TOTP is the best.
The problem is how to effectively store the secrets for recovery.
Tell HN: SMS-based two-factor authentication is not secure
131–140 of 291 posts
Re: Tell HN: SMS-based two-factor authentication is not secure
#132Not only is it not secure, it's not a constant for everyone. I moved countries and I am now locked out of my bank account abroad since they verify logins via OTP over SMS.
Why cancel your old phone number in that country when you still have a bank account there? I suggest a bank which doesn't suck, such as bunq.
I would never think my phone # was the only proof of identity.
Re: Tell HN: SMS-based two-factor authentication is not secure
#133Earlier quoted context omitted.
I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.
A bad second factor is better than no second factor. I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.
others may have suggested that, I did not :)
Re: Tell HN: SMS-based two-factor authentication is not secure
#134Earlier quoted context omitted.
Why cancel your old phone number in that country when you still have a bank account there? I suggest a bank which doesn't suck, such as bunq.
I would never think my phone # was the only proof of identity.
If that's what your bank had been using during the login flow...
Re: Tell HN: SMS-based two-factor authentication is not secure
#135Earlier quoted context omitted.
FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the ac…
TOTP is phishable, which is a way way way more common attack than sim swaps.
Sure, no security measure is perfect. Hardware tokens are likely to have better properties than TOTP, which has better properties than SMS, which has better properties than nothing.
you can phish SMS exactly the same way you can phish TOTP, I'd say :)
Re: Tell HN: SMS-based two-factor authentication is not secure
#136Earlier quoted context omitted.
> Some form of trust that can be bootstrapped again from scratch. This is not using it as a second factor. It is using it as the only factor. Having SMS as the only factor is not purely additive. As such it can (and obviously does) reduce security. Account recovery is hard, SMS is quite usable there, but way to insecure to be the only basis for bootstrapping account recovery.
I don't really understand why you think I'm advocating for SMS as the only factor, when I very clearly wrote the exact opposite. Let's say that you remember your password, but your house just burned down. You cannot replace the U2F keys and backup codes that were lost in flames. But you almost certainly can bootstrap your real life identity far enough to get a replacement SIM. Which, in combination with your password…
Except in practice, most providers (even those that should know better, like Google) allow use of SMS, ostensibly set up as a “second factor,” to be used for account recovery without knowing the password. Making it, in practice, 1FA.
Re: Tell HN: SMS-based two-factor authentication is not secure
#137As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to ba…
We have something vaguely similar with "BankID" in Norway. It's a bank issued digital ID that submits a 2FA to your phone (not through SMS, but through some other system that takes over the whole screen - not sure what it is).
It's usable for almost all government agencies or official stuff online here, but I haven't seen anyone use it for third party auth as it costs roughly 10 cents per login for the service using it.
Re: Tell HN: SMS-based two-factor authentication is not secure
#138Earlier quoted context omitted.
I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.
What's the recovery process when your phone gets stolen, or you drop it?
For me, for TOTP, I use one that backs up to iCloud. that obviously weakens the security, but increases the availability.
With some applications, you can add additional devices, so you can add multiple, if you have 'em.
Re: Tell HN: SMS-based two-factor authentication is not secure
#139Earlier quoted context omitted.
I don't have a source to hand, but I've heard from other post-mortems that in SIM-jacking attack the carrier has been socially engineered into not bothering with the pin, ongoing court cases RE negligence perhaps on-going.
If they're able to issue a new SIM card without the system requiring them to enter the PIN first, then it's a very terribly designed system.
They have to be able to issue a new SIM card without a pin in the case of a lost phone though. In that case they should probably check government identification, of course, and not be available remotely.
Re: Tell HN: SMS-based two-factor authentication is not secure
#140Earlier quoted context omitted.
phishable how? "your account has been hacked, please provide us a TOTP code"?
1. Somebody loads fakebank.com. 2. It pops up a username/password screen. The user types in their credentials for realbank.com. 3a. The owners of fakebank.com use your creds to log in to realbank.com and are presented with a TOTP page. 3b. fakebank.com loads another page that asks the user for their TOTP. The user enters it, still thinking they are logging in to realbank.com 4. The owners of fakebank.com use the TOTP…
Couldn’t this entire scenario play out exactly the same with SMS codes?