Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker got all my texts for $16

vice.com

Post reply on HN
Print view View original

21–30 of 296 posts

Re: A hacker got all my texts for $16

#21

Post by david_shaw »

malwarebytess wrote: post #13
DyslexicAtheist wrote: post #3

SMS-2F needs to die. It has absolutely no benefit other than perhaps as protection against credential stuffing.

Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me. Feels like the industry needs to push for a dedicated, universal, probably physical, tool for 2FA.

> Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me.

This is not the case in my experience. Many apps that once used Authenticator-based TOTP now use app-based push alerts (Steam Authenticator, Blizzard Authenticator, Google->GMail App, etc.), but I haven't noticed a trend toward actual SMS.

Are there major orgs that switched to SMS 2FA and disabled authenticator apps? If so, I'd be interested in learning why, also.

Re: A hacker got all my texts for $16

#22

Post by t-writescode »

malwarebytess wrote: post #13
DyslexicAtheist wrote: post #3

SMS-2F needs to die. It has absolutely no benefit other than perhaps as protection against credential stuffing.

Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me. Feels like the industry needs to push for a dedicated, universal, probably physical, tool for 2FA.

Ubiquity: almost everyone has a cell phone. They’re nearly required for all but the richest people.

Simplicity: nearly everybody understands how texting works.

Re: A hacker got all my texts for $16

#23

Post by lstamour »

malwarebytess wrote: post #13
DyslexicAtheist wrote: post #3

SMS-2F needs to die. It has absolutely no benefit other than perhaps as protection against credential stuffing.

Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me. Feels like the industry needs to push for a dedicated, universal, probably physical, tool for 2FA.

They have it, it’s called FIDO2, and it even works with existing devices such as Touch ID or Windows Hello in common browsers such as Chrome. Even Google doesn’t promote Google Authenticator now, but they keep it around for legacy reasons because it still works, until you lose your phone. That’s where FIDO2 shines: just authenticate more than one device, including purchased hardware tokens if you want something cheaper than a phone, and you’ll always have at least one device with access, somewhere.

Re: A hacker got all my texts for $16

#24

Post by davchana »

bogwog wrote: post #15
techrat wrote: post #11

Earlier quoted context omitted.

Don't use Phone number based 2Factor or if you must use a number, keep it to an app (eg, Google Voice) and don't forward your Google Voice texts to your phone's number. Basically, avoid using your carrier provided phone number for anything related to an account.

But Google Voice requires a Google account, and to create a Google account you need to provide a valid phone number. There are also a lot of service providers that don't allow you create an account without providing a valid phone number. I wonder how high-profile politicians and celebrities deal with security issues like this? If this is really such an easy attack to pull off, what's stopping someone from shilling cr…

I deleted the phone number from google account, just use 2FA from app. Now forgot password does not give extreme option of just sending a code to my phone.

Re: A hacker got all my texts for $16

#25

Post by davchana »

jsnell wrote: post #8
vmception wrote: post #5

Earlier quoted context omitted.

"sms based one time passcodes" needs to die and the companies that know better should be fined and sanctioned, particular the ones that are demanding SMS based OTP so they can also add your phone number to their social graph

Nonsense. SMS is a great recovery factor, both for people who forget their password, and for those who lose access to their other second factors. (E.g. email address or a smartphone app). The thing that makes SMS uniquely good at this is that there is infrastructure around for people to replace their lost SIM cards, and that SMS available globally (vs regional identity systems like the bank ids in Nordic countries).…

Google is also a culprit in this same way. Activate normal 2fa, but when you click forgot password, conveniently it says Should we send a code to your phone?

Re: A hacker got all my texts for $16

#26

Post by thelean12 »

davchana wrote: post #24
bogwog wrote: post #15

Earlier quoted context omitted.

But Google Voice requires a Google account, and to create a Google account you need to provide a valid phone number. There are also a lot of service providers that don't allow you create an account without providing a valid phone number. I wonder how high-profile politicians and celebrities deal with security issues like this? If this is really such an easy attack to pull off, what's stopping someone from shilling cr…

I deleted the phone number from google account, just use 2FA from app. Now forgot password does not give extreme option of just sending a code to my phone.

How do you recover your account if you don't have the app?

Re: A hacker got all my texts for $16

#27

Post by davchana »

lstamour wrote: post #23
malwarebytess wrote: post #13

Earlier quoted context omitted.

Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me. Feels like the industry needs to push for a dedicated, universal, probably physical, tool for 2FA.

They have it, it’s called FIDO2, and it even works with existing devices such as Touch ID or Windows Hello in common browsers such as Chrome. Even Google doesn’t promote Google Authenticator now, but they keep it around for legacy reasons because it still works, until you lose your phone. That’s where FIDO2 shines: just authenticate more than one device, including purchased hardware tokens if you want something cheap…

> , until you lose your phone.

Just like any other password or data, 2fa strings also need to be backed up, like in a password database (separate from the usual one).

Re: A hacker got all my texts for $16

#28

Post by sakopov »

bogwog wrote: post #15
techrat wrote: post #11

Earlier quoted context omitted.

Don't use Phone number based 2Factor or if you must use a number, keep it to an app (eg, Google Voice) and don't forward your Google Voice texts to your phone's number. Basically, avoid using your carrier provided phone number for anything related to an account.

But Google Voice requires a Google account, and to create a Google account you need to provide a valid phone number. There are also a lot of service providers that don't allow you create an account without providing a valid phone number. I wonder how high-profile politicians and celebrities deal with security issues like this? If this is really such an easy attack to pull off, what's stopping someone from shilling cr…

You could remove recovery phone number from your Google account use a couple (main and backup) hardware tokens like Yubikey as 2FA.

Re: A hacker got all my texts for $16

#29

Post by devoutsalsa »

nickjj wrote: post #16
devoutsalsa wrote: post #12

Earlier quoted context omitted.

I hate having to use a smartphone for auth in general. Especially when I have an app on my phone that expects me to be able to receive an SMS on the same phone. It’s like I need my phone to recover having lost my phone.

> I hate having to use a smartphone for auth in general. Same, especially since I don't have a smartphone. Often times I'll go a week without looking at my phone and by then it has lost its charge so if an app requires a OTP to do something I often need to wait a while before it's charged enough to receive a text. I do have a Google Voice number but I've mistakenly used my real number for a few services that frequent…

I use Google Voice when at all possible, but there are a few cases where it doesn’t work. The easiest way to piss me off is to make me use a USA number that isn’t my Google Voice number! It doesn’t help that some services won’t even let me log from a non-USA IP when I’m traveling.

Re: A hacker got all my texts for $16

#30

Post by jandrese »

malwarebytess wrote: post #13
DyslexicAtheist wrote: post #3

SMS-2F needs to die. It has absolutely no benefit other than perhaps as protection against credential stuffing.

Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me. Feels like the industry needs to push for a dedicated, universal, probably physical, tool for 2FA.

SMS isn't about protecting your account from hackers, it's about protecting the service from bots. You'll notice if you have a VOIP account that the number can't be used to set up something like a GMail account, it requires an honest to god phone number, something you presumably paid money for. If you try to sign up a hundred accounts using one number you can be assured that it will cut you off very quickly. This is true of all major services.

This is also why they won't let you set up a good 2 factor authentication system (like a Yubikey) they'll force you to first set up a SMS 2 factor. It's very important to remember to delete that SMS second factor after setting up your good second factor or social engineers will use it to steal your account.

Post reply on HN