Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is using SMS bad for 2FA?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: Why is using SMS bad for 2FA?

#11

Post by CogitoCogito »

LinuxBender wrote: post #7

SMS is not a great form of MFA but in many cases it is the only option and better than nothing assuming it was implemented correctly, being one of multiple factors and is not a stand-alone factor. Someone will suggest U2F, but most financial institutions don't even know what that is much less have any plans to support it. This will sound negative, but sadly my login to a video game is more secure than my login to a b…

> SMS is not a great form of MFA but in many cases it is the only option…

Email?

Re: Why is using SMS bad for 2FA?

#12

Post by LinuxBender »

CogitoCogito wrote: post #11
LinuxBender wrote: post #7

SMS is not a great form of MFA but in many cases it is the only option and better than nothing assuming it was implemented correctly, being one of multiple factors and is not a stand-alone factor. Someone will suggest U2F, but most financial institutions don't even know what that is much less have any plans to support it. This will sound negative, but sadly my login to a video game is more secure than my login to a b…

> SMS is not a great form of MFA but in many cases it is the only option… Email?

Valve and a few other gaming companies will use email. I have seen one financial institution use email as well. SMS seems to be more widely adopted. I should clarify and mention when I say only option, I mean for the end-user. Companies could in theory implement anything if they prioritized it.

Re: Why is using SMS bad for 2FA?

#13

Post by CogitoCogito »

LinuxBender wrote: post #12
CogitoCogito wrote: post #11

Earlier quoted context omitted.

> SMS is not a great form of MFA but in many cases it is the only option… Email?

Valve and a few other gaming companies will use email. I have seen one financial institution use email as well. SMS seems to be more widely adopted. I should clarify and mention when I say only option, I mean for the end-user. Companies could in theory implement anything if they prioritized it.

In my personal experience, email is often accepted. But that wasn’t my point. You said SMS is often the only option, but I don’t see why companies couldn’t support email as well.

Edit: I guess my point is that since this post is essentially asking what should be prioritized, I think that companies should prioritize providing email as an option if they provide SMS.

Re: Why is using SMS bad for 2FA?

#14

Post by LinuxBender »

CogitoCogito wrote: post #13
LinuxBender wrote: post #12

Earlier quoted context omitted.

Valve and a few other gaming companies will use email. I have seen one financial institution use email as well. SMS seems to be more widely adopted. I should clarify and mention when I say only option, I mean for the end-user. Companies could in theory implement anything if they prioritized it.

In my personal experience, email is often accepted. But that wasn’t my point. You said SMS is often the only option, but I don’t see why companies couldn’t support email as well. Edit: I guess my point is that since this post is essentially asking what should be prioritized, I think that companies should prioritize providing email as an option if they provide SMS.

Agreed. I can add TLS checks on my mail server to validate where mail is coming from for specific domains. I would love to see more companies support this option.

Re: Why is using SMS bad for 2FA?

#15

Post by PranavBerry »

LinuxBender wrote: post #10
PranavBerry wrote: post #9

Earlier quoted context omitted.

>As for QR codes, those can be copied The QR code are unique for every login attempt. After you scan the QR code and enter your phone's pin, my authenticator will send a request to my server. If everything is ok you will be logged in. Sorry I did not get what you mean by this? Do you mean that someone could copy and use the same QR again? >I will never use digital face/touch ID for anything I do not save any biometri…

Do you mean that someone could copy and use the same QR again? A person intercepting traffic or spoofing a site can copy/tamper/replace the QR code just as they can plain text or binary blobs. QR is just a presentation structure that makes it easier for a camera to translate something into data. For this to be useful there would have to be a boot-strapped chain of custody and chain of trust already installed on the d…

>intercepting traffic or spoofing a site can copy/tamper/replace the QR code

Will this be a problem with HTTPS?

When you open a page, a request will be made to my server to generate a unique login attempt, the id of this unique login attempt will be shown in the QR code. When you scan it and enter your phone's pin, my authenticator generates a signature of the login attempt id, your username on that website and the current time. My server verifies the signature and logs you in if everything is ok.

Have you logged in to the Discord/Reddit/Whatsapp websites by scanning the QR code shown there from their mobile app? My concept is the same but using my authenticator app, websites which do not have a native app can also offer a QR code login.

Re: Why is using SMS bad for 2FA?

#16

Post by PranavBerry »

Rafert wrote: post #8

You might want to look into what the FIDO Alliance is doing with WebAuthn. The problem is already being solved.

> FIDO Alliance is doing with WebAuthn

Yes I looked into it, but it looks like WebAuthn does not support multiple devices (let me know if I am wrong).

What if I want to login from two different devices? I don't think that is possible with WebAuthn, but using my authenticator you can login to multiple devices. You will also be able to add a recovery email address to my authenticator to recover your accounts if you phone gets damaged/lost.

Re: Why is using SMS bad for 2FA?

#17

Post by LinuxBender »

PranavBerry wrote: post #15
LinuxBender wrote: post #10

Earlier quoted context omitted.

Do you mean that someone could copy and use the same QR again? A person intercepting traffic or spoofing a site can copy/tamper/replace the QR code just as they can plain text or binary blobs. QR is just a presentation structure that makes it easier for a camera to translate something into data. For this to be useful there would have to be a boot-strapped chain of custody and chain of trust already installed on the d…

>intercepting traffic or spoofing a site can copy/tamper/replace the QR code Will this be a problem with HTTPS? When you open a page, a request will be made to my server to generate a unique login attempt, the id of this unique login attempt will be shown in the QR code. When you scan it and enter your phone's pin, my authenticator generates a signature of the login attempt id, your username on that website and the c…

I've seen people use QR with those sites and it doesn't make sense to me. So using a bank as example, I barely trust them to get this right. Now I am inserting your company into the chain of trust? Why am I trusting one more party to get all of this right? Or is this a solution you are selling to each vendor and they are implementing your service on prem? Is your service going to be audited by independent third parties that vendors choose? How do people verify that your application is the legitimate version? How does the bank know if someone has tampered with your application? Why is my bank trusting your application?

Re: Why is using SMS bad for 2FA?

#18

Post by [deleted] »

LinuxBender wrote: post #10
PranavBerry wrote: post #9

Earlier quoted context omitted.

>As for QR codes, those can be copied The QR code are unique for every login attempt. After you scan the QR code and enter your phone's pin, my authenticator will send a request to my server. If everything is ok you will be logged in. Sorry I did not get what you mean by this? Do you mean that someone could copy and use the same QR again? >I will never use digital face/touch ID for anything I do not save any biometri…

Do you mean that someone could copy and use the same QR again? A person intercepting traffic or spoofing a site can copy/tamper/replace the QR code just as they can plain text or binary blobs. QR is just a presentation structure that makes it easier for a camera to translate something into data. For this to be useful there would have to be a boot-strapped chain of custody and chain of trust already installed on the d…

[deleted]

Re: Why is using SMS bad for 2FA?

#19

Post by PranavBerry »

LinuxBender wrote: post #17
PranavBerry wrote: post #15

Earlier quoted context omitted.

>intercepting traffic or spoofing a site can copy/tamper/replace the QR code Will this be a problem with HTTPS? When you open a page, a request will be made to my server to generate a unique login attempt, the id of this unique login attempt will be shown in the QR code. When you scan it and enter your phone's pin, my authenticator generates a signature of the login attempt id, your username on that website and the c…

I've seen people use QR with those sites and it doesn't make sense to me. So using a bank as example, I barely trust them to get this right. Now I am inserting your company into the chain of trust? Why am I trusting one more party to get all of this right? Or is this a solution you are selling to each vendor and they are implementing your service on prem? Is your service going to be audited by independent third parti…

>Is your service going to be audited by independent third parties that vendors choose?

Yes I am planning to do that.

>How do people verify that your application is the legitimate version? How does the bank know if someone has tampered with your application?

I will use SafetyNet to check that the device is not rooted/jailbroken and that the signature is being made from my app.

Re: Why is using SMS bad for 2FA?

#20

Post by ViViDboarder »

PranavBerry wrote: post #16
Rafert wrote: post #8

You might want to look into what the FIDO Alliance is doing with WebAuthn. The problem is already being solved.

> FIDO Alliance is doing with WebAuthn Yes I looked into it, but it looks like WebAuthn does not support multiple devices (let me know if I am wrong). What if I want to login from two different devices? I don't think that is possible with WebAuthn, but using my authenticator you can login to multiple devices. You will also be able to add a recovery email address to my authenticator to recover your accounts if you pho…

Yes it is. I can plug my Yubikey into as many laptops as I would like.

> You will also be able to add a recovery email address to my authenticator to recover your accounts if you phone gets damaged/lost.

This worries me. That means I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy. All my 2FA is on my Yubikey.

Post reply on HN