Live data from Hacker News

It’s time to stop using SMS for security

lucky225.medium.com

61–70 of 149 posts

Re: It’s time to stop using SMS for security

#61
post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

The hatred is because it costs 16 dollars to take over a number:

https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

Re: It’s time to stop using SMS for security

#62
post #61
post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

The hatred is because it costs 16 dollars to take over a number: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

Even easier are the sites that do this: "Please enter the phone number where we should send your one-time 2FA code: [_______]"

I've had that happen on more than one site. Surely anyone who stole my password would just put in their own number?

Re: It’s time to stop using SMS for security

#63
post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

I actually love SMS 2FA ( And the rare few on HN ). It is the simplest form of 2FA that non-tech people will actually understand and use. Unless people want to argue 1FA is better than crappy 2FA.

SMS gets hatred especially in US because of how easy it is to socially engineer their way for SIM replacement or other SMS uses. Mostly because for unknown reason US has the absolute worst MNO in the world. In other places SMS replacement requires official forms to be filled as well as physical presence. It doesn't matter whether SMS is a form of 2FA of not, getting my SIM card without decent form of protection from Carrier is wrong in the first place.

And RCS doesn't seems / want / willing to replace SMS anytime soon. Carrier have little incentive to do so. It is backed by Google which means not everyone is on board including Apple. And GSMA has no intention to make a better SMS either.

Re: It’s time to stop using SMS for security

#64
post #48

The website does not currently work for me. Here's a working archive.org mirror: https://web.archive.org/web/20210316074533/https://lucky225.... If that mirror keeps hiding the text, blocking all inline scripts with uBlock Origin solved it for me.

[deleted]

Re: It’s time to stop using SMS for security

#65
post #63
post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

I actually love SMS 2FA ( And the rare few on HN ). It is the simplest form of 2FA that non-tech people will actually understand and use. Unless people want to argue 1FA is better than crappy 2FA. SMS gets hatred especially in US because of how easy it is to socially engineer their way for SIM replacement or other SMS uses. Mostly because for unknown reason US has the absolute worst MNO in the world. In other places…

Having built a system to handle SMS for a previous employer about 10 years ago the US's fractured mobile phone system did not help back then you could not reliably deliver SMS across systems.

Unfortunately yet another example of the US's poor regulation of telecoms receiver pays is another example.

Re: It’s time to stop using SMS for security

#66
post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

SMS has no security at all.

SMS is not properly encrypted over the air, GSM and UMTS encryption is broken and often misconfigured anyways. There is no way to check and no guarantee that a SMS will be transmitted in a safe encryption protocol, i.e. no way to force LTE. And given the level of brokenness in GSM and UMTS, I wouldn't rely too much on LTE or 5G crypto being worth anything. End-to-end encryption isn't provided anyways.

Also, phone numbers are not terribly secure either. The control protocol for mobile networks, SS7, is a steaming heap of excrement without any consideration for security. There are numerous ways to redirect SMS and calls into the hands of criminals, which have been demonstrated over and over by researchers. Also, this is regularly being abused by the police, secret services and criminals. As a customer, you are completely at the mercy of the phone network to do the proper mitigation dance because SS7 is inherently broken and cannot be fixed, just maybe firewalled off (a little, but not too much...): https://attack.mitre.org/techniques/T1449/

Then there is a whole lot of social engineering cases to take over numbers and SIM cards which others have described nearby.

With 2FA via a proper app or even open protocols like TOTP, I can verify and trust much more of the auth flow. Properly done, I only need to trust the endpoints and (maybe, if used, with TOTP even that is unnecessary) the TLS connection. With SMS, I need to trust a whole lot of telcos between the endpoints, their firewalls, IDSs, (mis-)configurations, all their service providers and their employees not to fiddle with things. And actually, all of the aforementioned have repeatedly proven untrustworthy by using broken, outdated, and known-to-be-insecure technology.

Re: It’s time to stop using SMS for security

#67
post #19

Living in Germany, I don't remember the last time I used an SMS. When I was in south-east Asia I don't think I ever used SMS, it was always Line (or WeChat in China) or email. Is there a reason SMS are so much in use in the US but not in other parts of the world?

The good thing about SMS is that it's standard. I live in Sweden, just about everyone has a smartphone. SMS is still common for things like package delivery notifications or other service notifications, SMS is still an option for many transport tickets, though being phased out in favor of app solutions.

SMS works whether you're on iOS or Android, it works for the few users of classic phones, it works if you don't currently have mobile data, etc. It's not a secure method of communication and has other flaws, but it's the most reliable one if you don't know anything about the recipient. Whether they're using their beloved Siemens S35 or the latest Android flagship, they can receive a SMS.

Re: It’s time to stop using SMS for security

#68
post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app. Like Microsoft Authenticator. It wanted way too many permissions on my phone, and provided less security than my Yubikey authenticator. My yubikey provides a standard open OTP but requires the device to generate it (phone tap or plugin via USB to computer or phone). Open standards are better. I don't want a d…

Microsoft Authenticator can be replaced by any app that does standard OTP, e.g. FreeOTP+.

Re: It’s time to stop using SMS for security

#69

Earlier quoted context omitted.

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to…

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn…

The app does work by the way.

It is a steaming hot pile of garbage where the government has yet again decided to not use a widely accepted standard.

But if you just need to login to myGov every few months to check something or do your tax return it works better then the SMS

(Just don't lose the phone it is installed on, because you can't link it to a new one without ringing and wading through security checks)

Re: It’s time to stop using SMS for security

#70
post #49
post #42

Earlier quoted context omitted.

I am in Switzerland and half of web services ask for a sms confirmation these days. Its not an US issue

Not even niche web services. Yesterday Amazon insisted I tell them the code they sent to a phone I haven’t owned in 5 years.

Imagine making an account with Twitter these days without major phone provider. Twitter seriously would not accept my last sim from a small swiss provider, nether did facebook and many other services.
Post reply on HN