Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

291–300 of 379 posts

Re: SMS is not 2FA-secure

#291

Post by _wldu »

The sad part about all of this is the complexity of the new solutions. Webauthn is strong but fiendishly complex. How did we get here?

Websites used weak hashes (md5 and sha1... efficient to compute and attack) to store passwords and allowed users to set short, weak passwords (12345, letmein).

Long passwords randomly generated by password managers and stored as strong hashes (Argon2id) by websites are secure, not guessable and even difficult/expensive to attack offline when the database is dumped.

This approach is simple and easily understood by everyone involved (users and site admins) and would be suitable for the security of 99% of websites. Leaving 'Account Recovery' as the only remaining challenge.

Re: SMS is not 2FA-secure

#292

Post by ChuckNorris89 »

simsla wrote: post #287
Pxtl wrote: post #283

Earlier quoted context omitted.

Seems straightforward, all these phone companies have endless kiosks and offices. Legislate that a phone number can only be transferred by making a confirmation call to the old phone or in-person with a salesperson who is checking ID.

In Europe, neither of these is viable without a complete overhaul. - There are online-only providers. E.g. Giffgaff in the UK, Mobile Vikings in Belgium, etc. - Many European countries offer prepaid SIMs that aren't tied to ID. Instead, you can just buy them in the supermarket the same way like you would a gift voucher.

On the contrary, in most European countries, due to anti terror regulations, you now need an ID to buy a SIM card or if you've bought one before this new law came into place you have to send a picture of your ID to the Telecom operator or your sim card gets deactivated.

Not saying I like this or that this is good way forward but it's a reality that contradicts your assumption.

Re: SMS is not 2FA-secure

#293

Post by fastball »

adrr wrote: post #205
fastball wrote: post #196

Earlier quoted context omitted.

Photo ID seems like enough, no?

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

My DL has a barcode that can be swiped. They already use it at grocery stores to confirm that you are over 21 and that it's a real ID.

Re: SMS is not 2FA-secure

#294

Post by fastball »

PeterisP wrote: post #219
adrr wrote: post #205

Earlier quoted context omitted.

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

That's the key problem that US needs to solve - the businesses don't really have a solid gov't ID system to fall back on. In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. I mea…

You can get a federal ID. It's called a passport card. It costs $65.

The US also has the REAL ID[0] standard that requires IDs to meet minimum standards in order to be accepted by the federal government.

If carriers just required a REAL ID compliant ID in order to get a new SIM, and actually checked it via the chip or magnetic strip, I think we'd be good.

[0] https://www.dhs.gov/real-id

Re: SMS is not 2FA-secure

#295

Post by fastball »

jaclaz wrote: post #261
PeterisP wrote: post #219

Earlier quoted context omitted.

That's the key problem that US needs to solve - the businesses don't really have a solid gov't ID system to fall back on. In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. I mea…

>In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. Can you detail which "most" of Europe you are talking about? In Italy, while obviously you have to produce an ID card, there i…

Plus Italy's national ID is laughably insecure. It's a laminated piece of paper. I remember when I was growing up I had an Italian friend in the UK who went out to a bar for her actual 18th birthday. When they asked for ID, she showed it to them and they kicked us out because they thought it was fake. It was not.

Re: SMS is not 2FA-secure

#296

Post by Pxtl »

ChuckNorris89 wrote: post #292
simsla wrote: post #287

Earlier quoted context omitted.

In Europe, neither of these is viable without a complete overhaul. - There are online-only providers. E.g. Giffgaff in the UK, Mobile Vikings in Belgium, etc. - Many European countries offer prepaid SIMs that aren't tied to ID. Instead, you can just buy them in the supermarket the same way like you would a gift voucher.

On the contrary, in most European countries, due to anti terror regulations, you now need an ID to buy a SIM card or if you've bought one before this new law came into place you have to send a picture of your ID to the Telecom operator or your sim card gets deactivated. Not saying I like this or that this is good way forward but it's a reality that contradicts your assumption.

Assuming that ID gets logged in a database accessible to customer service people, it seems like a database check for IDs and IMEIs would be workable as a way to confirm "sorry, we can't port that number to your new SIM card, the ID card registered to its IMEI doesn't match your old phone number's ID card". You could still do it over the phone, then, since an ID was logged against your sim card when you bought it.

Re: SMS is not 2FA-secure

#297

Post by tzs »

jandrese wrote: post #224
tzs wrote: post #198

Earlier quoted context omitted.

Having the secret only exist on a single phone is the most secure, but keeping a backup of the secret for recovery if you lose the phone only lowers security a negligible amount if you are careful about it. If it is an account you set up from home, probably the simplest thing to do is print the setup page before you scan the QR code for the secret. Even better, print the page, and then scan that QR code from the prin…

People chasing perfect security by only putting their TOTP codes in one place seems like perfect being the enemy of good. Back up you codes people! Put them in an encrypted file and back that file up in a bunch of places. Encrypting a file is a bit arcane, but not difficult: openssl enc -aes-256-cbc -pbkdf2 -iter 1024 -in plaintext.txt -out cryptotext.dat Decrypting is about the same: openssl enc -aes-256-cbc -pbkdf2…

Do you have one encrypted file with all the codes, or do you have one file per code?

I prefer one file per code. When I get a new code, I make a directory named after the account the code is for, save a screenshot of the QR code in there, save a text file with the text version of of the code and any one-time recovery codes the site provided. I then make a .zip for .tgz from that directory, encrypt that, and save a copy in the cloud and locally. The local copy is in a location that is included in offsite backups.

If you use one file per code, I'd recommend using a public key system for the encryption. That way you don't have to enter any secrets to encrypt a new code. You only enter anything secret when decrypting.

This has a few advantages.

1. Less chance of accidentally exposing the key.

2. If like most people you use the same key for all the files, no chance of unknowingly mistyping the key resulting in a file that you cannot decrypt later.

3. If you need to recover a code, you only need to decrypt that code.

If as you suggest you wrap this in shell scripts, you can address #2 there. Have a reference file encrypted with your symmetric key. For encryption, the script can ask for your key and verify it was typed correctly by using it to decrypt the reference file.

Also worth considering is using an encrypted disk image. I believe that all major desktop operating systems provide reasonably easy ways to create, mount, and dismount such volumes. Whether you use one file per code or all codes in one file, the file or files can live on an encrypted volume that you only mount when you are saving a new code or recovering an old code.

The advantage of that is that there is no need to use any arcane commands or install any extra software.

Re: SMS is not 2FA-secure

#298

Post by Nextgrid »

ChuckNorris89 wrote: post #292
simsla wrote: post #287

Earlier quoted context omitted.

In Europe, neither of these is viable without a complete overhaul. - There are online-only providers. E.g. Giffgaff in the UK, Mobile Vikings in Belgium, etc. - Many European countries offer prepaid SIMs that aren't tied to ID. Instead, you can just buy them in the supermarket the same way like you would a gift voucher.

On the contrary, in most European countries, due to anti terror regulations, you now need an ID to buy a SIM card or if you've bought one before this new law came into place you have to send a picture of your ID to the Telecom operator or your sim card gets deactivated. Not saying I like this or that this is good way forward but it's a reality that contradicts your assumption.

This will do nothing to deter malicious SIM swaps. Someone who's happy to take over your number and then steal your money is also happy to present a fake ID and pretend to be you.

Re: SMS is not 2FA-secure

#299

Post by Nextgrid »

chewz wrote: post #253
adrr wrote: post #188

Earlier quoted context omitted.

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.

> Walk into a store and provide a government ID and the original SIM card. This is how it works in Poland since September 2019, after some recent SIM-swap attacks. You can swap SIM or get a replacement if stolen only at store showing government ID. It is free of charge with Orange and not always free with T-mobile. But this has some downsides in real life. 1) I had to walk my 88 yo Mom to the store to swap SIM card.…

The problem is that the ID is still checked by the clerk. They could be bribed or tricked by a fake ID.

A recovery code snail-mailed/e-mailed to the account holder when they first open the account is the correct way to go, and if they can't provide it they need to go through a lengthy process where many factors are used to authenticate them (verify their physical address, verify their ID, ask to confirm last call records, billing details, etc).

Re: SMS is not 2FA-secure

#300

Post by Nextgrid »

fastball wrote: post #293
adrr wrote: post #205

Earlier quoted context omitted.

Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.

My DL has a barcode that can be swiped. They already use it at grocery stores to confirm that you are over 21 and that it's a real ID.

Does the bar code act as a key to lookup a record in a central database, or does it just encode "I am 21, trust me" without any cryptographic signature?

Unless it's the former it's as good as a standard paper ID as far as forgeries go. If anything, having it machine-readable decreases security as it means the person inspecting it spends less time looking at it and just scans it in a machine.

Post reply on HN