Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

11–20 of 323 posts

Re: Second factor SMS: Worse than its reputation

#11

Post by sleepyhead »

slow_typist wrote: post #4
F30 wrote: post #3

"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."

Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).

We at MakePlans were affected by this breach as we use Twilio. We are not using Twilio Verify (their 2FA api) but rather handle 2FA SMS ourselves in our app using Twilio as one of our providers. So the CCC definition of this being only 2FA-SMS is incorrect, it was all SMS sent through this Twilio third party gateway that was exposed to a limited set of countries (France, Italy, Burkina Faso, Ivory Coast, and Gambia).

GDPR is not necessary applicable here. An SMS gateway is most likely classified as a telecom carrier, and thus any local telco laws would be applicable and not GDPR. That applies only to the transfer of the SMS though, so for example a customer GUI of sent SMS would be out of that scope.

(And before someone tells us that SMS 2FA is insecure I would like to point out that we use this for verification purposes in our booking system when a customer makes a booking. So for end-customers, not for users. It is a chosen strategy for making verification easy as alternatives are too complex for many consumers. All users however authenticate with email and password, and have the option of adding TOTP 2FA).

Re: Second factor SMS: Worse than its reputation

#12

Post by stavros »

kkfx wrote: post #6

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope…

We do do that, it's WebAuthn/passkeys.

Re: Second factor SMS: Worse than its reputation

#13

Post by sleepyhead »

Apparently the messages on the S3 bucket were updated every five minutes: https://www.zeit.de/digital/datenschutz/2024-07/it-sicherhei...

The CCC definition of this being only 2FA-SMS is incorrect though. It was not only Twilio Verify (2FA API) that was affected, it was all SMS sent through this vendor.

Re: Second factor SMS: Worse than its reputation

#15

Post by commandersaki »

buccal wrote: post #10
worksonmine wrote: post #7

Earlier quoted context omitted.

Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.

NFC/RFID in many mobile devices allows for interfacing smart cards very similarly to wired connection.

Yeah but it's a tradeoff in usability, that's an accessory that needs to be provisioned and carried around.

Re: Second factor SMS: Worse than its reputation

#17

Post by stavros »

lmz wrote: post #5
slow_typist wrote: post #4

Earlier quoted context omitted.

Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).

> most of them should be able to build their own service. Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.

No, the hard part is having to secure all these little random services that I've now built. Why would I not just pay for someone whose job it was to worry about this instead?

Re: Second factor SMS: Worse than its reputation

#19

Post by kkfx »

commandersaki wrote: post #15
buccal wrote: post #10

Earlier quoted context omitted.

NFC/RFID in many mobile devices allows for interfacing smart cards very similarly to wired connection.

Yeah but it's a tradeoff in usability, that's an accessory that needs to be provisioned and carried around.

How many have a smartphone with a cover able to hold cards? How many have wallet in their pockets? Where the trade off in usability? Having a sole pin and a card to access various services instead of passwords and copypasting OTP or something similar with crappy and dysfunctional apps.

Re: Second factor SMS: Worse than its reputation

#20

Post by kkfx »

Hamuko wrote: post #8
worksonmine wrote: post #7

Earlier quoted context omitted.

Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.

You can use Yubikeys, which are basically the modern and better version of "smart cards", on phones and tablets just fine. I have a Yubico Security Key on my keychain and I can use it on my iPhone with NFC or with my iPad using USB-C.

You need it. While your bank already gives you (typically) a card you can also use as is for auth for them. Your country probably have some e-documents already, no need for extras to authenticate the public sector services and so on.

The point is offering something already usable and gives people a habit on that. After we might add yubi for generic services like GMail and so on.

Post reply on HN