Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s time to stop using SMS for security

lucky225.medium.com

Post reply on HN
Print view View original

141–149 of 149 posts

Re: It’s time to stop using SMS for security

#141

Post by ClumsyPilot »

hlandau wrote: post #128
ClumsyPilot wrote: post #101

Earlier quoted context omitted.

So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.

"Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear. By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is. Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox…

"mailbox can only be accessed by me over an SSH tunnel"

Thats basically fantasy territory for an average user. If you consider the real world" abundant phishing, etc. then you will realise that in practice there is very little daylight between them.

Re: It’s time to stop using SMS for security

#142

Post by wryroybatty »

GhostVII wrote: post #84
quicklime wrote: post #28

Earlier quoted context omitted.

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to…

This is why I switched over to a VOIP number instead. SMS works everywhere I have internet, and if I have to I just pick up a data-only sim card for wherever I am. Can even check my messages online. Probably not as secure, and wouldn't work well if I was regularly calling people, but for the most part it works fine and costs $1 a month.

Unfortunately voip, in my case voip.ms, does not work with all sms send methods.

Re: It’s time to stop using SMS for security

#143

Post by jjav »

slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

As the article explains, SMS is just plain insecure. So attempting to rely on it for MFA is worse than nothing (worse, because it allows attackers to lock out legitimate user).

Ignoring security (not that we should), it's just a massive pain from a pragmatic point of view. As others note, right when an SMS MFA is triggered is most of the time when I can't receive an SMS, so everything breaks when I actually need access.

Much easier solutions exist today at more convenient adoption at scale, like email and TOTP.

Re: It’s time to stop using SMS for security

#144

Post by jjav »

ClumsyPilot wrote: post #101
_trampeltier wrote: post #80

Earlier quoted context omitted.

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.

So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.

> Email is hardly beter than sms, and we do password resets over email.

Email is certainly far more secure. Consider the steps an attacker would need to do to be able to intercept an email being sent from the service being accessed (say, your bank) to your email server provider.

Re: It’s time to stop using SMS for security

#145

Post by supermatt »

supermatt wrote: post #8
slovette wrote: post #7

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…

I don’t think anyone hates SMS 2FA in general, just that it is susceptible to MITM attacks (snooping/interception) than other solutions (device, key, app) as is made clear in this article. I note, however, that this attack seems to only be possible on VOIP routable numbers, and it’s my experience that banks, etc, will not allow you to use VOIP routable numbers for 2FA. That’s definitely not the case for a naive imple…

Further reading suggests this isn’t just voip numbers!

Re: It’s time to stop using SMS for security

#146

Post by tptacek »

hlandau wrote: post #128
ClumsyPilot wrote: post #101

Earlier quoted context omitted.

So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.

"Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear. By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is. Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox…

No mainstream email providers support DANE, which is about as realistic an option as SSH tunnels.

Re: It’s time to stop using SMS for security

#147

Post by ydant »

inflorescer wrote: post #140
ydant wrote: post #105

Earlier quoted context omitted.

I have two virtual (US) numbers - one through Twilio (which I've enable short-code receive support for), and one on Google Voice. Both have failed to receive 2-factor messages from providers over the years. Very occasionally the Google Voice number is blocked explicitly by the provider as a VOIP number. It's just not a reliable 100% replacement for "real" SMS in my experience. Google Voice is close to acceptable as a…

>I have two virtual (US) numbers - one through Twilio I've heard good things, can you port a cell number in or is it strictly voip? (I haven't done anything phreaking adjacent in ages)

Seems porting is supported:

https://support.twilio.com/hc/en-us/articles/223179348-Porti...

I used one of their existing pool of numbers.

For inbound short-code support, you have to contact support directly and agree to a legal T&C for them to enable it.

Re: It’s time to stop using SMS for security

#148

Post by BiteCode_dev »

chrismorgan wrote: post #58
quicklime wrote: post #28

Earlier quoted context omitted.

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to…

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn…

I'd advice for the excellent pulsesms app, which will let you sync you sms from your phone to your desktop.

You can read and write messages from the comfy keyboard of your Windows/MacOS/Linux laptop, even if your phone is at the other side of the world, as long as both are connected to internet.

As someone who forgets his phone regularly at home, it's great.

Re: It’s time to stop using SMS for security

#149

Post by glitchc »

mindslight wrote: post #130
glitchc wrote: post #129

Earlier quoted context omitted.

That’s a horrendous hack. The security provisions of immediacy and liveness offered by SMS 2FA are rendered moot. That one needs to do this to work around the limitations solidifies in my mind that SMS is a poor 2FA solution and should be discontinued.

I'm surprised to see people here treating SMS "2FA" as anything but some snake oil annoyance to be worked around. I setup mine to go to a VOIP number where texts show up in email. I have plans to write something that looks for these messages and spits the code to a terminal or XMPP. My goal is to get that code into my paste buffer as quickly as possible. If you're using a password manager and have a security model th…

Sounds like we're in agreement.
Post reply on HN