Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

111–120 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#111

Post by PaulHoule »

globie wrote: post #27
gruez wrote: post #14

Earlier quoted context omitted.

>your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that. This is mostly a red herring because most of the places that require SMS TOP already have your full name/address (eg. financial institutions, healthcare providers) or are in a position to intercept communications that they can infer that information (eg. google). If apps/si…

I don't understand how this post stacks up against the myriad of communications apps that not only require phone verification when creating a new profile (and maybe SMS2FA), but put great effort into blocking as many VoIP/burner/prepaid numbers as possible. "Most"? maybe "a troubling few"? Phone verification is absolutely a widely exploited data mining opportunity, I don't see how it's a red herring at all. It's one…

To single out Meta properties, I'd point to both Instagram and WhatsApp. It was an official policy early on that you could only create a WhatsApp account if it was connected to a "real" cellular number, I think the same has been true about Instagram for a while in that every time I tried to create an account without a cellular number it didn't work. Put in a cellular number and it worked just fine.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#112

Post by immibis »

miki123211 wrote: post #98

This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. Your carrier is already capable of redirecting your SMS messages to other carriers, that's what they do when you're abroad and roaming with a foreign operator. You could make a fake carrier that speaks the right protocols on the roaming side, but communicates with the customer over the internet (using an API or…

> Carriers would probably hate this and might not be willing to sign roaming agreements with such a company.

This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't.

You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#114

Post by McGlockenshire »

modeless wrote: post #16
pyrale wrote: post #12

Earlier quoted context omitted.

> When you choose an eccentric lifestyle Many "eccentric" lifestyles are not chosen. For instance not owning a smartphone or not having access to power easily is not necessarily limited to well-off tech-savv hipsters who want to make a statement, homeless people, older people in less connected areas or people in developing countries can also be in that situation. When you make your services depend on specific access,…

Homeless people get free smartphones and free service in the US. Living in very rural areas is in fact a lifestyle choice. Not all choices need to be subsidized.

> Homeless people get free smartphones and free service in the US

Recently former homeless person here. The Republicans in Congress refused to renew the Lifeline program in 2023 and the replacement is objectively worse in every single way.

> Not all choices need to be subsidized.

Ah yes, being homeless, a choice. I hope it never happens to you.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#116

Post by Suppafly »

terinjokes wrote: post #95
BenjiWiebe wrote: post #82

Earlier quoted context omitted.

I've been using Citi and Discover for years with a Google Voice number. Possibly I've been grandfathered in though?

I could not use my Google Voice number (that I've had since Grand Central) for most companies that only do SMS 2FA until it became my Google Fi number. Then I guess some flag got set in the database they check against.

>I could not use my Google Voice number (that I've had since Grand Central) for most companies that only do SMS 2FA until it became my Google Fi number. Then I guess some flag got set in the database they check against.

I was wondering about that, because I can't get google voice because I have google fi, so clearly it's using the same bank of numbers, but maybe once they are fi, they are ported to T-mobile instead of their own CLEC.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#117

Post by Loudergood »

dreamcompiler wrote: post #15

1. Download the Google Voice app. This phone number works for some but not all 2FA services. Not all, because some explicitly forbid GV numbers because they're afraid of fraud. GV can receive SMS messages over wifi. 2. Ask the cell phone company for a femtocell. These used to be called "AT&T Microcells" and they were cheap. I used one before cell service improved because I live in the mountains. But apparently AT&T d…

The real bonus to security here, access to your SMS is protected via MFA.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#118

Post by lxgr »

hedora wrote: post #60
lxgr wrote: post #30

Earlier quoted context omitted.

> Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal It can't – how would it? The only entity that can forward texts is the carrier, and I doubt that that service is integrated with all US carriers to somehow get them forwarded (which is technically quite difficult for various legacy protocol reasons). Apple's satellite messaging service is…

Sms and signaling system 7 are incredibly insecure. It has to be so it can support scammers that call you from spoofed numbers. Anyway, it’s probably possible to make a service like that. You might need to route through a country with permissive laws.

SS7 is very insecure, yes, but intercepting inbound SMS is still orders of magnitude more difficult than spoofing sender/caller numbers.

Allowing SMS interception without the home network's consent seems like a quick way to get offboarded as a roaming partner.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#119

Post by vzaliva »

"it turns out messages from 5 digit shortcodes often aren't supported over wifi calling."

This does not seems plausible. I live in urban area but do not have good cellural connection at home and my mobile phones are usually route calls via home Wifi. All SMS come through. It is just a low-lever transport and I doubt it cares about message size or numbers.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#120

Post by Suppafly »

Spivak wrote: post #89
LeifCarrotson wrote: post #67

She just needs a microcell/femtocell. Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 inpu…

I'm surprised the major cell providers are cool with letting randos operate cell towers that back into an unknown untrusted ISP and their customers will automatically switch to when in range. It's unbelievably chill for companies that are usually so concerned about their image and controlling the whole experience end to end.

>I'm surprised the major cell providers are cool with letting randos operate cell towers that back into an unknown untrusted ISP and their customers will automatically switch to when in range.

A lot of office buildings have these in them. I think the personal ones are how they get around some of the issues with government requiring them to build networks to certain coverage. They just don't build it out and when someone complains they offer them one of these.

Post reply on HN