Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

181–190 of 323 posts

Re: Second factor SMS: Worse than its reputation

#181

Post by twelve40 »

rsync wrote: post #166
bckr wrote: post #43

Earlier quoted context omitted.

Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank

Very difficult with most big banks. In my experience with Bank of America and US Bank they bounce you around to several totally different top level domains as you navigate through the web-based banking. These are third-party service providers that the banks contract for various pieces of their online infra… And it is a complete mess in terms of conditioning consumers to be phished.

that's true and kind of a joke by now, bofa has at least two parallel bill pay systems (both seem white-labeled from someone else?) keep redirecting through multiple domains, both are barely usable and take forever to load to do basic tasks. Security definitely takes a back seat when fighting with their UIs to get anything done.

Re: Second factor SMS: Worse than its reputation

#182

Post by dsego »

Tuna-Fish wrote: post #121
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

The way both my banks work is that I log into the bank, do something that requires confirmation, and then I need to go open my app to confirm it, and it shows all the details for what exactly I'm confirming in the app.

I believe it's the 3d secure protocol, my bank has it, usually a push notification or with a token.

Re: Second factor SMS: Worse than its reputation

#183

Post by warkdarrior »

jampekka wrote: post #82
0xbadcafebee wrote: post #52

I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's…

> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Basic usability? The security theatre is making computing more and more yanky every year, with questionable benefits, and with no regard to the drop in efficiency. For most accounts I don't care much if they are compromised. And have never been compromised…

> Would you agree also that MFA should be mandated for everybody's doors? Or to my bike?

Attacks in the digital world are simply more scalable than in real world. I can try to log into 1000 Gmail accounts in seconds, but it'll take me hours to try to open 1000 doors.

Re: Second factor SMS: Worse than its reputation

#184

Post by recursive »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

If the business model of your search engine is based on ads, your (search user) relationship with them is fundamentally adversarial. Ad blockers will get you some temporary respite, but it doesn't change the nature.

This is an observation from a happy kagi subscriber that doesn't use an ad block.

Re: Second factor SMS: Worse than its reputation

#185

Post by recursive »

TacticalCoder wrote: post #179
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> The site was an immaculate knock off ... Then I can picture a great way, locally, to screw these knock off big times. Either the site is a great knock off, visually similar (if not identical) or it won't fool people, right? So what about this: what about the browser saving, locally, screenshots of the login pages you visit. Then, when a new login is made, compare, visually, the page to what's saved and see if any s…

When a measure becomes a target, it ceases to be a useful measure.

Re: Second factor SMS: Worse than its reputation

#186

Post by warkdarrior »

thepasswordis wrote: post #167

I’ve recently become pretty disillusion with 2FA in general. Google has recently started enforcing their own “click yes on already authorize mobile device” 2FA, which is very frustrating. I have hardware 2FA keys that I keep in a safe. I deliberately do not keep them on me, and using them to re-auth is mentally an “event”. This is not the case with my cell phone, which my kids play with, gets left on my dresser while…

Google lets you choose which authenticators to use (SMS, push to mobile, TOTP, etc). It sounds like you should disable push to mobile for your accounts.

Re: Second factor SMS: Worse than its reputation

#187

Post by calfuris »

elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

I've seen it forced on non-public-facing systems where the company already has everyone's phone number, so that can't be the only reason.

Re: Second factor SMS: Worse than its reputation

#188

Post by TacticalCoder »

whodev wrote: post #76
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

This almost happened to my S/O. Luckily I had setup NextDNS to block newly registered domains along with a list of uncommon TLDs so the site got blocked.

> Luckily I had setup NextDNS to block newly registered domains along with a list of uncommon TLDs so the site got blocked.

I go further: I generate tens of thousands of variants of all the "sensitive" websites we use (like banks and brokers).

All the "levenshtein edit distance = 1" and some of the LED = 2. All variation of TLDs, etc.

I blocklist most TLDs (now that most are facetious): the entire TLD. I blocklist many countries both at the TLD level and by blocking their entire IP blocks (using ipsets).

For example for "keytradebank.be", I generate stuff like:

    # Generated by typosquat.clj for keytradebank.be (9809 entries)
    0.0.0.0 keeytraebank.be
    0.0.0.0 kebtradebank.be
    0.0.0.0 kytradebani.be
    0.0.0.0 keytrxdebak.be
    0.0.0.0 kewytadebank.be
    0.0.0.0 keytgadbank.be
    0.0.0.0 aeytradeank.be
    0.0.0.0 keytradebsan.be
    0.0.0.0 keymradebnk.be
    0.0.0.0 kytradeb9nk.be
    0.0.0.0 ketrade-bank.be
    0.0.0.0 keytradbeban.be
    0.0.0.0 eytradebafk.be
    0.0.0.0 keytraebank.ee
    0.0.0.0 keytrad3bak.be
    0.0.0.0 keytradebzn.be
    ...
I don't care that most make no sense: I generate so many that those who could fool my wife are caught by my generator.

I then force the browser to use the "corporate" DNS settings: where DoH/DoT is forbidden from the browser to the LAN DNS. I can still use DoH/DoT after that if I feel like it.

So any DNS request passes through the local DNS resolver (the firewall ensures that too).

My firewall also takes care of rejecting any DNS attempt to an internationalized domain names (by inspecting packets on port 53 and dropping any that contains "xn--"). I don't care a yota about the legit (for some definition of legit): "pile of poo heart" websites.

My local DNS resolver has 600 000 entries blocked I think, something like that.

I then also use a DNS resolver blocking known malware/porn sites (CloudFlare's 1.1.1.3 for example).

So copycat phishing sites have to dodge my blocklist, the usual blocklists (which I also put in my DNS), then 1.1.1.3's blocklist.

P.S: some people go further and block everything by default, then whitelist the sites they use. But it's a bit annoying to do with all the CDNs that have to be whitelisted etc.

Re: Second factor SMS: Worse than its reputation

#189

Post by wang_li »

rurp wrote: post #175
slothtrop wrote: post #129

Earlier quoted context omitted.

Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.

Intrusive ads are more profitable for the ad company, while the costs are largely born by other parties. A strategy to privatize the gains and socialize the costs is common in a lot of sleazy industries.

There is zero reason for ad companies or ad networks to be covered by any safe harbor provisions of the law. They should have 100% criminal liability for every mal-advertisement they send to a user.

Re: Second factor SMS: Worse than its reputation

#190

Post by TacticalCoder »

schmorptron wrote: post #81
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

I'm paranoid enough at this point that I check that the Cert authority for my bank is the one I know it to have before I log in on the website.

What's your process? Where do you save the cert? I'd be interested in automating that.
Post reply on HN