Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

1–10 of 323 posts

Re: Second factor SMS: Worse than its reputation

#4

Post by slow_typist »

F30 wrote: post #3

"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."

Look at the list of customers, most of them should be able to build their own service.

Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk.

Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).

Re: Second factor SMS: Worse than its reputation

#5

Post by lmz »

slow_typist wrote: post #4
F30 wrote: post #3

"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."

Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).

> most of them should be able to build their own service.

Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.

Re: Second factor SMS: Worse than its reputation

#6

Post by kkfx »

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives.

I hope a day or another people will understand and IMPOSE an end to such crappy unsafe practice.

Re: Second factor SMS: Worse than its reputation

#7

Post by worksonmine »

kkfx wrote: post #6

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope…

Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.

Re: Second factor SMS: Worse than its reputation

#8

Post by Hamuko »

worksonmine wrote: post #7
kkfx wrote: post #6

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope…

Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.

You can use Yubikeys, which are basically the modern and better version of "smart cards", on phones and tablets just fine. I have a Yubico Security Key on my keychain and I can use it on my iPhone with NFC or with my iPad using USB-C.

Re: Second factor SMS: Worse than its reputation

#10

Post by buccal »

worksonmine wrote: post #7
kkfx wrote: post #6

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope…

Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.

NFC/RFID in many mobile devices allows for interfacing smart cards very similarly to wired connection.
Post reply on HN