Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s time to stop using SMS for security

lucky225.medium.com

Post reply on HN
Print view View original

71–80 of 149 posts

Re: It’s time to stop using SMS for security

#71

Post by 0xbadcafebee »

slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

SMS is fine for 2FA for Reddit. It's not fine when it protects things that have financial repercussions. But that's when we actually need strong 2FA.

It's been proven time and again that cyber criminals frequently target people using SMS 2FA to steal from them. Most implementations of 2FA might as well be 1FA. People might even use worse passwords when they think 2FA protects them.

I think the adoption of SMS as a "universal 2FA" was not worth it. We should've just gotten people used to the less easy but more secure methods. U2F bluetooth keyfob on my keychain would be good enough for my phone and PC. Remote access seems like the hardest nut to crack.

Re: It’s time to stop using SMS for security

#72

Post by eythian »

pabs3 wrote: post #9
slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

Probably the SIM porting attacks, where telco employees are vulnerable to being socially engineered to letting an attacker port your phone number over to another device. Also this new attack, which is more stealthy.

Some countries resolve the porting issue by having a list of numbers that have been ported, so that banks (for example) can check that and not rely on it if the port happened in the past two weeks (also, for example.)

Re: It’s time to stop using SMS for security

#73

Post by tomjen3 »

slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

SMS 2f is only used to collect phone numbers. There is already an open standard called TOTP that people can use, and which requires no special access and isn't locked to any PII.

Re: It’s time to stop using SMS for security

#74

Post by herbst »

dgellow wrote: post #47
baxtr wrote: post #32

Earlier quoted context omitted.

I don't think that's true though. Maybe you haven't SEND any, but I bet you receive a lot. At least I do: from my bank, from some of my bank accounts, from my mobile service provider, from my parcel delivery service. From Coinbase, from PayPal... The list goes on and on.

So, I just checked, during the past ~6 months I got the following: - Clubhouse invite - A security code from a trading exchange - My mobile internet provider telling me I reached 80% of my monthly data budget - A few codes to validate my phone number when creating new accounts on platforms And that's basically it.

Exacly. Imagine losing acces to that number for whatever reason. Thats the exact issue, this number is now part of your security concept if you want or not.

Re: It’s time to stop using SMS for security

#75

Post by eythian »

sdfhbdf wrote: post #46

The link is pointing to 0 content length page with no content type header so it behaves weirdly in for example Safari trying to download.

In firefox for me, it's just a blank page and the headers returned seem mostly to be from cloudflare rather than medium.

Re: It’s time to stop using SMS for security

#76

Post by herbst »

realusername wrote: post #29
erfgh wrote: post #23

Earlier quoted context omitted.

Not all people have or want smartphones.

Don't know about the US but I haven't seen anybody using classic GSM for years now...

I have a smartphone, but i usually dont have a sim card. One is not exclusive to the other. I use and need google auth and some other apps, i also like to surf on my couch.

What i definitly dont need is being reachable and available 24/7 wherever i am

Re: It’s time to stop using SMS for security

#77

Post by simonebrunozzi »

slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

Here's a parable, from personal experience [0].

TL;DR: my mobile phone number (not the phone itself) was hacked, then my Twitter account. The attacker changed my Twitter handle from @simon to @simonsw9kww.

I eventually recovered my @simon twitter account, after several MONTHS and several emails and calls to twitter support and friends working at Twitter.

Is this enough for you?

[0]: https://simon.medium.com/mobile-twitter-hacked-please-help-2...

Re: It’s time to stop using SMS for security

#78

Post by chrismorgan »

dbetteridge wrote: post #69
chrismorgan wrote: post #58

Earlier quoted context omitted.

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn…

The app does work by the way. It is a steaming hot pile of garbage where the government has yet again decided to not use a widely accepted standard. But if you just need to login to myGov every few months to check something or do your tax return it works better then the SMS (Just don't lose the phone it is installed on, because you can't link it to a new one without ringing and wading through security checks)

When I hear many reports of things flat-out not working in this way, I’m suspicious that it won’t work for me with my Samsung Galaxy J1 (2016) on Android 5.1, which Google has progressively broken by means of Google Play Services updates. As some typical examples of things that have been broken by Google Play Store updates: Fastmail notifications now only come through on wifi or (I found out last week) if Maps (by Google) is running in the foreground; and Hangouts is completely nonfunctional off wifi (can’t send or receive). It’s network-related things that are the least reliable.

I really wish I could root it or install a new OS on it, but the former has failed and even with an unlocked bootloader the latter takes much too much effort if a prebuilt image isn’t available for your specific device, which roughly means “if you don’t have a flagship phone”.

Re: It’s time to stop using SMS for security

#79

Post by elcomet »

mysterydip wrote: post #62
sildur wrote: post #61

Earlier quoted context omitted.

The hatred is because it costs 16 dollars to take over a number: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

Even easier are the sites that do this: "Please enter the phone number where we should send your one-time 2FA code: [_______]" I've had that happen on more than one site. Surely anyone who stole my password would just put in their own number?

They would surely compare the number to the one they have registered, right ?

Re: It’s time to stop using SMS for security

#80

Post by _trampeltier »

bawolff wrote: post #16
slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

I dont think this is a one sided debate. Pro: SMS 2FA is better than just passwords. In practise 2FA is primarily a hedge against credential surfing, with its other security properties more theoretical than practical, and it mostly works good enough for that use case. (Perfect is the enemy of good) Con: there's lots of attacks related to social engineering the telecom into transfering your phone number. Real people h…

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.
Post reply on HN