Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 291 posts

Tell HN: SMS-based two-factor authentication is not secure

#1

Post by Zolt »

SMS-based Two-Factor Authentication is not Secure. I’ve read this before but brushed it off. It wouldn’t happen to me. It did.

I am with Boost Mobile. On Sunday night I received a text message that my PIN was changed. Within minutes I confirmed this to be true on my PC. I used the Boost application on my phone to change the PIN and received a confirmation text.

A few minute later I received a text message welcoming me to Metro PCS.

A few minute later I received emails to my business email that my account security information was deleted from my person email account. They used SMS authentication to my mobile number, that they now have control of to gain access.

A few minutes later I received an email there was an account recovery attempt on my coinbase.com account.

It took less than 30 minutes for these events to transpire.

I've spent about 15 hours trying to get my phone number and my email address back to my control.

I've accumulated a list of eight other people in the Boost Mobile Reddit.com forum where the exact same thing happened to them.

I filed a police report and filed a report with the FCC. I received a response from the FCC that they have started the inquiry and contacted Boost.

I finally did get my cell phone number ported back to Boost. I have not gained control of my Microsoft email address.

I didn’t realize I could only have messages of 2,000 characters. So I will wrap this up.

When account settings were changed, Coinbase gave me a link to lock my account, Microsoft gave me a link to log in to my account, which I no longer have control of.

Unlike competitors, which allow pins from 6 to 15 characters and for accounts to be administrative locked, Boost offers none of these options. The last Boost operator suggested I pick a more secure PIN.

I am calculating my losses and documenting all interactions.

Re: Tell HN: SMS-based two-factor authentication is not secure

#2

Post by jsnell »

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor.

The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

Re: Tell HN: SMS-based two-factor authentication is not secure

#5

Post by cassianoleal »

Sorry you went through all that, and even more sorry that you'll probably be dealing with the fallout for quite some time.

I agree that SMS 2FA is not secure and a terrible idea. I've moved countries and my old mobile number has been given out to someone else. I don't even know what accounts I have might be tied to that phone number and I don't have any way to find out.

I have had friends message that person without knowing it as well. He could easily impersonate me on WhatsApp and fish for my personal info from those contacts.

Luckily, he seems to be a decent person but I not only have to trust this stranger to be honest, but also need to trust that the number stops at him or goes to another honest person if he drops it.

Phone numbers are not identity and using it for verifications of this sort is a horrible idea.

Re: Tell HN: SMS-based two-factor authentication is not secure

#6

Post by swiley »

Not only is SMS two factor authentication not secure, it weakens the security of accounts it is enabled on.

Experts know this (because it's obvious) but large companies like Google continue to insist on using it either because they like the data collection or because they're just covering their asses.

Re: Tell HN: SMS-based two-factor authentication is not secure

#7

Post by Zolt »

UncleMeat wrote: post #4

That isn't 2FA. That is a single factor recovery process. SIM-swapping only defeats SMS-based 2FA if the attacker also has your password, which is difficult to accomplish if you are using good passwords that are unique.

I had to remove this detail from my original post as it was too long:

Boost mobile is negligent and not following industry standards. Their whole security model is based on a 4-digit pin. At first I thought somebody had a script working its way up through all the combinations at the login screen, but I no longer feel that is the case. The fact that at least nine of us had this same issue within days makes me think there is a wide-spread issue here.

Re: Tell HN: SMS-based two-factor authentication is not secure

#8

Post by raesene9 »

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker.

Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the account.

TOTP or hardware tokens don't generally suffer from the same problem.

Post reply on HN