Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

111–120 of 323 posts

Re: Second factor SMS: Worse than its reputation

#111

Post by dylan604 »

rafram wrote: post #70
elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!

since COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device.

I know I'm not the first person to be unable to port a number, so calling a phone number something that never changes is a bit skewed

Re: Second factor SMS: Worse than its reputation

#112

Post by DanielHB »

Sweden solved this problem years ago with BankID

https://en.wikipedia.org/wiki/BankID

It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great.

It is incredible there is no system like this for every country, heck it is incredible that there isn't a system like this for the whole EU.

Re: Second factor SMS: Worse than its reputation

#113

Post by michaelt »

bckr wrote: post #43
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank

In the past I've heard people say the opposite - that if less computer savvy people are using google instead of URLs, it's a good thing.

The reasoning was it protects them against typosquatters and whitehouse.com situations. I guess when people were giving out that advice, google wasn't the way it is now.

Re: Second factor SMS: Worse than its reputation

#114

Post by twelve40 »

2Gkashmiri wrote: post #68
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

How did entering login and 2fa do the following things. 1. Login 2. Add payee 3. Create transaction 4. Verify transaction This appears to be a banking issue where they do not try to maximize the attack surface. Sure people will try to game the system by doing phishing but its the responsibility of banks to actively make it harder

Yep. A few simple steps like an extra SMS (or email) code to add a recipient, an email notifying about the change, not perfect, but will make this harder to pull off. Not sure what is '"pay anyone" payee', i don't think it's a thing at my bank. They could try to scrape the account number though, I think in the States that may be enough to try to debit someone's account.

Re: Second factor SMS: Worse than its reputation

#115

Post by omh »

pphysch wrote: post #110
omh wrote: post #104

The article conflates two issues that have different security implications. The "1-click login" links are a concern and just having access to the SMS would be enough to take over things like WhatsApp. But 2FA codes seem notably less worrying. They are the second factor and require an attacker to have the password too. For these cases I'm much more relaxed about the use of SMS and the risks of interception.

> They are the second factor and require an attacker to have the password too. For every leaked database of SMS messages there are 1000 leaked databases of account credentials

Good point.

But what's the threat model here?

I didn't think of 2FA as being protection against password reuse. People should still avoid reusing passwords and change them if they know of a breach.

Are there really attackers who are picking up breach databases and then sim-swapping to get the 2FA as well?

Re: Second factor SMS: Worse than its reputation

#116

Post by lucianbr »

jdiez17 wrote: post #39
didntcheck wrote: post #38

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

There's always a root account, the only issue is who has access to it.

So... phones where a corporation has root are more secure that phones where the owner has root, you say? Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you?

Again, you're just a few words from "Freedom is slavery".

Re: Second factor SMS: Worse than its reputation

#117

Post by Tepix »

JohnMakin wrote: post #92
LorenDB wrote: post #64

I think we should just ban companies from implementing SMS 2FA. https://lorendb.dev/posts/lets-ban-sms-2fa/

This causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.

But did you RTFA? SMS aggregators can also be hacked or can leak SMSs by accident.

Re: Second factor SMS: Worse than its reputation

#118

Post by renonce »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

My bank app asks for different tokens for different operations. A code for login, a code for transfers (the code needs to be generated with the payee account number as input). So it’s not a problem of tokens vs SMS.

Re: Second factor SMS: Worse than its reputation

#119

Post by Tepix »

PinguTS wrote: post #21
lmz wrote: post #5

Earlier quoted context omitted.

> most of them should be able to build their own service. Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.

So you say, that for Google, Amazon, Facebook, Microsoft, which are among those costumers, it is too hard to negotiate with the various teclos?

It's not their core business, which is why they let SMS aggregators deal with it and merely switch inbetween those.

Re: Second factor SMS: Worse than its reputation

#120

Post by JohnMakin »

Tepix wrote: post #117
JohnMakin wrote: post #92

Earlier quoted context omitted.

This causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.

But did you RTFA? SMS aggregators can also be hacked or can leak SMSs by accident.

This would still be a targeted attack if exploited, and arguably much more difficult than sim swapping. And yes, I did RTFA, and my point still stands.
Post reply on HN