Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s time to stop using SMS for security

lucky225.medium.com

Post reply on HN
Print view View original

101–110 of 149 posts

Re: It’s time to stop using SMS for security

#101

Post by ClumsyPilot »

_trampeltier wrote: post #80
bawolff wrote: post #16

Earlier quoted context omitted.

I dont think this is a one sided debate. Pro: SMS 2FA is better than just passwords. In practise 2FA is primarily a hedge against credential surfing, with its other security properties more theoretical than practical, and it mostly works good enough for that use case. (Perfect is the enemy of good) Con: there's lots of attacks related to social engineering the telecom into transfering your phone number. Real people h…

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.

So don't allow password reset over SMS.

Email is hardly beter than sms, and we do password resets over email.

Re: It’s time to stop using SMS for security

#102

Post by ClumsyPilot »

Andrew_nenakhov wrote: post #39
slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

In russia it is common for authorities to temporary switch phone to another sim card, then switch it back without user even noticing it. This method was widely used to target dissidents and access their accounts. To sum it, 2fa via sms gives only an illusion of safety.

I think thats a different threat level, an app that manages shopping coupons doesnt need to worry about russian government taking their "10% off" code

Re: It’s time to stop using SMS for security

#104

Post by ddevault »

tony0x02 wrote: post #103
ddevault wrote: post #99

For the love of God, stop using Medium. I don't understand how authors don't know better by now.

Why?

https://l.sr.ht/XhOm.png

If you actually want people to read your content, then don't put it on Medium. Not to mention that it's bloated as hell, requires JavaScript, burns batteries on mobile devices, and is full of loathesome spyware software.

Re: It’s time to stop using SMS for security

#105

Post by ydant »

the_duke wrote: post #100
quicklime wrote: post #28

Earlier quoted context omitted.

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to…

Why don't you just get a dedicated "virtual" phone number for this purpose? It's not expensive. Skype is an obvious choice, but there are many other providers. Then you have a stable number and can read SMS via app web UI. I switched to the same method a few years ago. It's useful even if you don't travel much, just to not tie 2FA to your phone and for not giving all those services your real number.

I have two virtual (US) numbers - one through Twilio (which I've enable short-code receive support for), and one on Google Voice.

Both have failed to receive 2-factor messages from providers over the years. Very occasionally the Google Voice number is blocked explicitly by the provider as a VOIP number. It's just not a reliable 100% replacement for "real" SMS in my experience.

Google Voice is close to acceptable as a replacement, and it's my primary 2-factor number when it works, but it's not 100% for reasons outside of my control.

Re: It’s time to stop using SMS for security

#106

Post by dkersten »

slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

SMS is not at all secure. My first out-of-uni programming job was working on SMS value-add services for mobile networks (mostly anti-spam, anti-fraud, anti-spoofing type stuff and roam steering, but also parental controls and other stuff). It was crazy what weird things we could bend the network to. Obviously, our services ran on the network itself, so had more access than a typical end user, but the protocols have zero built in security, everything on the network was totally open, spoofing is trivial (we could detect much of it with our software, but definitely not all -- mostly all we could do was consistency checks, but if you carefully crafted a fake packet, there's nothing we could do). As others have stated, the over-the-air encryption is often.. not good.. so getting access SMS like we had seems very possible. And since its not end-to-end encrypted, a bad actor within the network could also trivially access messages (we could! we even intercepted some of our own messages for testing, it would have been a simple regex to read other people's messages).

This was ~15 years ago, but I doubt much has changed.

Re: It’s time to stop using SMS for security

#107

Post by sleepyhead »

nottorp wrote: post #97
dgellow wrote: post #19

Living in Germany, I don't remember the last time I used an SMS. When I was in south-east Asia I don't think I ever used SMS, it was always Line (or WeChat in China) or email. Is there a reason SMS are so much in use in the US but not in other parts of the world?

Tbh I haven't heard of SMS hijacking in Europe either. Is this an american thing, like SSN identity theft? Or checks... let's not forget checks...

I assume it is a lot easier in the US. Here in Norway it is still possible as well though, there was a media showcase about it a few years ago. But that is mostly due to lack of security measures by the telco (we have a national auth method that could be used).

Re: It’s time to stop using SMS for security

#108

Post by javier123454321 »

ACS_Solver wrote: post #67
dgellow wrote: post #19

Living in Germany, I don't remember the last time I used an SMS. When I was in south-east Asia I don't think I ever used SMS, it was always Line (or WeChat in China) or email. Is there a reason SMS are so much in use in the US but not in other parts of the world?

The good thing about SMS is that it's standard. I live in Sweden, just about everyone has a smartphone. SMS is still common for things like package delivery notifications or other service notifications, SMS is still an option for many transport tickets, though being phased out in favor of app solutions. SMS works whether you're on iOS or Android, it works for the few users of classic phones, it works if you don't cur…

Yeah honestly, it's a shame that every one of these services (whatsapp, signal, telegram, ...) dont operate on a protocol like smtp. Its completely unnecessary to recreate a chat protocol every time it gets implemented. Here we are though, and exactly the thing you are expecting is happening, several competitors that don't interact with each other so even if I want to delete WhatsApp, I still keep it to reach family and friends elsewhere.

Re: It’s time to stop using SMS for security

#109

Post by jiggawatts »

pentae wrote: post #59
quicklime wrote: post #28

Earlier quoted context omitted.

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to…

Unfortunately, the only remedy to this i've found is to travel like james bond with two cell phones. I keep a second android phone with my 'back home' sim on the cheapest monthly plan possible and only turn it on to read sms codes. It really comes in handy when needing to sign up to a new service in your home country while abroad. Just don't forget to keep data roaming turned off

Newer phones have a second virtual e-SIM slot. Very handy when you're travelling. You set up your normal number on the e-SIM, and then you buy a data-only phyiscal SIM at the airport.

Re: It’s time to stop using SMS for security

#110

Post by GhostVII »

sodality2 wrote: post #86
GhostVII wrote: post #84

Earlier quoted context omitted.

This is why I switched over to a VOIP number instead. SMS works everywhere I have internet, and if I have to I just pick up a data-only sim card for wherever I am. Can even check my messages online. Probably not as secure, and wouldn't work well if I was regularly calling people, but for the most part it works fine and costs $1 a month.

$1/mo? Which provider is that? Twilio?

Voip.ms
Post reply on HN