Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

201–210 of 323 posts

Re: Second factor SMS: Worse than its reputation

#201

Post by [deleted] »

lucianbr wrote: post #116
jdiez17 wrote: post #39

Earlier quoted context omitted.

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

There's always a root account, the only issue is who has access to it. So... phones where a corporation has root are more secure that phones where the owner has root, you say? Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you? Again, you're just a few words from "Freedom is slavery".

[deleted]

Re: Second factor SMS: Worse than its reputation

#202

Post by shreddit »

TacticalCoder wrote: post #198

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing " https://online.banking…

So what you are telling me is that windows “recall” feature could actually protect people from phishing attacks…

Re: Second factor SMS: Worse than its reputation

#203

Post by mattigames »

TacticalCoder wrote: post #198

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing " https://online.banking…

Did you just call chatGPT "he"? Oh that may get you in quite a lot of hot water this days!

Re: Second factor SMS: Worse than its reputation

#204

Post by Hello71 »

brandon272 wrote: post #156
Hobadee wrote: post #101

NIST has explicitly said you shouldn't use SMS 2FA for a while now: NIST SP 800-63B §5.1.3.3. https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB

The perspectives and interests of NIST and the things that a service provider has has to worry about with respect to their customer/user experience are not necessarily aligned. Customer: "What do you mean two factor app? I thought the code was supposed to come to my phone?" Support: "It did, but we no longer support SMS two factor authentication." Customer: "But I had no problems when the code came to my phone." Supp…

it would be most convenient to have no 2FA. hell, skip the password too, then nobody will forget theirs. security is tradeoffs, but NIST says "if you take security seriously, you should not use SMS 2FA".

Re: Second factor SMS: Worse than its reputation

#205

Post by compootr »

TacticalCoder wrote: post #198

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing " https://online.banking…

that's called a hallucination. AI models are simply guessing what to say with differing sizes of word banks

At it's best, it may even "recognize" the top 90% of sites. Often, it's not a bulletproof solution, and shouldn't be trusted to generate either false positive/negative

My best operational security advice is not to click shit in your inbox and navigate directly to the hostname you trust to do sensitive actions

Re: Second factor SMS: Worse than its reputation

#206

Post by solardev »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

FYI, passkeys do not require anything in hardware. You can connect them to software only password managers like 1Password or Bitwarden.

Where they are nice though is that they are also tied to a specific origin (domain), so a phishing site can't ask for the real passkey. But I've never seen a passkey be a primary source of authentication, so they can always fool the user to falling back to some weaker auth (email reset or 2fa).

Re: Second factor SMS: Worse than its reputation

#207

Post by beepbooptheory »

TacticalCoder wrote: post #198

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing " https://online.banking…

Did you ask it with the modified page in the same context?

Re: Second factor SMS: Worse than its reputation

#208

Post by swatcoder »

TacticalCoder wrote: post #198

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing " https://online.banking…

I know everybody's doing it because they don't know better, but it's a terrible idea to make the inductive leap from one successful sample to some abstract sense of what a ML model is suited for. Especially for anything important.

As a sibling comment noted, performance will almost certainly be sensitive to temperature (randomness), exact prompt phrasing, exact sequence of messages in a dialog, and the training-data frequency of both the site being analyzed and the phishing approach used.

One could conceivably train a specialized ML model, perhaps with an LLM component, to detect sophsticated phishing attempts and I would assume this has even been done.

But using a relying on generic "helpful chatbot" to do that reliably and sufficiently is a really bad idea. That's not what it's for, not what's good at, and not something its vendor promises for it to remain good at even if it happens to be today.

Re: Second factor SMS: Worse than its reputation

#209

Post by alistairSH »

bckr wrote: post #43
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank

Or skip the website and use their native app.

Re: Second factor SMS: Worse than its reputation

#210

Post by smeej »

Tepix wrote: post #109
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Kraken is a cryptocurrency exchange that utilizes (at least) two different TOTP codes, one for login and one for money transfers.

For a long time (still?) Kraken also refused to add SMS 2FA as an option due to its weak security.

I still don't see how that's worse than no 2FA at all, which was an option, but I appreciated that they were banging the "SMS 2FA isn't very secure" drum.

Post reply on HN