup yubikeys and spare codes written down I’d still be much more likely to lock myself out than be attacked. If it’s one thing I have learned the hard way it’s that the most dangerous per…

> I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Anytime you have a human in the loop you have the risk of human failings. I.e., that human forgets to follow critical step X in the protocol. Or that human falls for the attackers emotional sob story and takes pity on the attacker and lets the attacker unlock your account. Or that particular human is amenab…

> Anytime you have a human in the loop you have the risk of human failings. I.e., that human forgets to follow critical step X in the protocol

This is exactly my point. If the risk of an attack is X, the risk of me being that person who fails or forgets a critical step of the protocol (backup yubikey, whatever) is a hundred times higher. So this system of “flawed humans interacting” to me looks like the lesser evil.

I don’t want my things protected by foolproof protocols. I‘m the fool you see.

Post reply on HN