Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#211

Post by dheera »

tialaramex wrote: post #201
dheera wrote: post #175

Earlier quoted context omitted.

The only thing I wish is that more sites support multiple tokens, since tokens can get lost. If you only support one token but have an easy recovery procedure, that opens up loopholes. If you support multiple tokens, allow the user to de-activate one token from another token, and make recovery difficult, that's much more secure.

Again, other than AWS which "more sites"? Dropbox, Facebook, Google, GitHub, GitLab, even Login.gov works fine with multiple tokens. More sites should do WebAuthn (you should not do greenfield deployments of U2F today, WebAuthn is the standard). Yes, AWS should fix their feature but that shouldn't block the next ten would-be Unicorns from doing WebAuthn.

Twilio, Kraken, Paypal, Gusto, Bittrex, Coinbase, ...

Re: Tell HN: SMS-based two-factor authentication is not secure

#212

Post by platty »

I had this happen with AT&T. Someone bought a new phone on my account with a phone upgrade, they transferred my service to the new phone, and I had to go through a ton of headache getting them to give me my service back to my old phone and trying to figure out what happened.

At the end, they acknowledged it was fraud. Additionally, added guards on the account with an additional passcode and wording stating that a person must confirm with me specifically before anything like transferring services is done again.

It did however blow my mind that something like that could happen and if someone intended on getting access to my accounts, the situation could have been much worse.

Re: Tell HN: SMS-based two-factor authentication is not secure

#213

Post by dheera »

rsgrn wrote: post #198
dheera wrote: post #170

Earlier quoted context omitted.

SMS is not a good second factor, even as a second factor. I deprecated SMS 10 years ago and the only way I receive SMS codes is via an online interface that is password access. For most people, SMS fails miserably when you need to change your SIM card or fly to another country, or work out of a place with no cell reception but has wired or wi-fi internet access. That's a big part of the reason why I deprecated it in…

How do you direct SMS to the online interface?

Twilio

Re: Tell HN: SMS-based two-factor authentication is not secure

#214

Post by NotEvil »

andmalc wrote: post #200
esolyt wrote: post #86

Earlier quoted context omitted.

I'm glad someone is bringing this up. I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

Password managers such as 1Password and Bitwarden can save and fill in TOTP codes. Maybe not perfect security but a big win for convenience and loss prevention.

I have received advice from way to many people to not use your password manager as a 2nd factor be ause 1) It's actually become the only point if failure (your pw getting hacked). 2) Both factors protected and saved on the same spot

Re: Tell HN: SMS-based two-factor authentication is not secure

#216

Post by dageshi »

esolyt wrote: post #86
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I'm glad someone is bringing this up. I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

Don't most 2fa systems have recovery codes? You print em off or encrypt them with a one time password?

Re: Tell HN: SMS-based two-factor authentication is not secure

#217

Post by tgsovlerkhgsel »

Wowfunhappy wrote: post #22
staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

One of the problems here is that few sites support U2F, and even fewer support it properly.

Proper support would mean allowing multiple tokens, so that you can have one permanently on your keychain, one permanently in your computer at home, and an off site backup pair that you rotate (enroll the one that is at home, then swap and enroll the other one).

On desktop, touching a U2F token is a lot easier than typing numbers from a SMS, and it actually protects against one of the biggest threats, phishing (the SMS does not - if the phisher bothers to ask for it, the user, who thinks that they're logging into the legit web site, will enter it).

Re: Tell HN: SMS-based two-factor authentication is not secure

#218

Post by tgsovlerkhgsel »

jjav wrote: post #202
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

You can also "loose, etc" the phone so it is equally weak on that front. Except the SIM can be hijacked, so SMS is strictly worse and never better. Best compromise between usability, access and recovery is to always use TOTP but be sure to always securely back up the secret offline. Don't ever just scan it into a single device, as then you're back to being able to lose it and be locked out.

The advantage with the phone is that the web site operator can pawn off the difficult recovery part on your mobile provider (go there, show ID, get a new SIM).

IMO both the mobile provider and the web site operator should be jointly liable for damages resulting from SMS 2FA abuse. The mobile operator for giving access to your phone number to an unauthorized person, the web site operator for using a known insecure technique.

Both the number of successful hijackings and companies using SMS 2FA would drop drastically.

Re: Tell HN: SMS-based two-factor authentication is not secure

#219

Post by cromka »

oezi wrote: post #187
3np wrote: post #116

What really grinds my gears is the seemingly unstoppable global transition towards SMS to a mobile phone number as means of identifying an individual, conflated with "security" through 2FA/account recovery, with this as the only option. This is especially popular within Fintech. Wise (formerly Transferwise) recently started requiring 2FA for signing in - SMS is the one and only option. Revolut requires it for acknowl…

Well, the European PSD2 has forbidden the use of SMS TANs last year for banking applications while requiring much more stringent 2FA use (for account balances more than 30 days in the past for instance). So, I would say quite the opposite to unstoppable.

Yep, and the banks are literally reaching the deadline as we speak. All my EU banks are notifying me that within a week or so the SMS codes will stop working, and their mobile app will be required for 2FA.

Re: Tell HN: SMS-based two-factor authentication is not secure

#220

Post by tialaramex »

dheera wrote: post #211
tialaramex wrote: post #201

Earlier quoted context omitted.

Again, other than AWS which "more sites"? Dropbox, Facebook, Google, GitHub, GitLab, even Login.gov works fine with multiple tokens. More sites should do WebAuthn (you should not do greenfield deployments of U2F today, WebAuthn is the standard). Yes, AWS should fix their feature but that shouldn't block the next ten would-be Unicorns from doing WebAuthn.

Twilio, Kraken, Paypal, Gusto, Bittrex, Coinbase, ...

But none of these support U2F or WebAuthn at all. The problem isn't that they need to support "multiple" tokens except in the sense that they don't support any at all.
Post reply on HN