Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#121

Post by mrweasel »

raesene9 wrote: post #8
jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the ac…

> TOTP or hardware tokens don't generally suffer from the same problem.

But how many hardware tokens or TOTP tokens are users willing to deal with? I currently have eight for various clients and systems at work. If each online account required a TOTP token or a custom hardware token it would be a confusing mess of tokens.

I don't know if there's a safe and easy way of reusing the same token across sites. Until then SMS really is the only "solution".

Re: Tell HN: SMS-based two-factor authentication is not secure

#122

Post by benjohnson »

esolyt wrote: post #86
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I'm glad someone is bringing this up. I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

I keep an old phone around with a duplicate Authy setup. I also photograph the 2FA code or QR code and print it to a safe place.

Re: Tell HN: SMS-based two-factor authentication is not secure

#123

Post by StavrosK »

withinboredom wrote: post #118
StavrosK wrote: post #15

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Not only that, but you can remove the username too : WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.

But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.

Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine.

I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p.

Just don't get your password manager stolen, I guess, but that's already the case.

Re: Tell HN: SMS-based two-factor authentication is not secure

#126

Post by spicybright »

rawgabbit wrote: post #106

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to ba…

Absolutely this, but the service should act like a driver's license if you want people to actually use it.

Pay some $ for the key, renew it every 2 years for a fee, pay for a replacement if needed.

No one wants another monthly fee, taxes should keep the infra up like any other license.

Re: Tell HN: SMS-based two-factor authentication is not secure

#127

Post by spicybright »

sometimesshit wrote: post #124

To the OP, Please don't use cheap providers like Boost. I have done audit and I found Sprint to be superior; however, they got merged with T-Mobile now. Sprint was the best provider that prevented most hijacks.

That's pretty neat, can you describe what you check when auditing a network?

Re: Tell HN: SMS-based two-factor authentication is not secure

#128

Post by whymauri »

inetknght wrote: post #32

I lost my Microsoft account years ago. I still get emails from Microsoft stating that there's suspicious activity on the account. I got two just yesterday. Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the…

>Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the account with help from support or even after visiting a brick-and-mortar store.

This happened to me. I was briefly a contractor at MSFT and was able to escalate the issue -- after a few years, these accounts get automatically deleted. It's likely that your account is completely wiped and no longer exists.

Re: Tell HN: SMS-based two-factor authentication is not secure

#129

Post by sometimesshit »

meowster wrote: post #9

I think crypto companies should block withdraws for a period of time after a password recovery. (OP, you are calculating your losses, but didn't specify what those losses were. Did the theif get your crypto?)

Coinbase has extensive access to mobile provider data. They can see when number ported and what phone the thief uses, but it's really hard to make decisions.

Re: Tell HN: SMS-based two-factor authentication is not secure

#130

Post by tsimionescu »

staticassertion wrote: post #41
darkwater wrote: post #34

Earlier quoted context omitted.

> In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.

> Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability. So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.

Most people don't own two phones though, and wouldn't think to have two separate U2F tokens.
Post reply on HN