Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

141–150 of 323 posts

Re: Second factor SMS: Worse than its reputation

#141

Post by kkfx »

Hamuko wrote: post #44
kkfx wrote: post #33

Earlier quoted context omitted.

A bank card to pay stuff, witch is a smart card, NFC capable, you can use (as is common in various EU countries) to authenticate yourself on your internet banking. Similarly various countries offers eIDs (some I know Estonia, Belgium, Italy, Germany, France) witch are NFC ISO 14443A/B who are used to authenticate the Citizen on various public services. Many universities and some high school as well offer an NFC badge…

My Visa card definitely doesn't work for any online bank authentication in Finland. It's strictly for payments. For authentication, it's user ID + PIN with a paper two-factor, or user ID + phone authenticator. Some banks also have physical two-factor hardware.

Well, in Germany, Nederland, Belgium Visa, Mastercard works so, I imaging is just a matter of choice from the bank side. In Italy RSA token (small key chain with an LCD display) was fairly common as another option and some banks have solved the PSD/DSP2 article five with a captcha post-OTP for transactions (i.e. Unicredit), few have chosen more complex OTP with a cam to read a Qr but they are simply too expensive to became spread. In France curiously most banks still do not use a second factor allowing login with just ridiculous "random sorted" virtual keyboards to makes keylogging not work. I guess the world is vary, but I'm also sure enough that Finland have some eIDAS eID document witch can be used like bank cards.

Re: Second factor SMS: Worse than its reputation

#142

Post by mewpmewp2 »

aftbit wrote: post #100
Rygian wrote: post #86

Earlier quoted context omitted.

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.

I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice. Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.

You can access e-mail from outside of your phone, but SMS usually not unless synced with cloud. If your e-mail gets hacked then all of yoir 2FA everywhere with e-mail would be useless.

Re: Second factor SMS: Worse than its reputation

#143

Post by darknavi »

dpkirchner wrote: post #102
AegirLeet wrote: post #80

Earlier quoted context omitted.

Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web. In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBl…

It's to the point that even the US government (even with all its faults and lobbying) recommends using an ad blocker for this reason.

Very interesting! Could you link to that recommendation?

Re: Second factor SMS: Worse than its reputation

#144

Post by joelfried »

darknavi wrote: post #143
dpkirchner wrote: post #102

Earlier quoted context omitted.

It's to the point that even the US government (even with all its faults and lobbying) recommends using an ad blocker for this reason.

Very interesting! Could you link to that recommendation?

Here you go: https://www.ic3.gov/Media/Y2022/PSA221221

Re: Second factor SMS: Worse than its reputation

#145

Post by toast0 »

weinzierl wrote: post #137

Can someone explain to me how SIM swapping actually works? All the articles and videos I found are like: 1. Attacker calls phone companies support hotline or alternatively his confidante there 2. ** MAGIC ** 3. Atacker has access to SMS messages sent to victims number I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview. And to give anot…

If you have a never registered, not expired SIM for a carrier, the carrier can register it to an account given the IMSI. You can also do this with eSIM without needing a physical SIM.

So, step 1, convince the carrier representative. Step 2, give the the IMSI. Step 3, put the sim in your phone and receive SMS.

If you do step 1 in a physical store, the representative will probably give you a new sim from their stack even.

Re: Second factor SMS: Worse than its reputation

#146

Post by zinekeller »

weinzierl wrote: post #137

Can someone explain to me how SIM swapping actually works? All the articles and videos I found are like: 1. Attacker calls phone companies support hotline or alternatively his confidante there 2. ** MAGIC ** 3. Atacker has access to SMS messages sent to victims number I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview. And to give anot…

Except for state-level attacks (in which case you're screwed anyways), in some countries the process tends to be lax (on-the-spot issuance of replacement SIM without robust identity verification or allowing SIM replacement to any arbitary address without verification). This also does not consider insider attacks, where people in the company... can just re-issue any SIM for any number they please (and therefore there are people who are willing to issue illicit SIMs in exchange for money).

Re: Second factor SMS: Worse than its reputation

#147

Post by lolinder »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

It's worth reminding your loved ones that the FBI specifically recommend using an ad blocker in search engines to avoid exactly this kind of scam [0].

> Use an ad blocking extension when performing internet searches. Most internet browsers allow a user to add extensions, including extensions that block advertisements. These ad blockers can be turned on and off within a browser to permit advertisements on certain websites while blocking advertisements on others.

[0] https://www.ic3.gov/Media/Y2022/PSA221221

Re: Second factor SMS: Worse than its reputation

#148

Post by paholg »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

I'm curious if the different SMS message would have mattered in practice.

I for one don't ever read those messages, and Android at least will usually copy the code for you making them even easier to ignore.

Re: Second factor SMS: Worse than its reputation

#149

Post by mnw21cam »

weinzierl wrote: post #137

Can someone explain to me how SIM swapping actually works? All the articles and videos I found are like: 1. Attacker calls phone companies support hotline or alternatively his confidante there 2. ** MAGIC ** 3. Atacker has access to SMS messages sent to victims number I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview. And to give anot…

> And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address.

That's basically SIM-swapping. The only step you haven't described is getting the new SIM sent somewhere else, which probably isn't too hard a thing to achieve given sufficient corruption.

Ultimately, the phone company uses its information to work out where to send an SMS, and that information is an entry in a database - SMS to number X is routed to SIM card ID Y. If an inside job can change that database entry for a while, that's enough to attack SMS-2FA.

Re: Second factor SMS: Worse than its reputation

#150

Post by mixmastamyk »

DanielHB wrote: post #112

Sweden solved this problem years ago with BankID https://en.wikipedia.org/wiki/BankID It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great. It is incredible there is no system like this for every country, heck it is incredible that ther…

Is it true that it doesn’t support Linux as the wiki implies? I guess the card form could be used instead.
Post reply on HN