Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

41–50 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#41
If cell service is available in at least one area of the property, you could have a dedicated sim for receiving SMS 2FA and use a 4G router to forward the SMS to an email, e.g. Teltonika have this functionality [1].

The 4G router also has the benefit of being able to use externally mounted antennas. Which might help in low signal areas.

Not ideal, but might at least be a solution for some people.

[1]: https://wiki.teltonika-networks.com/view/SMS_Forwarding_Conf...

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#42

1. Download the Google Voice app. This phone number works for some but not all 2FA services. Not all, because some explicitly forbid GV numbers because they're afraid of fraud. GV can receive SMS messages over wifi. 2. Ask the cell phone company for a femtocell. These used to be called "AT&T Microcells" and they were cheap. I used one before cell service improved because I live in the mountains. But apparently AT&T d…

4. Get a USB modem and hook it up to a computer somewhere safe that has coverage, and access it via internet.

I'm building the opposite, using the modem and a Raspberry Pi to send me metrics from my cabin, but could easily work in reverse.

While prototyping I had it parse SMS messages I sent it.

Obviously not for everyone but we're on HN here...

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#43
SMS 2FA is also quite expensive. In the US it's $0.0083 per SMS, which at bulk is going to add up quickly. Even before the war started, it was $0.70 to send an SMS to Russia. And then there's the premium SMS line fraud that's led to massive bills for some companies.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#45
post #6

When you choose an eccentric lifestyle you should accept the loss of certain features.

I'm pretty sure that their mother lived there before SMS was a thing, it's not exactly eccentric. Especially in the USA. You're not seriously suggesting that she leaves her home because of poorly implemented 2FA?

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#46
post #35

Earlier quoted context omitted.

Homeless people get free smartphones and free service in the US. Living in very rural areas is in fact a lifestyle choice. Not all choices need to be subsidized.

We should support the rural lifestyle choice. For one, the food you eat comes from there.

Food doesn't come from remote mountainous areas. Farm fields may not have cell service but living way out there isn't required even for farmers. I grew up on a farm so it's funny when people on the internet try to educate me about farms as if I've never heard of them.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#47
post #12

Earlier quoted context omitted.

> When you choose an eccentric lifestyle Many "eccentric" lifestyles are not chosen. For instance not owning a smartphone or not having access to power easily is not necessarily limited to well-off tech-savv hipsters who want to make a statement, homeless people, older people in less connected areas or people in developing countries can also be in that situation. When you make your services depend on specific access,…

Homeless people get free smartphones and free service in the US. Living in very rural areas is in fact a lifestyle choice. Not all choices need to be subsidized.

[deleted]

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#48
post #7

I wonder what the companies requiring 2FA think about uncompleted 2FA bounces. Deterred fraudster? Short attention span? SMS sucks?

Every second SMS authorization does not reach my phone. Just yesterday I couldn't log in to my GitHub from new computer, because my phone did not receive authentication code. I didn't have any bans because of that. I think that a lot of people experience similar problems, so it makes no sense to look for fraudsters, 99.9999% will be false negatives.

There's really no reason to use SMS 2FA for GitHub though, you can literally pick anything else.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#49

Earlier quoted context omitted.

> I'm surprised ios and android don't have native TOTP apps (afaik). They do. Google's Authenticator is as close as it gets to a native Android app, and your secret keys are sync'ed in Google's cloud for a while now (it's a shame they waited so long). Apple's Keychain has supported TOTP for ages too. That said OTPs over RCS instead of SMS are a major improvement if you don't mind your phone number being used as an id…

Google Authenticator is a separate app that you need to download from Google Play. Native android solution is Google Password app which is pre-installed (at least on Pixel) and its functionality is extremely rudimentary even compared to Apple Passwords. No TOTP support there. I think that Google does not care about security for their users, because their passwords app is clearly some intern work, not something really…

Until recently, Google Authenticator codes could not be backed up or transferred to a new phone. When I replaced my Android device, I had to re-register every TOTP code that I had in Google Authenticator. This led me to Authy, and later on to Yubikey since the code is removed from my phone completely.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#50

If cell service is available in at least one area of the property, you could have a dedicated sim for receiving SMS 2FA and use a 4G router to forward the SMS to an email, e.g. Teltonika have this functionality [1]. The 4G router also has the benefit of being able to use externally mounted antennas. Which might help in low signal areas. Not ideal, but might at least be a solution for some people. [1]: https://wiki.te…

While that is a solution someone could use, it wouldn't work for the subject here:

> she usually doesn't even have service 100 meters down the road.

Post reply on HN