Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

281–290 of 379 posts

Re: SMS is not 2FA-secure

#281

Post by brightball »

kccqzy wrote: post #131
mumblemumble wrote: post #113

Earlier quoted context omitted.

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

WebAuthn is definitely the way to go. The security key approach is such a better user experience that the app based approaches.

Re: SMS is not 2FA-secure

#282

Post by fulafel »

cortesoft wrote: post #180
tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

So how SHOULD this problem be solved? How should account recovery work?

A web of trust style arrangement would be interesting, 2/3 of previously named recovery pals would have to verify you.

Re: SMS is not 2FA-secure

#283

Post by Pxtl »

tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

Seems straightforward, all these phone companies have endless kiosks and offices. Legislate that a phone number can only be transferred by making a confirmation call to the old phone or in-person with a salesperson who is checking ID.

Re: SMS is not 2FA-secure

#284

Post by willvarfar »

RcouF1uZ4gsC wrote: post #11

The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did not back up their TOTP. With SMS authentication, even if the user loses a phone, they can go down to the local cell phone store and get a new phone on their number and be back in business without the website having to get involved.

I know that google branded “titan” yubikeys come in pairs. One is for keeping in a safe place for recovery.

Re: SMS is not 2FA-secure

#285

Post by MrStonedOne »

Protip: security is not black and white

The word "secure" is not binary.

sms as a 2fa is secure.

Just not as secure as a authy totp account

...which is not as secure as a unclonable totp system

...which is not as secure as a hardware token based otp system

...which is not as secure as a hardware token that also requires you enter a pin and a fingerprint to activate it and only communicates using hard coded encrypted messages with the legit service that issued it.

Re: SMS is not 2FA-secure

#286

Post by ryanlol »

chewz wrote: post #273
paranoidrobot wrote: post #272

Earlier quoted context omitted.

Or like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-he...

The clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake. So easy for evildoers and so much friction for law-abiding customers.

I think most people fail to realize that excellent fake IDs cost like $50. (A tad more in the EU because of the lower drinking age)

Re: SMS is not 2FA-secure

#287

Post by simsla »

Pxtl wrote: post #283
tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

Seems straightforward, all these phone companies have endless kiosks and offices. Legislate that a phone number can only be transferred by making a confirmation call to the old phone or in-person with a salesperson who is checking ID.

In Europe, neither of these is viable without a complete overhaul.

- There are online-only providers. E.g. Giffgaff in the UK, Mobile Vikings in Belgium, etc. - Many European countries offer prepaid SIMs that aren't tied to ID. Instead, you can just buy them in the supermarket the same way like you would a gift voucher.

Re: SMS is not 2FA-secure

#288

Post by tialaramex »

vladvasiliu wrote: post #237
PeterisP wrote: post #219

Earlier quoted context omitted.

That's the key problem that US needs to solve - the businesses don't really have a solid gov't ID system to fall back on. In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. I mea…

I have a counterpoint from my experience in France. A few years back I have lost my phone and went to get a new SIM. The attendant in the shop only had a quick look over my ID card. He didn't scan it nor did he enter the ID number in the computer to check anything. I think he only verified that the name was the same as the one on file and the photo looked like me. The same happens at the post office when you go to co…

The pen contains a chemical that interacts with the paper that's always used to make these bank notes. Specifically it blackens the starch found in wood pulp, and the paper in your laser printer, photocopier, etcetera uses wood pulp because that's cheap. Bank notes use a higher quality paper and so they aren't turned black.

This forces crooks to use more expensive and traceable high quality papers for their counterfeit notes or they'll get rejected in stores and bars.

Having IDs that actually look up to anything at all is a relatively modern idea. When I was born if you suspected a passport in my country of being bogus it'd probably take a bunch of clerks several hours of physically looking through filing cabinets to check.

And where we build systems that can check often people don't. The UK government built a system which lets a driver prove to the government who they are and then get a token value back which they can give to anyone - that token can be exchanged for viewing the government records for that driver. So e.g. hire firms could insist on this token to see you're not disqualified and actually have the entitlements your physical driving license says you have.

They don't. Some of them will let you give them this token reluctantly but all prefer you give them a print out, which obviously you could just fake.

Re: SMS is not 2FA-secure

#289

Post by ossguy »

juskrey wrote: post #248
ossguy wrote: post #118

Earlier quoted context omitted.

That's how https://jmp.chat/ works, and you can make your phone number as arbitrarily secure as you want with JMP. Any port-out requests are handled manually - you are contacted by a human to ensure that you made the request. You can ask them to put a verification code on file for you to confirm when this happens if you're concerned about the security of your XMPP account (which itself could use whatever kind of auth…

Good luck trying to use VOIP numbers with US banks these days

In practice it seems to work fine with the banks I've tried. There may be one or two that don't accept numbers whose type is listed as "voip", but they are in the minority.

There is also work being done to update the type field of JMP numbers so they appear as "mobile" instead.

Post reply on HN