Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

71–80 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#71

Post by dheera »

modeless wrote: post #46
dheera wrote: post #35

Earlier quoted context omitted.

We should support the rural lifestyle choice. For one, the food you eat comes from there.

Food doesn't come from remote mountainous areas. Farm fields may not have cell service but living way out there isn't required even for farmers. I grew up on a farm so it's funny when people on the internet try to educate me about farms as if I've never heard of them.

We should still be supportive of people who want to live in the mountains. I'd like to think that we as a society enable people to live how they want to live. Given that technology has allowed us to deploy broadband internet access pretty much anywhere, there is no good reason to deny them of e.g. web-based banking just because of some stupid SMS confirmation. Hardware 2FA keys are cryptographically superior AND usable by people in the mountains.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#72

Post by bityard »

declan_roberts wrote: post #36

At this point it's pretty clear 2FA SMS is just a ploy to get PII customer data under the guise of security

The ONLY accounts I have that require SMS and offer no other 2FA are financial institutions. They already have more information on their customers than most other businesses I can think of. Heck, I WANT my bank to have my phone number so they can call me if there's ever a problem. I just want insecure SMS to stop being the only minor hurdle between a fraudster and my life savings.

Companies do SMS because their VP of security compliance demands 2FA and because it's easy and has mature existing third-party vendor support. No tinfoil hat needed for this one.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#73

Post by hedora »

brettanomyces wrote: post #19

TOTP are okay for some things but often regulation means each code/challenge needs to be tied to a specific action. TOTP codes typically last for 30s and mulitple actions can happen within 30s, so it's not possible to use TOTP in many cases. PUSH approval could be used instead but then you need to download an app for every service you use, which isn't very convenient. PASSKEYS offer a solution which will work on both…

> TOTP codes typically last for 30s and mulitple actions can happen within 30s

The server just needs to remember which TOTP codes have been used and to reject after the first use.

The code is no longer sensitive after it has been used, so jam it in a database that can expire tuples after a few minutes or stick it in an login audit table if you have one.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#74

Post by hocuspocus »

fullstop wrote: post #49
vbezhenar wrote: post #21

Earlier quoted context omitted.

Google Authenticator is a separate app that you need to download from Google Play. Native android solution is Google Password app which is pre-installed (at least on Pixel) and its functionality is extremely rudimentary even compared to Apple Passwords. No TOTP support there. I think that Google does not care about security for their users, because their passwords app is clearly some intern work, not something really…

Until recently, Google Authenticator codes could not be backed up or transferred to a new phone. When I replaced my Android device, I had to re-register every TOTP code that I had in Google Authenticator. This led me to Authy, and later on to Yubikey since the code is removed from my phone completely.

I'm pretty sure you could always manually export a QR code for every one of your secret keys.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#75

Post by TonyTrapp »

lxgr wrote: post #32
TonyTrapp wrote: post #26

Earlier quoted context omitted.

Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.

Are you sure that the locker has an Internet connection? Requiring Bluetooth and an Internet connection on your phone suggests that that's exactly what they removed on their side. Quite clever, if true – why pay for network connectivity if you can just piggy back on your customers'? (Nevermind those customers without a smart phone and data plan...)

> Are you sure that the locker has an Internet connection?

Let's put it like this: The old ones (with a display) definitely do, because they can send email notifications. I would be very much surprised if the new ones didn't. The main reason for requiring the app isn't connectivity to the outside world, it is that they can save money on the terminal screens, which get vandalized frequently in some areas. The internet connection is probably a fraction of the cost of replacing those touch screens every few months.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#76

Post by tlb »

vbezhenar wrote: post #59
hocuspocus wrote: post #48

Earlier quoted context omitted.

There's really no reason to use SMS 2FA for GitHub though, you can literally pick anything else.

Anything else could be lost. I can always get new SIM card for this number. I don't need to backup it and I can't accidentally delete it. That's the biggest reason for me to link phone number everywhere. I'd hate to lose access to my GitHub account.

It's also not very hard for scammers to get a SIM card for your number, unless you're using a carrier that specializes in not allowing SIM swapping attacks.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#77

Post by devoutsalsa »

arccy wrote: post #68
Ozarkian wrote: post #17

Earlier quoted context omitted.

I have been living outside the United States for twelve years. I always had problems with SMS until I got Google Fi. And that's a problem because, as the article here says, many banks insist on SMS these days. There are various services that give you a virtual number. But they always suffer from one of two problems: (1) VOIP numbers are 'blacklisted' by some banks for security reasons: they want a real cell phone num…

compared to prices for the rest of the world, you wouldn't want to use Fi for data anyway... just get a local or even "travel" esim and run with dual sims.

I’ve found that it’s easy to data-only eSIM package through an app store app such as Saily, but it’s harder to find a service that gives you a “real” phone number when traveling internationally. Any recommendations?

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#78

Post by hedora »

hkchad wrote: post #39

I have garbage cell signal in my house, was only an issue for sending/receiving large pictures/video's over iMessage, apparently those don't send over WiFi for some unknown reason as well... I called Verizon and they sent me a Fem2Cell, problem solved.

Those definitely work over wifi. iMessage strongly prefers it.

Maybe verizon is incompetent or malicious?

What happens if you’re overseas or in a cell dead spot with wifi? The latter happens to me all the time in the city.

It’s amazing how many hip “use your phone to order!” restaurants are in cell dead spots, and have set up wifi access points as a workaround.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#79

Post by BenjiWiebe »

lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

I use Wi-Fi calling on a phone only for 2FA SMS. Never had a problem with it. It was RedPocket (MVNO) with T-Mobile. Annual plan of 200MB, only a few dollars a month. No T-Mobile service here* so only SMS over Wi-Fi works. Only ever used for SMS 2FA.

*The bands acquired with the Sprint merger have service, but the cheap used phone I bought was pre-Sprint-merger and lacked those bands.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#80

Post by hocuspocus »

vbezhenar wrote: post #59
hocuspocus wrote: post #48

Earlier quoted context omitted.

There's really no reason to use SMS 2FA for GitHub though, you can literally pick anything else.

Anything else could be lost. I can always get new SIM card for this number. I don't need to backup it and I can't accidentally delete it. That's the biggest reason for me to link phone number everywhere. I'd hate to lose access to my GitHub account.

I don't see how I could simultaneously lose my three hardware keys (laptop, phone and Yubikey) and backup codes.
Post reply on HN