Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

171–180 of 323 posts

Re: Second factor SMS: Worse than its reputation

#171

Post by funmi »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. I haven't seen any bank with that level of 2fa yet, has anyone else?

HSBC actually has this. All of their country-specific apps allow you to generate a different security code depending on whether you want to login to the website, verify a transaction (e.g. transfer funds to payee), or re-authenticate (e.g. to change your personal info, like your phone number).

Here's a screenshot of what that looks like on their Australia app (similar screens in their US and UK apps): https://www.hsbc.com.au/content/dam/hsbc/au/images/ways-to-b...

They've had this for years. I'm not quite sure why this isn't a standard yet or at least been adopted by other US banks.

Re: Second factor SMS: Worse than its reputation

#172

Post by funmi »

howerj wrote: post #135
xnorswap wrote: post #127

Earlier quoted context omitted.

Which bank? I'm with LLoyds and transactions are verified via the app, not SMS.

Same with Natwest / Virgin. I do not think I have ever verified anything with SMS banking wise, sometimes you get alerts via SMS though.

Same with HSBC (globally actually, not just in the UK).

Re: Second factor SMS: Worse than its reputation

#173

Post by uconnectlol »

Wow SMS 2FA forced bullshit that suddenly got astroturfed right on the day of the Snoweden revelations is actually indeed bullshit. When will they have opt out of this or is this just the end of the web? 20 years ago I did not need or want anything more than a password (obviously cryptographic key auth would be better but not if it's brought to you by X.509). And of course all the HNers who eat this shit up and defend it like little dogs are suddenly on the other side. Email verification is fucking dumb too, and of course now every email forces phone SMS shit.

Re: Second factor SMS: Worse than its reputation

#174

Post by rsync »

0xbadcafebee wrote: post #52

I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's…

I would much rather we just handed everybody an RSA token.

Dead simple… Works off-line… Requires no account or personal infra to use…

… And as a bonus I already have a nice workflow where a WebCam is pointed at my token sitting on my desk.

I kid.

Or do I … ?

Re: Second factor SMS: Worse than its reputation

#175

Post by rurp »

slothtrop wrote: post #129
AegirLeet wrote: post #80

Earlier quoted context omitted.

Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web. In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBl…

Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.

Intrusive ads are more profitable for the ad company, while the costs are largely born by other parties. A strategy to privatize the gains and socialize the costs is common in a lot of sleazy industries.

Re: Second factor SMS: Worse than its reputation

#176

Post by warkdarrior »

rsync wrote: post #159

Random thought I’ve been having as we keep bringing this topic up these past few weeks… How interesting or uninteresting would bi-modal 2FA be ? That is: you receive a code by text and you enter the code by email… I haven’t spent any time to work out whether this significantly changes the attack surface but… At first glance it does seem like you would need to own two different account types… … So I guess a first ques…

Bi-modal 2FA is already here: you receive a code by text and you enter the code in your web browser (or a proprietary app like a banking app).

Moving from web browser to email for entering the 2FA code means that you (the user) have to make sure to send email to the correct address, not one provided by the attacker.

Re: Second factor SMS: Worse than its reputation

#177

Post by HL33tibCe7 »

slothtrop wrote: post #129
AegirLeet wrote: post #80

Earlier quoted context omitted.

Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web. In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBl…

Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.

Google’s search ads have become explicitly more intrusive and less distinguishable from the real content over time, deliberately and knowingly.

It’s funny, that while many parts of Google are making improvements to the web security ecosystem, they are completely ready to throw it out of the window when it comes to making them more money.

Re: Second factor SMS: Worse than its reputation

#178

Post by ted_dunning »

jampekka wrote: post #82
0xbadcafebee wrote: post #52

I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's…

> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Basic usability? The security theatre is making computing more and more yanky every year, with questionable benefits, and with no regard to the drop in efficiency. For most accounts I don't care much if they are compromised. And have never been compromised…

My front door effectively has 2FA.

You have to HAVE the key and you have to KNOW exactly how to wiggle the key to get it to work.

Re: Second factor SMS: Worse than its reputation

#179

Post by TacticalCoder »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> The site was an immaculate knock off ...

Then I can picture a great way, locally, to screw these knock off big times.

Either the site is a great knock off, visually similar (if not identical) or it won't fool people, right?

So what about this: what about the browser saving, locally, screenshots of the login pages you visit.

Then, when a new login is made, compare, visually, the page to what's saved and see if any saved pages are similar?

"Oops, the page www.banklng.com looks nearly identical to www.banking.com which you visited previously, they're probably trying to scam you!".

Re: Second factor SMS: Worse than its reputation

#180

Post by Sylamore »

RandallBrown wrote: post #165
slothtrop wrote: post #129

Earlier quoted context omitted.

Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.

I feel like this was one of the original selling points of Google's ads. They were pretty simple, unobtrusive, mostly text, ads.

The doubleclick acquisition was the end of that.
Post reply on HN