Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

131–140 of 323 posts

Re: Second factor SMS: Worse than its reputation

#131

Post by j5155 »

slothtrop wrote: post #129
AegirLeet wrote: post #80

Earlier quoted context omitted.

Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web. In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBl…

Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.

They are rare but do exist, see ethicalads and Modrinth’s ad program

Re: Second factor SMS: Worse than its reputation

#132

Post by arp242 »

nolist_policy wrote: post #107
elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

No, most companies actually want your phone number for spam prevention. I think the contribution of Spammers to the decline of the Internet is underrated.

Only by those who never worked on these kind of services. Running something like a webmail service is being flypaper for dickheads. As soon as you gain any sort of popularity you will have some very hard and sharp lessons about the lengths spammers will go through to make abuse your service.

First rule of designing anything: "if some cunt can make a buck by completely fucking over your system then that cunt will completely fuck over your system because that cunt is a cunt."

Re: Second factor SMS: Worse than its reputation

#133

Post by twelve40 »

hiatus wrote: post #56
jdiez17 wrote: post #39

Earlier quoted context omitted.

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

> Hot take: rooted phones are inherently less secure. My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?

great question! probably historical reasons:

* computers have always been "rootable", so the banks can't do anything about that

* phones work with "apps", which are viewed as more dangerous than websites. So they came up with the concept of app curation (monitoring large appstores for lookalikes and viruses), and by rooting/sideloading you are violating that model.

* Repackaging a legit app into a malicious lookalike is relatively easy on Android, but harder to distribute if you combat rooting/sideloading.

* if your phone is rooted the bank may be concerned that you could be more susceptible to installing dangerous things, including apps that intercept your 2fa.

You can argue whether these points held up over time (or whether they make things more secure), but that seems to be why they do it. It costs them relatively little to try to combat rooting but potentially liable for losses if people get phished/hacked so...

Re: Second factor SMS: Worse than its reputation

#134

Post by ptero »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Was this in the US or elsewhere, what was the amount and how long did it take to notice? Just curious.

In the US the bar to pull money out of an account is pretty low. Most banks would allow reasonably-sized transfers out with just routing and account numbers. I was stunned by this, but this is the reason utilities and stores can pull your money without you even talking to your bank. Just give them the info. And that information is not secret, it is printed on your every check.

The flip size is that for those "convenience" and service payments the money is easy to get back: banks, at least traditional, will bend over backwards to prevent being seen as enabling fraud.

Re: Second factor SMS: Worse than its reputation

#135

Post by howerj »

xnorswap wrote: post #127
cpcallen wrote: post #108

In the UK it seems that almost all online banking transactions are now verified by SMS. As far as I can tell this is required by law, and replaced the previous, bank card + card reader + pin verification system, which was not only more secure but also did not depend on having a working mobile phone with signal. I hope that this will in due course be recognised as a terrible mistake and rectified. Unfortunately my hop…

Which bank? I'm with LLoyds and transactions are verified via the app, not SMS.

Same with Natwest / Virgin. I do not think I have ever verified anything with SMS banking wise, sometimes you get alerts via SMS though.

Re: Second factor SMS: Worse than its reputation

#136

Post by crazygringo »

didntcheck wrote: post #38

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

That is a security win.

On a rooted phone, you've made it possible for other apps to spy on and steal your banking information.

Bank apps not running on phones where security has been compromised seems entirely reasonable.

Re: Second factor SMS: Worse than its reputation

#137

Post by weinzierl »

Can someone explain to me how SIM swapping actually works?

All the articles and videos I found are like:

1. Attacker calls phone companies support hotline or alternatively his confidante there

2. ** MAGIC **

3. Atacker has access to SMS messages sent to victims number

I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview.

And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address.

Re: Second factor SMS: Worse than its reputation

#138

Post by samspot »

pphysch wrote: post #110
omh wrote: post #104

The article conflates two issues that have different security implications. The "1-click login" links are a concern and just having access to the SMS would be enough to take over things like WhatsApp. But 2FA codes seem notably less worrying. They are the second factor and require an attacker to have the password too. For these cases I'm much more relaxed about the use of SMS and the risks of interception.

> They are the second factor and require an attacker to have the password too. For every leaked database of SMS messages there are 1000 leaked databases of account credentials

I think 999 of those databases are the same data set. I lost a password ten years ago from a blog breach and I get almost a monthly notification about it showing up again and again.

Re: Second factor SMS: Worse than its reputation

#139

Post by dtx1 »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. I haven't seen any bank with that level of 2fa yet, has anyone else?

My local german bank uses an App specifically for 2fa. When i log in i have to approve the login within the app and the website redirects automatically. It shows me that I am approving a login or a transaction with all the transaction details. Since I don't enter my second factor into the browser, a replay wouldn't be possible and it would be VERY obvious to spot the difference between approving a login and approving a transaction. German Sparkasse for those that care.

Re: Second factor SMS: Worse than its reputation

#140

Post by leni536 »

somehelpdeskguy wrote: post #73
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

"...with a replay attack in the background." Wouldn't this be MITM?

I'm not familiar with the nuances of terminology, but I would expect MITM to only apply when you (and your computer) actually attempt to connect to service A, and a malicious actor X intercepts that communication. Phishing is different in the sense that you connect to the phishing page directly, and it may or may not replay some of your inputs to the actual service it is phishing.
Post reply on HN