Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s time to stop using SMS for security

lucky225.medium.com

Post reply on HN
Print view View original

121–130 of 149 posts

Re: It’s time to stop using SMS for security

#121

Post by alanfranz »

whatastory wrote: post #92
elcomet wrote: post #79

Earlier quoted context omitted.

They would surely compare the number to the one they have registered, right ?

Google oftentimes doesn't. One of my accounts requires a phone number to verify every single time I login. I have no clue why, and it accepts absolutely any phone number. I have no clue what the purpose is aside from forcing me to give sensitive information to other people when my phone isn't available or I'm traveling (which I've been forced to do already).

You didn’t set a 2fa in that account. So they ask for a phone number to correlate the login.

Re: It’s time to stop using SMS for security

#122

Post by yabones »

ddevault wrote: post #104
tony0x02 wrote: post #103

Earlier quoted context omitted.

Why?

https://l.sr.ht/XhOm.png If you actually want people to read your content, then don't put it on Medium. Not to mention that it's bloated as hell, requires JavaScript, burns batteries on mobile devices, and is full of loathesome spyware software.

Agree. It's also one of the annoying websites that breaks scrolling with yet more javascript crap. It's a lot of cruft for a text-with-images page that hasn't changed conceptually since 1995.

Re: It’s time to stop using SMS for security

#124

Post by heroprotagonist »

corty wrote: post #68
heroprotagonist wrote: post #60

Earlier quoted context omitted.

Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app. Like Microsoft Authenticator. It wanted way too many permissions on my phone, and provided less security than my Yubikey authenticator. My yubikey provides a standard open OTP but requires the device to generate it (phone tap or plugin via USB to computer or phone). Open standards are better. I don't want a d…

Microsoft Authenticator can be replaced by any app that does standard OTP, e.g. FreeOTP+.

Oh nice, I just checked my account and it has the option now. It didn't when I last looked a couple years ago. I'm glad they added this.

Thanks for the heads up!

Still, the principle stands for a number of other sites. eg, Steam (using their app or email), Twitch (authy or bust), etc. I'd rather use an open standard than be limited to a custom or specific authenticator.

Re: It’s time to stop using SMS for security

#125

Post by mooreds »

slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

I wrote up a long article on a number of ways to do MFA. https://fusionauth.io/learn/expert-advice/authentication/mul...

In looking around, a few things became clear:

   * the tech industry hates SMS
   * there are some common social engineering and a few network level attacks that SMS allows
   * it's widely deployed and supported
   * it's a heck of a lot better than nothing
I think the title of the original article is a bit absurd. That's like saying "It's time to stop using passwords for security." Sure, you can say that, but your grandma will still have a sticky note of passwords next to her computer.

Defense in depth without relying entirely on the user to secure their systems makes a lot of sense to me.

Ban SMS if you aren't worried about adoption of MFA (for example, because you are a corporation and can mandate TOTP). Otherwise find ways to work with it.

Re: It’s time to stop using SMS for security

#126

Post by bawolff »

akvadrako wrote: post #25
bawolff wrote: post #18

Earlier quoted context omitted.

Email is much worse than SMS.

It could be better if the sender's SMTP server forced the use of TLS. Most emails are now sent encrypted but it isn't usually enforced. If your control your own receiving server then it would be hard for someone to intercept the message.

That's not why its bad.

Its bad because 85% of the usecase of 2fa is people using bad passwords. If you use a bad password in one place, you probably are also doing so on your email.

Re: It’s time to stop using SMS for security

#127

Post by bawolff »

PeterisP wrote: post #116
bawolff wrote: post #16

Earlier quoted context omitted.

I dont think this is a one sided debate. Pro: SMS 2FA is better than just passwords. In practise 2FA is primarily a hedge against credential surfing, with its other security properties more theoretical than practical, and it mostly works good enough for that use case. (Perfect is the enemy of good) Con: there's lots of attacks related to social engineering the telecom into transfering your phone number. Real people h…

While a password+SMS 2FA would be better than just password, the problem is that SMS often gets also turned into a single-factor password recovery mechanism; and SMS alone is worse security-wise than a decent password.

Well that's not 2fa. That is just 1fa.

Re: It’s time to stop using SMS for security

#128

Post by hlandau »

ClumsyPilot wrote: post #101
_trampeltier wrote: post #80

Earlier quoted context omitted.

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.

So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.

"Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear.

By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is.

Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox can only be accessed by me over an SSH tunnel is truly laughable. In fact since sites which demand phone numbers seem to have some completely baseless idea that the phone number is somehow more "secure" than email, often adding a phone number will enable phone number-based recovery methods which therefore actually reduce account security.

Re: It’s time to stop using SMS for security

#129

Post by glitchc »

superasn wrote: post #89
chrismorgan wrote: post #58

Earlier quoted context omitted.

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn…

> has required me to contact my parents to turn on and check the old phone I left with them Why didn't you use a sms to email forwarding app on a phone connected to a charger? They are free on play store and work really well.

That’s a horrendous hack. The security provisions of immediacy and liveness offered by SMS 2FA are rendered moot.

That one needs to do this to work around the limitations solidifies in my mind that SMS is a poor 2FA solution and should be discontinued.

Re: It’s time to stop using SMS for security

#130

Post by mindslight »

glitchc wrote: post #129
superasn wrote: post #89

Earlier quoted context omitted.

> has required me to contact my parents to turn on and check the old phone I left with them Why didn't you use a sms to email forwarding app on a phone connected to a charger? They are free on play store and work really well.

That’s a horrendous hack. The security provisions of immediacy and liveness offered by SMS 2FA are rendered moot. That one needs to do this to work around the limitations solidifies in my mind that SMS is a poor 2FA solution and should be discontinued.

I'm surprised to see people here treating SMS "2FA" as anything but some snake oil annoyance to be worked around. I setup mine to go to a VOIP number where texts show up in email. I have plans to write something that looks for these messages and spits the code to a terminal or XMPP. My goal is to get that code into my paste buffer as quickly as possible.

If you're using a password manager and have a security model that includes trusting your own computer, you really don't want the snake oil. In fact with US bank accounts, "2FA" steps make your account less secure, because the security of your bank account ultimately relies on checking your transactions every 30 days - anything that gets in the way of easily logging in undermines that.

Post reply on HN