Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

181–190 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#181

Post by lldb »

nelblu wrote: post #159

Some of the comments pointed out that this is hostile behaviour for people roaming as well, and I completely agree. Here is my solution for this : When I am roaming internationally, I leave my SIM card in a spare android at home plugged into a charger. Android has an app that forwards SMS to API : https://f-droid.org/packages/tech.bogomolov.incomingsmsgatew... . Every time I receive a SMS I forward it to this API. Th…

If your phone supports WiFi calling and dual SIM, you can get a data-only eSIM for the country you're visiting and you'll receive texts for your primary line over the data connection of the secondary eSIM.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#182

Post by unethical_ban »

connicpu wrote: post #106
_bin_ wrote: post #81

Earlier quoted context omitted.

This is probably compliance-related. For me, TOTP isn’t “something I have”, it’s another thing I toss into my password manager and sync to all devices. I really agree with it, but that’s probably their rationale.

I do the same, and it somewhat defeats the spirit of 2FA, but I still believe it's more secure. It's basically a second password where intercepting it in transit once isn't enough to be able to repeat the login in the future.

One time password.

Yes, a digital OTP generator is more susceptible in theory to theft or duplication than a hardware token.

Yes, the benefits of digital OTP are great compared to password only, more secure than SMS, and trivial to implement.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#184

Post by pxeboot »

BenjiWiebe wrote: post #82
jjice wrote: post #52

Earlier quoted context omitted.

It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.

I've been using Citi and Discover for years with a Google Voice number. Possibly I've been grandfathered in though?

I think your experience is typical. I use my Google Voice number for everything and have rarely had any issues.

There are a few popular companies that blacklist VoIP numbers, but most don't. Even Chase, which historically blocked Google Voice, started allowing it a couple years ago.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#185

Post by nelblu »

apexalpha wrote: post #175
nelblu wrote: post #159

Some of the comments pointed out that this is hostile behaviour for people roaming as well, and I completely agree. Here is my solution for this : When I am roaming internationally, I leave my SIM card in a spare android at home plugged into a charger. Android has an app that forwards SMS to API : https://f-droid.org/packages/tech.bogomolov.incomingsmsgatew... . Every time I receive a SMS I forward it to this API. Th…

I’m sorry how is this related to roaming? I roam all the time in Europe and have roamed a lot outside of it, I have never had any trouble receiving any SMS?

Technically you are right, the SIM card isn't roaming, but I am physically roaming outside of my home network (internationally).

Some phone plans in my home network do not support international roaming, or if they support then it is ridiculously expensive that it doesn't make any sense to take the phone roaming.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#186

Post by BlueTemplar »

Great points.

> and TOTP, the obvious alternative solution, is still pretty sorry. you have to download an app to do it, it's not just a capability that a phone has by default. and then when trying to find an app to use for it, you're presented with a multitude of high-stakes choices, and often pretty technical explanations if you start internet searching about which app to use.

A reminder that mandatory iOS App Store / Android Play Store / (Xiaomi store ???) is even less acceptable than SMS 2FA unless maybe you're a USA(/Chinese) citizen living in USA(/China).

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#187

Post by mikestew »

kmoser wrote: post #97
LeifCarrotson wrote: post #67

She just needs a microcell/femtocell. Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 inpu…

It seems t-Mobile no longer offers such hardware: https://www.t-mobile.com/support/coverage/4g-lte-cellspot-se...

Maybe T-Mobile doesn't need to. I've used their WiFi calling for, what, going on ten years probably. Works a treat, including getting short code SMS. Ergo, I don't know the use case for femtocell for T-Mobile. That's why I was surprised to learn via TFA that WiFi isn't the solution in all cases.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#188

Post by Calwestjobs »

lxgr wrote: post #38
Calwestjobs wrote: post #2

TOTP, HOTP. SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.

Neither TOTP nor HOTP provide "what you see is what you sign" property, unfortunately, which can be critical for bank and other transactions. "Enter this code only if you want to pay to " is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example). Not even WebAuthN provides that property on a compromised computer…

only system which does it securely is bitcoin cold wallet / offline computer signed transaction

or as you pointed out, signing it on smartcard with keypad reader.

but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline.

and there is no way for attacker to MITM, and here lies the problem. companies can not blame you as easily as with currently deployed technologies... they hide breaches all the time, f... PCI

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#189

Post by mikestew »

jaoane wrote: post #6

When you choose an eccentric lifestyle you should accept the loss of certain features.

20 minutes outside of Asheville, NC is hardly "an eccentric lifestyle". Let's break it down: which part of this is "eccentric"?

1. Has internet, has WiFi calling.

2. Has a cell phone, but the signal is crap at the house.

Before you answer, that describes my house exactly. And I live in Redmond, WA, and a 10 minute drive from the Microsoft main campus. Though the neighbors might disagree, there is nothing eccentric about my lifestyle.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#190

Post by fasteo »

lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

>>> I really wish that were illegal. A phone number is a phone number.

European speaking. For completeness:

Financial directive PSD2[1] allows to use an SMS as a 2FA only because there is an KYC already done for that number (anon SIM are no longer allowed in the EU)

Also note that the 2FA is not the OTP code you receive. This code is just a proxy for probing "something you have", with the "something" being the phone number which, again, is linked to a physical person/company.

I have commented this several times, but as of today, SMS is the only 2FA method that can be easily deployed at scale (all demographics, all locations, compatible with all mobile devices)

[1] https://en.wikipedia.org/wiki/Payment_Services_Directive

Post reply on HN