Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#201

Post by tialaramex »

dheera wrote: post #175
PeterisP wrote: post #142

Earlier quoted context omitted.

It is safe to use the same U2F token for many sites, that's not an issue. Having a backup token is very useful, but apart from that, a single hardware token (not custom - standards are good) can easily be used to secure all your accounts.

The only thing I wish is that more sites support multiple tokens, since tokens can get lost. If you only support one token but have an easy recovery procedure, that opens up loopholes. If you support multiple tokens, allow the user to de-activate one token from another token, and make recovery difficult, that's much more secure.

Again, other than AWS which "more sites"?

Dropbox, Facebook, Google, GitHub, GitLab, even Login.gov works fine with multiple tokens.

More sites should do WebAuthn (you should not do greenfield deployments of U2F today, WebAuthn is the standard). Yes, AWS should fix their feature but that shouldn't block the next ten would-be Unicorns from doing WebAuthn.

Re: Tell HN: SMS-based two-factor authentication is not secure

#202

Post by jjav »

Wowfunhappy wrote: post #22
staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

You can also "loose, etc" the phone so it is equally weak on that front. Except the SIM can be hijacked, so SMS is strictly worse and never better.

Best compromise between usability, access and recovery is to always use TOTP but be sure to always securely back up the secret offline. Don't ever just scan it into a single device, as then you're back to being able to lose it and be locked out.

Re: Tell HN: SMS-based two-factor authentication is not secure

#203

Post by deckard1 »

esolyt wrote: post #86
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I'm glad someone is bringing this up. I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

2FA goes one of two ways:

1. You increase the risk of losing your entire life (if 2FA is properly implemented and avoids all social engineering process risks)

or

2. The 2nd factor devolves into a 2nd way to get access to your account

You really can't have both security and convenience.

> wiped their phone that had an authenticator app

try this one: battery dies in an iPhone. iPhone won't boot until battery is replaced. Battery can only be replaced at an Apple store. 2FA: do you feel lucky, punk?

Re: Tell HN: SMS-based two-factor authentication is not secure

#204

Post by jsnell »

tialaramex wrote: post #191
jsnell wrote: post #35

Earlier quoted context omitted.

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch. For most of the world, SMS is it. The Nordic countries have th…

> SMS as a second factor is purely additive. It cannot reduce security. You are forgetting social engineering. Humans find it reassuring that the security process happened as usual, even if in fact the apparently "usual" process was them being being phished. This can mean they're actually less alert than they would be otherwise. You get an urgent message from your bank about an unexpected $500 transaction, you follow…

Here's the same story without 2FA:

"You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course. It was a phishing website. Your bank account will be emptied."

It did not reduce security.

Re: Tell HN: SMS-based two-factor authentication is not secure

#205

Post by tialaramex »

dguo wrote: post #171
UncleMeat wrote: post #108

Earlier quoted context omitted.

1. Somebody loads fakebank.com. 2. It pops up a username/password screen. The user types in their credentials for realbank.com. 3a. The owners of fakebank.com use your creds to log in to realbank.com and are presented with a TOTP page. 3b. fakebank.com loads another page that asks the user for their TOTP. The user enters it, still thinking they are logging in to realbank.com 4. The owners of fakebank.com use the TOTP…

This is certainly a vulnerability, but it also depends on how you get your TOTP codes. I use Bitwarden's browser extension to get mine, and if the domain is incorrect, the extension won't present me with the code. I think this is a decent level of protection from phishing.

I encourage you, as an exercise at least, to think about what you'll do when it doesn't work.

You're sure this is the right web site. But Bitwarden won't fill out the code. What could be wrong? Did the idiots who make this web site change the URL?

Now, maybe you're a far above average user and you would calmly determine the exact cause, assuming at every step that the most likely explanation is you're being phished. Hopefully that's more likely now that you've done this exercise. I would love to believe I'm in this category.

But most users will just be frustrated, why wasn't it filled out? Is there a way to get the code from Bitwarden anyway? There is, it's a bit fiddly but you can do it. Lots of users are going to do that. They might even help each other to give their credentials to bad guys, community spirit.

Hopefully some of those users pause because this is unusual and a few of them will realise in that moment that they're being phished. But experiments suggest most won't.

Re: Tell HN: SMS-based two-factor authentication is not secure

#206

Post by jjav »

baybal2 wrote: post #180
u801e wrote: post #169

Earlier quoted context omitted.

I really wish that web browsers had worked on the UI for generating certificate signing requests and importing certificates and that websites had 2FA via username/password along with client-side TLS certificate for authentication. This is more portable than U2F tokens since client-side certificates are part of the TLS standard and should be supported regardless of the application protocol used. Adding other devices c…

It had it! HTML 5 keygen tag https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke... But Mozilla, and Google double teamed to sink it in W3C to push their own bicycle reinvention attempts, which after 10+ years, multiple incompatible versions, and errata ridden revisions are still not there. https://lists.w3.org/Archives/Public/www-tag/2015Sep/0001.ht... Google needs to be kicked out of W3C

Yes! This was a very good solution. Built right into the browser, very convenient. We built a related CA product back in the 90s and were issuing client certs on smarts cards via the browser. Plug in smartcard and browser could automatically authenticate to all services. Take it out and go home.

Re: Tell HN: SMS-based two-factor authentication is not secure

#207

Post by jjav »

jsnell wrote: post #35
staticassertion wrote: post #26

Earlier quoted context omitted.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch. For most of the world, SMS is it. The Nordic countries have th…

> But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security.

It most certainly can reduce security, that's the point. If I don't have a phone number on my account (which I almost universally don't) then no amount of SMS hijacking will ever matter.

If some provider forces me to put a phone number in, now I may be vulnerable to a weakness I didn't want to be vulnerable to. Maaybe today that particular provider uses SMS in a stricly additive sense. Maybe. Just as likely next month they'll redesign their site to be "easier" and add back the vulnerability.

Same with recovery questions. They make the security stricly worse for most people since they are password-equivalents with far lower entropy. Although personally my best friend from high school was named D3ho9WvylJkws1zfAKUxZjdYuCsS.

Re: Tell HN: SMS-based two-factor authentication is not secure

#208

Post by tialaramex »

jsnell wrote: post #204
tialaramex wrote: post #191

Earlier quoted context omitted.

> SMS as a second factor is purely additive. It cannot reduce security. You are forgetting social engineering. Humans find it reassuring that the security process happened as usual, even if in fact the apparently "usual" process was them being being phished. This can mean they're actually less alert than they would be otherwise. You get an urgent message from your bank about an unexpected $500 transaction, you follow…

Here's the same story without 2FA: "You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course. It was a phishing website. Your bank account will be emptied." It did not reduce security.

But in your revised story I don't receive reassurance that everything is going as planned. That's what I'm getting at, the SMS step is reassuring even though it actually shouldn't be.

Re: Tell HN: SMS-based two-factor authentication is not secure

#209

Post by realusername »

addingnumbers wrote: post #72
raesene9 wrote: post #8

Earlier quoted context omitted.

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the ac…

The problem is with most online services, the only second factor allowed is SMS. If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably. It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use…

SMS is the only "second factor" that you can't control at all, your phone number can be changed from the phone company at any point, disabled, or suddenly refuse to work in a foreign country (all of those three happened to me).

For those reasons, even as a second factor it's a terrible one. SMS is just not a good method of authentication at all and has no place in a login form.

At it's best, SMS is only useful as a read-only notification system for non-sensitive purpose.

Re: Tell HN: SMS-based two-factor authentication is not secure

#210

Post by unethical_ban »

rawgabbit wrote: post #106

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to ba…

I only use 2FA if the service provides me with backup codes that I can put in my password safe, which has a unique, long password that is stored and backed up in several places.

If there is not a self-service recovery option for me losing my phone, I won't use it.

---

FWIW I keep a copy on my desktop and on my phone (Keepass) and sync them every few weeks. I try not to add new passwords to my phone copy in order to keep things simple, but Keepass can do diffs and merges.

"But if your safe is owned, then all your accounts are owned!" Yes, that's the balance I take. If someone is able to get my safe and use my bio auth on the phone OR otherwise crack it, I'm screwed.

Post reply on HN