Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

61–70 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#61

Post by miki123211 »

lxgr wrote: post #30
dreamcompiler wrote: post #15

1. Download the Google Voice app. This phone number works for some but not all 2FA services. Not all, because some explicitly forbid GV numbers because they're afraid of fraud. GV can receive SMS messages over wifi. 2. Ask the cell phone company for a femtocell. These used to be called "AT&T Microcells" and they were cheap. I used one before cell service improved because I live in the mountains. But apparently AT&T d…

> Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal It can't – how would it? The only entity that can forward texts is the carrier, and I doubt that that service is integrated with all US carriers to somehow get them forwarded (which is technically quite difficult for various legacy protocol reasons). Apple's satellite messaging service is…

> Apple's satellite messaging service is the only solution I know of that can somehow hook into carriers' SMS home router

Are you sure it actually does this?

I thought it was a pseudo-carrier that could speak MAP / Diameter, and just pretended you were roaming with them when you used satellite connectivity, perhaps with the original carrier's knowledge and consent.

As far as I understand, that's how this kind of service usually gets implemented.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#62

Post by jboggan »

I remember in 2014 going to play a Bitcoin poker game at some Google VP's house way up in the hills, Charlie Lee was there. We tried to buy-in at the beginning to a pot address but no one could get their Coinbase SMS 2FA to work because we had no reception so we ended up writing IOUs on scraps of paper.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#64

Post by pyrale »

modeless wrote: post #29
pyrale wrote: post #25

Earlier quoted context omitted.

> Not all choices need to be subsidized. Interesting choice of vocabulary. You could decide not to serve people without also describing them as freeloaders in order to feel morally righteous about your choice.

People choosing to live in rural areas aren't freeloaders. Until they demand the rest of us subsidize them. The demand for subsidies is what makes a freeloader, not the lifestyle choice.

My original message was simply here to remind people that technical decisions we make have consequences on who can use our services.

You were the one introducing this vocabulary (as well as claiming everyone living there does it by choice). Now you try to move the debate again with people "demanding" stuff. None of this vocabulary or framing exists in the original article, or in mine.

Let me clarify the question: why do you insist on framing this debate in a way that makes a moral claim about people's character?

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#65

Post by marssaxman »

I had this problem a couple years back, when I was living in a small coastal town where cell service was spotty. Generally I could either be in a place where I could receive text messages, or a place where I could get access to wifi, but not both at the same time. When I wanted to get into my bank website, I would drive 20 minutes up the road to the next, slightly less small town, where I could get wifi and receive SMS, then drive back when I was done.

If I had stayed there longer, I might have found a better solution for my personal situation, but the experience as it was left me pretty uncomfortable with mandatory SMS 2FA as a general security tool. I'm sure there are many other people running into similar edge-cases.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#66

Post by unethical_ban »

jjice wrote: post #52
lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.

I absolutely cannot stand that no bank I have (US) supports generic TOTP, which is more secure and easier to recover from backup if my phone is broken or stolen.

It's inexcusable.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#67

Post by LeifCarrotson »

She just needs a microcell/femtocell.

Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 input, a little GPS antenna so the cell supports e911 location data, and it will broadcast LTE (or now 5g) cellular data.

I work at a shop with metal walls located in a river valley. It's a cellular data black hole. People used to climb the hill up the driveway to make and take calls, but various people called their ATT, Verizon, and T-Mobile providers and all three shipped us femtocells. Mow the users and the contractors/customers who come to visit can't even tell that their phones have switched to data over our ISP instead of a tower, it just works - including 2FA codes and MVNOs.

She may have to switch to first-party Verizon service instead of using an MVNO.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#68

Post by arccy »

Ozarkian wrote: post #17
modeless wrote: post #5

Google Fi can receive all SMS 2 factor messages on Wi-Fi including short codes. It doesn't even require that your phone is on, you can get them in any web browser on any device even if your phone is destroyed. One of my favorite features. You can get service starting at $20 per month. Fi used to have good service in some mountain areas too, with US Cellular. Not sure what's going on with US Cellular right now though.…

I have been living outside the United States for twelve years. I always had problems with SMS until I got Google Fi. And that's a problem because, as the article here says, many banks insist on SMS these days. There are various services that give you a virtual number. But they always suffer from one of two problems: (1) VOIP numbers are 'blacklisted' by some banks for security reasons: they want a real cell phone num…

compared to prices for the rest of the world, you wouldn't want to use Fi for data anyway... just get a local or even "travel" esim and run with dual sims.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#69

Post by devoutsalsa »

brettanomyces wrote: post #19

TOTP are okay for some things but often regulation means each code/challenge needs to be tied to a specific action. TOTP codes typically last for 30s and mulitple actions can happen within 30s, so it's not possible to use TOTP in many cases. PUSH approval could be used instead but then you need to download an app for every service you use, which isn't very convenient. PASSKEYS offer a solution which will work on both…

My personal 2FA favorite is OTP + authenticator app. It behaves predictably and doesn’t have weird failure conditions.

SMS 2FA tied to your mobile number sucks if it doesn’t support Google Voice, especially when traveling internationally and your SIM card isn’t in your phone.

Email 2FA usually works, but I just find it annoying.

App-specific push notifications mostly work, but it’s hard to debug if you don’t get the notification. For example, I recently bought a new phone and all of my apps were reinstalled when I restored from a cloud backup. For some reason app notifications didn’t work until I uninstalled & reinstalled the apps. And reinstalling the apps was a bit confusing because some of the apps were not available in the app store based on my physical location in a different country at the time.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#70

Post by brandon272 »

vanburen wrote: post #56
ethersteeds wrote: post #50

Earlier quoted context omitted.

While that is a solution someone could use, it wouldn't work for the subject here: > she usually doesn't even have service 100 meters down the road.

Yeah wont work for everyone, but a directional antenna mounted high up on house might have a better chance than a phone antenna.

The idea of mounting a directional antenna "high up" on a house (or paying someone to do it) for the purposes of receiving SMS 2FA seems wild.
Post reply on HN