Second factor SMS: Worse than its reputation • Hacker News Board

Re: Second factor SMS: Worse than its reputation

#151

Post by ReK_ » Thu, Jul 11, 2024, 4:20 PM UTC

brightball wrote: post #103

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

I still don’t understand why banks just don’t use FIDO2/WebAuthn yet. I’d much prefer to use a Yubikey over all other options at this point.

Because banks are financial institutions and every decision they make is based in that. If the cost of insurance is less than the cost to actually secure the system, they will choose that every time.

Banks and payment processors have some of the worst technical debt. For example, a lot of transactions are processed using the ISO8583 standard, a binary bitmap-based protocol from the 80s. The way cryptography was bolted onto this was the minimum required to meet auditing standards: specific fields are encrypted but 99% of the message is left plaintext without even an HMAC.

Re: Second factor SMS: Worse than its reputation

#152

Post by diego_sandoval » Thu, Jul 11, 2024, 4:22 PM UTC

didntcheck wrote: post #38

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

At least you have an alternative.

In my country, almost all banks force the use of app 2FA without SMS as an alternative.

If I don't want to buy and carry an extra phone around, I'm limited to using the one bank that doesn't require it.

Re: Second factor SMS: Worse than its reputation

#153

Post by ReK_ » Thu, Jul 11, 2024, 4:22 PM UTC

leni536 wrote: post #140

somehelpdeskguy wrote: post #73

Earlier quoted context omitted.

"...with a replay attack in the background." Wouldn't this be MITM?

I'm not familiar with the nuances of terminology, but I would expect MITM to only apply when you (and your computer) actually attempt to connect to service A, and a malicious actor X intercepts that communication. Phishing is different in the sense that you connect to the phishing page directly, and it may or may not replay some of your inputs to the actual service it is phishing.

I guess theoretically phishing could be considered MiTM, but the latter term generally implies the attack is fully transparent to the user, whereas phishing convinces the user to insert the malicious party themselves.

Re: Second factor SMS: Worse than its reputation

#154

Post by brandon272 » Thu, Jul 11, 2024, 4:23 PM UTC

elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

They force SMS 2FA because it is a lot more frictionless to assume that your users have a phone number than to assume that they have a 2FA app installed on their phone and know how to manage those tools. It's also easier to support.

Re: Second factor SMS: Worse than its reputation

#155

Post by renewiltord » Thu, Jul 11, 2024, 4:25 PM UTC

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Just use apps. Apple protects.

Re: Second factor SMS: Worse than its reputation

#156

Post by brandon272 » Thu, Jul 11, 2024, 4:28 PM UTC

Hobadee wrote: post #101

NIST has explicitly said you shouldn't use SMS 2FA for a while now: NIST SP 800-63B §5.1.3.3. https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB

The perspectives and interests of NIST and the things that a service provider has has to worry about with respect to their customer/user experience are not necessarily aligned.

Customer: "What do you mean two factor app? I thought the code was supposed to come to my phone?"

Support: "It did, but we no longer support SMS two factor authentication."

Customer: "But I had no problems when the code came to my phone."

Support: "Yes, but NIST recommends that we don't use SMS 2FA"

Customer: "What's NIST? I'm finding this very frustrating, I need to get into my account."

Re: Second factor SMS: Worse than its reputation

#157

Post by mixmastamyk » Thu, Jul 11, 2024, 4:30 PM UTC

jampekka wrote: post #88

amluto wrote: post #63

Earlier quoted context omitted.

> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. A password manager is, in essentially every respect except interoperability, inferior to WebAuthn. Let’s not make an inferior solution mandatory when we already have a superior solution.

> Let’s not make an inferior solution mandatory when we already have a superior solution. With a slight caveat that it doesn't work. At least not on Linux without some proprietary junk dongles or their emulators.

Huh, can you be more specific? I thought I was using this on Linux with bitwarden. Is a yubikey “junk?”

Re: Second factor SMS: Worse than its reputation

#158

Post by jampekka » Thu, Jul 11, 2024, 4:30 PM UTC

DanielHB wrote: post #112

Sweden solved this problem years ago with BankID https://en.wikipedia.org/wiki/BankID It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great. It is incredible there is no system like this for every country, heck it is incredible that ther…

EU is introducing Digital Wallet for this. I hope it will nicer to use than the Finnish version of BankID. Also would be nicer to be less dependent of banks or other private rent-seeking institutions.

Not having too high hopes though.

https://ec.europa.eu/digital-building-blocks/sites/display/E...

Re: Second factor SMS: Worse than its reputation

#159

Post by rsync » Thu, Jul 11, 2024, 4:32 PM UTC

Random thought I’ve been having as we keep bringing this topic up these past few weeks…

How interesting or uninteresting would bi-modal 2FA be ?

That is: you receive a code by text and you enter the code by email…

I haven’t spent any time to work out whether this significantly changes the attack surface but… At first glance it does seem like you would need to own two different account types…

… So I guess a first question would be: does this exist anywhere? Has anyone ever seen this or done this?

Re: Second factor SMS: Worse than its reputation

#160

Post by ryandrake » Thu, Jul 11, 2024, 4:34 PM UTC

brandon272 wrote: post #154

elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

They force SMS 2FA because it is a lot more frictionless to assume that your users have a phone number than to assume that they have a 2FA app installed on their phone and know how to manage those tools. It's also easier to support.

Ugghhh, "frictionless" as if we're talking about logging into Candy Crush here. Are the "Growth Hackers" infiltrating banking apps now? I don't want my bank software to be frictionless. I want it to be secure.