Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

191–200 of 323 posts

Re: Second factor SMS: Worse than its reputation

#191

Post by Eisenstein »

TacticalCoder wrote: post #179
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> The site was an immaculate knock off ... Then I can picture a great way, locally, to screw these knock off big times. Either the site is a great knock off, visually similar (if not identical) or it won't fool people, right? So what about this: what about the browser saving, locally, screenshots of the login pages you visit. Then, when a new login is made, compare, visually, the page to what's saved and see if any s…

Another step everyone will ignore because it isn't a problem for any particular person until it is.

Re: Second factor SMS: Worse than its reputation

#192

Post by brandon272 »

ryandrake wrote: post #160
brandon272 wrote: post #154

Earlier quoted context omitted.

They force SMS 2FA because it is a lot more frictionless to assume that your users have a phone number than to assume that they have a 2FA app installed on their phone and know how to manage those tools. It's also easier to support.

Ugghhh, "frictionless" as if we're talking about logging into Candy Crush here. Are the "Growth Hackers" infiltrating banking apps now? I don't want my bank software to be frictionless. I want it to be secure.

The person I was replying to said "they just want your phone number", which to me implies that we're not talking about 2FA at the level of banking apps, as the bank already has your phone number, among plenty of other details. Most banking apps I have used also do not use SMS 2FA.

Re: Second factor SMS: Worse than its reputation

#193

Post by callalex »

renewiltord wrote: post #155
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Just use apps. Apple protects.

Nope. Apple participates in the same pay-for-search-placement scheme, and therefore will happily distribute the same kinds of scams. https://usa.kaspersky.com/blog/dangerous-apps-in-app-store/2...

Re: Second factor SMS: Worse than its reputation

#194

Post by renewiltord »

callalex wrote: post #193
renewiltord wrote: post #155

Earlier quoted context omitted.

Just use apps. Apple protects.

Nope. Apple participates in the same pay-for-search-placement scheme, and therefore will happily distribute the same kinds of scams. https://usa.kaspersky.com/blog/dangerous-apps-in-app-store/2...

Well, TIL

Re: Second factor SMS: Worse than its reputation

#195

Post by jdiez17 »

lucianbr wrote: post #116
jdiez17 wrote: post #39

Earlier quoted context omitted.

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

There's always a root account, the only issue is who has access to it. So... phones where a corporation has root are more secure that phones where the owner has root, you say? Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you? Again, you're just a few words from "Freedom is slavery".

> So... phones where a corporation has root are more secure that phones where the owner has root, you say?

You're putting words in my mouth that I explicitly rejected when I said "that does not include GrapheneOS". Just to prevent the follow up "well actually GrapheneOS is an organization": they don't have any kind of root access to GrapheneOS phones. The only thing they can do is push system updates, which you can (1) reject and (2) verify if they are the same updates being pushed to all users, to avoid targeted attacks.

> Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you?

Yes, secure for the user. Sure, power users that very carefully review any system mods they install with root powers would have the same level of security as with a non-rooted phone. But most people won't read the source code of root apps/extensions they install.

It's easier to tempt mobile phone users to install "cosmetic improvement/customization whatevers" that happen to require elevated privileges, than desktop Linux users. It's well known that many Android apps bundle near-malware that slurps all data possible, and will ask for root privileges if that is detected.

The fact is that mobile phones tend to contain more sensitive data than desktop computers (and are thus significantly more secure by default than Linux/Windows computers). Contacts, private messages, photos, etc. It's a more valuable target, so more effort is put in developing malware for phones.

Re: Second factor SMS: Worse than its reputation

#196

Post by tamimio »

The rule of thumb is that you should always avoid any services that still rely on SMS or phone numbers as an ID or 2FA. They simply don’t care about your privacy or security, even if they advertise it. A prime example is Signal.

Unfortunately, for some other services, like banks or government agencies, you don’t have any option. You can only minimize the impact by using a unique password and username and keeping them updated.

Re: Second factor SMS: Worse than its reputation

#197

Post by callalex »

renewiltord wrote: post #194
callalex wrote: post #193

Earlier quoted context omitted.

Nope. Apple participates in the same pay-for-search-placement scheme, and therefore will happily distribute the same kinds of scams. https://usa.kaspersky.com/blog/dangerous-apps-in-app-store/2...

Well, TIL

It's really incomprehensible, whatever minuscule revenue Apple is getting from running this protection racket, I mean ad network, must be minuscule compared to the potential damage they cause to their users and brand. But I guess that's next quarter's problem.

Re: Second factor SMS: Worse than its reputation

#198

Post by TacticalCoder »

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not.

It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc.

Then I modified one letter in the URL, changing "https://online.banking.com" (just an example) to "https://online.banklng.com" and asked ChatGPT 4o again.

He said it was a phishing attempt.

So, basically, you can, today, already have a screenshot automatically analyzed and have a model tell you if it's seemingly legit or not.

Re: Second factor SMS: Worse than its reputation

#199

Post by TacticalCoder »

Eisenstein wrote: post #191
TacticalCoder wrote: post #179

Earlier quoted context omitted.

> The site was an immaculate knock off ... Then I can picture a great way, locally, to screw these knock off big times. Either the site is a great knock off, visually similar (if not identical) or it won't fool people, right? So what about this: what about the browser saving, locally, screenshots of the login pages you visit. Then, when a new login is made, compare, visually, the page to what's saved and see if any s…

Another step everyone will ignore because it isn't a problem for any particular person until it is.

> Another step everyone will ignore ...

Well then enforce it, at the browser level.

Re: Second factor SMS: Worse than its reputation

#200

Post by ikekkdcjkfke »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

ADS ARE THE PRIMARY WAY ELDERS GET DEFRAUDED
Post reply on HN