Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

191–200 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#191

Post by fasteo »

lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

>>> she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through.

Completely different beasts. One is P2P, the other is A2P

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#192

Post by modeless »

arp242 wrote: post #168
modeless wrote: post #16

Earlier quoted context omitted.

Homeless people get free smartphones and free service in the US. Living in very rural areas is in fact a lifestyle choice. Not all choices need to be subsidized.

It just saddens me that you can be so devoid of empathy.

This kind of performative "empathy" people talk about in online forums is not true empathy. It's frequently the case that prioritizing this fake "empathy" results in bad outcomes. It saddens me when people use "empathy" to justify policy with strongly negative overall consequences. It's how you end up with, for example, the disaster zone that large chunks of San Francisco were before Lurie started cleaning up a few months ago. Or the deplorable state of our healthcare system.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#193

Post by kotaKat »

zinekeller wrote: post #122
Spivak wrote: post #89

Earlier quoted context omitted.

I'm surprised the major cell providers are cool with letting randos operate cell towers that back into an unknown untrusted ISP and their customers will automatically switch to when in range. It's unbelievably chill for companies that are usually so concerned about their image and controlling the whole experience end to end.

Eh, assuming it's 4G LTE (or above), it's literally the same thing as Wi-Fi calling. This is technically called IMS (IP Multimedia Subsystem, https://en.wikipedia.org/wiki/IP_Multimedia_Subsystem ), and is powered by "magic" DNS (no kidding, everything points to 3gppnetwork.org) and literal IP + IPSEC. Even when your phone is connected to Wi-Fi, it enters a special mode called IWLAN which powers your Wi-Fi calling, S…

No, in this case the consumer femtocells on the market (AT&T Cell Booster, Verizon LTE Network Extender) are actual eNodeBs inside the carrier’s RAN. They will IPSEC tunnel back to a security gateway (SeGW), grab provisioning information, and then come up on the carrier’s commercial license as just another (fancy low powered) LTE radio on the network.

AT&T did try to add some additional tamper switches and protection inside their units so they’d brick if you opened them - that was known since the MicroCell era. I believe T-Mobile’s former CellSpots were also tamper-protected in the same manner (they both deployed Nokia LTE small cells).

AT&T also appears to now charge you for the privilege of deploying the newer Cell Booster Pros if you want 5G - I assume that cost ($30/mo per cell!) is basically covering licensing the backend for all of that.

Wi-Fi Calling uses a different SeGW endpoint and is pure IMS back to the carrier voice network, regardless if you shoot it over WiFi or back over a dedicated APN on the LTE network in the normal VoLTE fare.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#194

Post by iszomer »

BenjiWiebe wrote: post #82
jjice wrote: post #52

Earlier quoted context omitted.

It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.

I've been using Citi and Discover for years with a Google Voice number. Possibly I've been grandfathered in though?

GV still works on BOA to an extent: general balance queries through their app or the web will go through but anything involving identity and real transactions via wire or zelle will ask for your real mobile number. Even if you do happen to visit one of their branches they will ask for confirmation through your real mobile number (landlines will obviously not work).

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#195

Post by lisper »

fasteo wrote: post #190
lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

>>> I really wish that were illegal. A phone number is a phone number. European speaking. For completeness: Financial directive PSD2[1] allows to use an SMS as a 2FA only because there is an KYC already done for that number (anon SIM are no longer allowed in the EU) Also note that the 2FA is not the OTP code you receive. This code is just a proxy for probing "something you have", with the "something" being the phone…

> anon SIM are no longer allowed in the EU

Ah. That explains why they asked for my life history when I tried to buy a local SIM in Italy.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#197

Post by lisper »

LeifCarrotson wrote: post #67

She just needs a microcell/femtocell. Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 inpu…

> She just needs a microcell/femtocell.

Those come with their own set of problems. In particular, they have to be able to receive a GPS signal, which is often not possible in mountainous terrain. I had a microcell for years and it was nightmarishly unreliable. Not only would it regularly (but randomly) just stop working, it would give absolutely no indication of why it was not working.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#198

Post by caseyy »

fasteo wrote: post #191
lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

>>> she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through. Completely different beasts. One is P2P, the other is A2P

I was under the impression WiFi Calling was just regular phone service through WiFi. It seems to work that way for me, 2FA codes and all.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#199

Post by PaulDavisThe1st »

lisper wrote: post #197
LeifCarrotson wrote: post #67

She just needs a microcell/femtocell. Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 inpu…

> She just needs a microcell/femtocell. Those come with their own set of problems. In particular, they have to be able to receive a GPS signal, which is often not possible in mountainous terrain. I had a microcell for years and it was nightmarishly unreliable. Not only would it regularly (but randomly) just stop working, it would give absolutely no indication of why it was not working.

They do not have to receive GPS, but it causes issues for e911 service if they do not. It has no impact on anything else, at least not the T-Mobile version.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#200

Post by hollerith »

kmoser wrote: post #91
devoutsalsa wrote: post #69

Earlier quoted context omitted.

My personal 2FA favorite is OTP + authenticator app. It behaves predictably and doesn’t have weird failure conditions. SMS 2FA tied to your mobile number sucks if it doesn’t support Google Voice, especially when traveling internationally and your SIM card isn’t in your phone. Email 2FA usually works, but I just find it annoying. App-specific push notifications mostly work, but it’s hard to debug if you don’t get the…

I hate email 2FA because I purposely don't have email on my phone. Unless I'm in front of my computer, I'm unable to log in to websites that use email 2FA.

Have you considered installing an email client on your phone, but not giving it the credentials it would need to fetch mail from the mailboxes you don't want to be tempted to look at when away from a keyboard?
Post reply on HN