81–90 of 114 posts
Earlier quoted context omitted.
Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.
there are tons of articles here in HN that have shown that SIM swamp (at least in US) is much easier then trying to brute force (or using quantum computer) to break TOTP encryption. One of main reason for SMS is also meta data collection of your number.
Note that this software unethically phones home with your usage data without your consent. Such opt-out, on-by-default spyware exfiltrates your data silently. They claim it’s anonymous, but that’s false as it includes your client IP address, which frequently maps directly to physical location. You have to patch it out, because even if you try to turn it off, it still phones home in violation of your expressed wishes:…
If you look in the source code for this software which is provided for everyone to see you will realize that Kevin Goslar is entirely innocent of this heinous crime. He merely added the copyright headers to each file. You misunderstand the purpose of the SQA telemetry. There are some reasons for SQA telemetry listed in the doc you posted: - Be able to say how many production deployments exist. - Understand which feat…
Now and then we run our stack with mitm monitor just to sniff out this dangerous crap. More recently, we are seeing it in ML libraries. For a security vendor to do it is extra bad because they can't claim not understanding why it's bad and often illegal.
Earlier quoted context omitted.
Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.
You haven’t looked for any proof: search for sim cloning.
> In SIM cloning attack, the fraudster gains access to the victims physical SIM card and..
Same thing could be done with TOTP.
https://securityboulevard.com/2021/12/why-using-sms-authenti... SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot. What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some pho…
I discovered another reason to avoid SMS OTP: I am currently visiting India and I have put my phone in Airplane mode because my Canadian phone company , Rogers,charges $15 per day for roaming and it is simply cheaper to buy an Indian SIM card and use it on an old phone to act as a wifi hotspot for my actual phone. So while my phone is in Airplane mode, I am unable to use my RBC Visa or MasterCard for any online purch…
Earlier quoted context omitted.
Yes, but if you want large enterprise customers such as regulated financial institutions where lots of money's at stake, you will need to support SMS as a second factor, mothers' maiden names, and bypassing all that when the user has forgotten.
Interesting, in the European Union SMS token are mostly illegal for financial services, because they are not considered safe enough.
I'm sympathetic to the reasons. The U.S. has a massive population of people who for various reasons will not or cannot adopt methods other than SMS, if that.
Meanwhile you can call up some of our largest financial institutions and impersonate someone with public-record knowledge. Many organizations will allow you to skip any kind of over-the-phone SMS challenge by asking for -more- publicly available knowledge to "better"/further authenticate the caller. And of course all our Social Security Numbers are effectively all out there, and those are still the de-factor identifier where a phone number is not.
I used to do business with Vanguard. Several years ago they rolled out U2F-then-WebAuthn support so you could use a Yubikey or other FIDO2 compliant token as your MFA method. They allowed you to disable SMS MFA if you did that. I happily enabled that. Within two years, they re-introduced a requirement to enroll a number for SMS MFA on the grounds that their mobile app only supported codes delivered by SMS, and there was no opt-out. If you didn't enroll a number you'd be locked out and have to call customer service to add a number and reset your password.
Note that this software unethically phones home with your usage data without your consent. Such opt-out, on-by-default spyware exfiltrates your data silently. They claim it’s anonymous, but that’s false as it includes your client IP address, which frequently maps directly to physical location. You have to patch it out, because even if you try to turn it off, it still phones home in violation of your expressed wishes:…
Going so far as to tell you exactly what sort of harmless data they're collecting and even putting the code for doing so in a public repo, and then even letting you opt out of it.
Doesn't sound like any kind of spyware I've ever seen.
Earlier quoted context omitted.
Yes, but if you want large enterprise customers such as regulated financial institutions where lots of money's at stake, you will need to support SMS as a second factor, mothers' maiden names, and bypassing all that when the user has forgotten.
Interesting, in the European Union SMS token are mostly illegal for financial services, because they are not considered safe enough.
Earlier quoted context omitted.
The latter.
How can I someone see other's messages? Surely someone has step by step guide if it is that easy. Are you sure it was interception without SIM takeover?
There are various ways to nab an SMS. Some are similar to SIM swap attacks in that they rely on social engineering or human or process fallibility to execute [1] [2], and others can grab messages right right out of the air, so to speak [3] [4]. This is in part because one of the foundational protocols that underlie modern cellular networks was never designed with modern security in mind. It's called SS7, and it's been extensively documented as a concern to the security of cellular based communications [5] [6] [7] [8].
Lot's of references because this is an area that has long fascinated me, and I have many bookmarks. There are also some recent papers on this behind paywalls (e.g., [9]).
In between the lines and lightly touched on in some reporting is a nuanced point that I think plays a larger part - one issue is that overhauling these older foundational technologies isn't just a matter of commercial and standards changes but also moving the goal posts on where lawful interception happens in the stack, how it happens, and the technologies that support that. For example in the U.S., law enforcement agencies can acquire devices that impersonate cellular infrastructure in order to force communications to go through law enforcement controlled equipment (called IMSI catchers). If we were to revamp cellular networks with a view toward security in the way we probably should, it's reasonable that devices like that wouldn't be feasible without being operated by the telephone companies that own the networks, and that would probably become some amount of red tape that law enforcement doesn't like.
[1] https://arstechnica.com/information-technology/2021/03/16-at...
[2] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s...
[3] https://www.firstpoint-mg.com/blog/ss7-attack-guide/
[4] https://www.youtube.com/watch?v=RXBvO8TWGsw
[5] https://www.theguardian.com/technology/2016/apr/19/ss7-hack-...
[6] https://arstechnica.com/information-technology/2018/05/nefar...
[7] https://arstechnica.com/features/2019/04/fully-compromised-c...
[8] https://www.zdnet.com/article/5g-networks-could-be-vulnerabl...
[9] https://link.springer.com/article/10.1007/s11235-023-01018-0
edit: formatting
https://securityboulevard.com/2021/12/why-using-sms-authenti... SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot. What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some pho…
I discovered another reason to avoid SMS OTP: I am currently visiting India and I have put my phone in Airplane mode because my Canadian phone company , Rogers,charges $15 per day for roaming and it is simply cheaper to buy an Indian SIM card and use it on an old phone to act as a wifi hotspot for my actual phone. So while my phone is in Airplane mode, I am unable to use my RBC Visa or MasterCard for any online purch…
Earlier quoted context omitted.
It doesn't "add" security, it "adds" an account takeover path.
How is a second factor adding an "account takeover path"? You're not seriously saying that adding a second factor is reducing security? We can agree that password reset via SMS token is bad. It basically reduces everything to one factor login via SMS.
And as to "You're not seriously saying that adding a second factor is reducing security?" -- yes I am, when it's not a second factor, it's implemented as an "only factor".
To that point, btw, I'd linked to your other reply about resets from a couple of mine: https://news.ycombinator.com/item?id=39467039
* Note: And by "as implemented almost everywhere", I mean so indistinguishable from everywhere that that effectively boils down to "SMS is bad", much easier for users and builders to understand, when better options are available.