Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

21–30 of 323 posts

Re: Second factor SMS: Worse than its reputation

#21

Post by PinguTS »

lmz wrote: post #5
slow_typist wrote: post #4

Earlier quoted context omitted.

Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).

> most of them should be able to build their own service. Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.

So you say, that for Google, Amazon, Facebook, Microsoft, which are among those costumers, it is too hard to negotiate with the various teclos?

Re: Second factor SMS: Worse than its reputation

#22

Post by PinguTS »

sleepyhead wrote: post #13

Apparently the messages on the S3 bucket were updated every five minutes: https://www.zeit.de/digital/datenschutz/2024-07/it-sicherhei... The CCC definition of this being only 2FA-SMS is incorrect though. It was not only Twilio Verify (2FA API) that was affected, it was all SMS sent through this vendor.

Where do you have the Twillio Verify reference from? It is nowhere mentioned.

Re: Second factor SMS: Worse than its reputation

#23

Post by upofadown »

ossobuco wrote: post #14
throw0101d wrote: post #9

If the choice between no 2FA and SMS, which is better?

As the linked post says itself, "2FA-SMS is Better Than Nothing"

I would argue that a 1FA unguessable password used once is just as good. Certainly better than the case where the provider offers account resets using just SMS thus having effectively 1FA SMS.

Re: Second factor SMS: Worse than its reputation

#24

Post by pilif »

hun3 wrote: post #16
ossobuco wrote: post #14

Earlier quoted context omitted.

As the linked post says itself, "2FA-SMS is Better Than Nothing"

But it's also the most cost expensive (from provider side) among 1FA and 2FA-OTP

I think conversion rate and support cost associated with 2FA-OTP are worse enough for SMS to still be worth it, especially as a phone number also gives you a good marketing ability and a reasonably unique identifier for a user.

If not, everybody would be using OTP already.

Re: Second factor SMS: Worse than its reputation

#25

Post by Hamuko »

kkfx wrote: post #20
Hamuko wrote: post #8

Earlier quoted context omitted.

You can use Yubikeys, which are basically the modern and better version of "smart cards", on phones and tablets just fine. I have a Yubico Security Key on my keychain and I can use it on my iPhone with NFC or with my iPad using USB-C.

You need it. While your bank already gives you (typically) a card you can also use as is for auth for them. Your country probably have some e-documents already, no need for extras to authenticate the public sector services and so on. The point is offering something already usable and gives people a habit on that. After we might add yubi for generic services like GMail and so on.

I have zero clue as to what you're talking about. And what card am I getting from my bank?

Re: Second factor SMS: Worse than its reputation

#26

Post by sleepyhead »

PinguTS wrote: post #22
sleepyhead wrote: post #13

Apparently the messages on the S3 bucket were updated every five minutes: https://www.zeit.de/digital/datenschutz/2024-07/it-sicherhei... The CCC definition of this being only 2FA-SMS is incorrect though. It was not only Twilio Verify (2FA API) that was affected, it was all SMS sent through this vendor.

Where do you have the Twillio Verify reference from? It is nowhere mentioned.

It is not but CCC is indicating that this provider was only used for 2FA. Sorry I was getting a bit ahead of myself here, this was earlier exposed as a breach of Twilio's vendor (IdentifyMobile). In the case of Twilio they offer an API for 2FA, Twilio Verify. I wanted to clarify that this breach was not only for 2FA, Verify API in the case of Twilio, but for all SMS sent through IdentifyMobile.

Re: Second factor SMS: Worse than its reputation

#27

Post by TonyTrapp »

averageRoyalty wrote: post #18

Hardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.

It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.

Re: Second factor SMS: Worse than its reputation

#28

Post by hocuspocus »

Hamuko wrote: post #25
kkfx wrote: post #20

Earlier quoted context omitted.

You need it. While your bank already gives you (typically) a card you can also use as is for auth for them. Your country probably have some e-documents already, no need for extras to authenticate the public sector services and so on. The point is offering something already usable and gives people a habit on that. After we might add yubi for generic services like GMail and so on.

I have zero clue as to what you're talking about. And what card am I getting from my bank?

I assume your bank gives you a debit card. And many government IDs have NFC chips nowadays.

Re: Second factor SMS: Worse than its reputation

#29

Post by jltsiren »

Hamuko wrote: post #8
worksonmine wrote: post #7

Earlier quoted context omitted.

Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.

You can use Yubikeys, which are basically the modern and better version of "smart cards", on phones and tablets just fine. I have a Yubico Security Key on my keychain and I can use it on my iPhone with NFC or with my iPad using USB-C.

Unfortunately physical keys are getting obsolete in many places, and people are no longer routinely carrying their keychains around.

Re: Second factor SMS: Worse than its reputation

#30

Post by commandersaki »

kkfx wrote: post #19
commandersaki wrote: post #15

Earlier quoted context omitted.

Yeah but it's a tradeoff in usability, that's an accessory that needs to be provisioned and carried around.

How many have a smartphone with a cover able to hold cards? How many have wallet in their pockets? Where the trade off in usability? Having a sole pin and a card to access various services instead of passwords and copypasting OTP or something similar with crappy and dysfunctional apps.

> How many have a smartphone with a cover able to hold cards?

I use a wallet that holds cards, but not common or popular, and are you seriously suggesting that we insert this thing into our phones, which would probably mean you'd have to dislodge from the case, wallet or not, and align the card into the slot. Not to mention how much space it'd consume in a smart phone. You & maybe a very tiny cohort want this, the general public don't, especially for the marginal security benefit. Anyways as others say, the modern equivalent is NFC, but again getting everyone to buy and carry an accessory is asking too much. Modern smartphones already have modern security and in recent years have been exposing their security coprocessor chip to the OS.

Post reply on HN