Tell HN: SMS-based two-factor authentication is not secure • Hacker News Board

Re: Tell HN: SMS-based two-factor authentication is not secure

#111

Post by tinus_hn » Wed, Jun 09, 2021, 4:28 PM UTC

cik wrote: post #73

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

Exactly this. Here in Israel, SMS is used extensively as part of a multi-factor authentication system. I also require my National ID. To move my phone number (consent or not) between any phone companies requires an SMS, my National ID, and verification of my ID, and personal details in the government database. SMS by itself is not secure.

You can’t control some random guy in a provider store giving out a new sim for your account, whether maliciously or because they were deceived.

Re: Tell HN: SMS-based two-factor authentication is not secure

#112

Post by vinay_ys » Wed, Jun 09, 2021, 4:29 PM UTC

One of the protections enforced in my country is this – for 24 hours after mobile number porting, all incoming/outgoing sms are blocked. And on both the current sim and new sim, notification sms are sent to inform the user that mobile number migration is occurring. This gives you the opportunity to notice and put a stop to it if it was triggered fraudulently. But of course there are corner-cases to this. If you are personally targeted in the meatspace, then all bets are off.

Re: Tell HN: SMS-based two-factor authentication is not secure

#113

Post by chris_st » Wed, Jun 09, 2021, 4:30 PM UTC

GhostVII wrote: post #68

chris_st wrote: post #13

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Unless they are requiring everyone to use 2FA, isn't that objectively worse than having the option of SMS 2FA? I'm sure there are a significant number of people who would just switch back to using a password instead of SMS 2FA rather than having to get a non-SMS second factor, since it is much less convenient than just putting in a phone number.

Well... I think that if they don't require 2FA, then, well, they don't require 2FA, and not having SMS is neither worse nor better.

If they do require it, then I believe the consensus is that 2FA via SMS is a very bad choice. And since Google Authenticator (and other such apps) are free to download and use, it's not really a burden.

Re: Tell HN: SMS-based two-factor authentication is not secure

#114

Post by chris_st » Wed, Jun 09, 2021, 4:32 PM UTC

ncphil wrote: post #33

chris_st wrote: post #13

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Yep. They've been planning that for awhile, hopefully a case of "leading by example". For me hardware keys (U2F) with TOTP as a backup are really essential. I've purged SMS where I can. Unfortunately, too many (like banks) have stopped at SMS and email as options -- and that only recently. My (insert name of wildly popular open source password manager here) vault is secured by U2F with TOTP as a fallback, and I use i…

For whatever it's worth, the US government has shown itself to be spectacularly bad at keeping secrets (proof left as an exercise for the reader).

Re: Tell HN: SMS-based two-factor authentication is not secure

#115

Post by robomartin » Wed, Jun 09, 2021, 4:34 PM UTC

I had to go look for how people might be able to hijack the SMS system. This led to [0], which was discussed on HN about three months ago [1].

Interesting, yet an attacker would have to spend some amount of money per attempt. Unless they are targeting high value individuals this does not seem a likely threat for the average person.

Other methods exist, such as SIM-jacking [2]. I wish the article included a list of phones that might be vulnerable to this attack. Are iPhone's vulnerable?

And yet, while "free" this still requires a massive automated net to be deployed in order to gain some information and then socially engineer your way into gaining access to sites and services that might be of value.

I guess my question is: How common are these attacks? What's the scale of the activity? I have never heard of anyone in my immediate and even extended circles having any such issues. OK, I have indoctrinated most of my family into not clicking links in SMS messages and most of my extended circles are technically savvy. What does this look like in the general population?

[0] https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... [1] https://news.ycombinator.com/item?id=26468892 [2] https://medium.com/auedbaki/how-hackers-hack-phone-using-sms...

Re: Tell HN: SMS-based two-factor authentication is not secure

#116

Post by 3np » Wed, Jun 09, 2021, 4:40 PM UTC

What really grinds my gears is the seemingly unstoppable global transition towards SMS to a mobile phone number as means of identifying an individual, conflated with "security" through 2FA/account recovery, with this as the only option.

This is especially popular within Fintech.

Wise (formerly Transferwise) recently started requiring 2FA for signing in - SMS is the one and only option. Revolut requires it for acknowledging transactions and changing/viewing debit card info.

That legacy banks do this is expected, but I'm really concerned about this trend among newer global and big actors who otherwise present themselves as modern.

I strongly urge other users here to reach out to customer support of these companies and request them to supplement this with some other more secure means of 2FA, such as TOTP (hey, we gotta take what we can get), U2F, or Webauthn.

Re: Tell HN: SMS-based two-factor authentication is not secure

#117

Post by sfteus » Wed, Jun 09, 2021, 4:43 PM UTC

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

I've posted before on here about my experience getting SIM swapped and how quickly someone was able to gain access to a bunch of my accounts. If I hadn't been at home and looking at my phone while it was happening, it could have been much worse, but thankfully I was able to get in and terminate most of their login sessions before too much damage was done.

The one thing I distinctly remember was two of my GMail accounts starting the recovery process. Thankfully, that process apparently gives either 14 or 30 days to stop the recovery and secure my own account. Had I not been connected, that may have been my only saving grace, as I was able to secure those accounts and subsequently use them to recover other compromised accounts.

The larger lesson for me was to always use TOTP tokens where possible over SMS, and to completely disable SMS recovery for accounts that didn't have a delay on SMS-only recovery.

Re: Tell HN: SMS-based two-factor authentication is not secure

#118

Post by withinboredom » Wed, Jun 09, 2021, 4:44 PM UTC

StavrosK wrote: post #15

staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Not only that, but you can remove the username too : WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.

But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.

Re: Tell HN: SMS-based two-factor authentication is not secure

#119

Post by bouke » Wed, Jun 09, 2021, 4:44 PM UTC

chris_st wrote: post #13

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Not sure if the yay is sarcasm. Heroku will remove existing SMS as second factor from all accounts, effectively making those accounts less secure. Yay Heroku! (Sarcasm intended)

Re: Tell HN: SMS-based two-factor authentication is not secure

#120

Post by bouke » Wed, Jun 09, 2021, 4:46 PM UTC

ncphil wrote: post #33

chris_st wrote: post #13

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Yep. They've been planning that for awhile, hopefully a case of "leading by example". For me hardware keys (U2F) with TOTP as a backup are really essential. I've purged SMS where I can. Unfortunately, too many (like banks) have stopped at SMS and email as options -- and that only recently. My (insert name of wildly popular open source password manager here) vault is secured by U2F with TOTP as a fallback, and I use i…

Making existing accounts less secure by removing a second factor is not “leading by example” in my book. Just make me pick a different second factor on my next sign-in.