Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol • Hacker News Board

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#221

Post by thaumasiotes » Sun, May 07, 2017, 2:44 AM UTC

acdha wrote: post #220

thaumasiotes wrote: post #214

Earlier quoted context omitted.

Only your third point is actually a conceptual difference from passwords. In terms of the common idea that 2FA should be "something you have" plus "something you know", a TOTP seed is "something you know", not "something you have", but everyone talks as if the opposite were true.

Think about it a bit longer: 1. Passwords are selected by the user; you cannot prevent reuse. While it's technically possible that a site could allow you to set the TOTP seed nobody does. 2. Password entropy is notoriously hard to calculate programmatically – e.g. well known movie passwords or leet-speak are often judged as stronger than shorter true-random sequences – but you generate the TOTP seed. 4. As with #1, p…

> “something you know" can be told to someone else, which isn't true of TOTP. It's also always valid and reusable whereas the one-time code is closer to an on-demand verification

This is not correct. When I set up TOTP 2FA, the site generates a seed and tells it to me. It is always valid and always reusable, and it's no more difficult for me to communicate it to anyone else than it was for the site to communicate it to me.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#222

Post by acdha » Sun, May 07, 2017, 2:16 PM UTC

thaumasiotes wrote: post #221

acdha wrote: post #220

Earlier quoted context omitted.

Think about it a bit longer: 1. Passwords are selected by the user; you cannot prevent reuse. While it's technically possible that a site could allow you to set the TOTP seed nobody does. 2. Password entropy is notoriously hard to calculate programmatically – e.g. well known movie passwords or leet-speak are often judged as stronger than shorter true-random sequences – but you generate the TOTP seed. 4. As with #1, p…

> “something you know" can be told to someone else, which isn't true of TOTP. It's also always valid and reusable whereas the one-time code is closer to an on-demand verification This is not correct. When I set up TOTP 2FA, the site generates a seed and tells it to me. It is always valid and always reusable, and it's no more difficult for me to communicate it to anyone else than it was for the site to communicate it…

Again, think of what that means in normal usage: it's technically possible but there's no UI to do it and in cases like iOS the system actively blocks it.

If you're building a consumer service, that's a big improvement over someone picking their dog's name and saving it in a Word doc on their desktop.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#223

Post by StavrosK » Sun, May 07, 2017, 10:00 PM UTC

scrollaway wrote: post #218

StavrosK wrote: post #171

Earlier quoted context omitted.

Haha, I love the reasoning there. I haven't, but you're right, I should.

Well if you manage to do that, let me know. To my knowledge creating a text/voice compatible Google Voice number is not possible in europe.

I had created one when I was in the US, so I do have one. I can't add a European phone number to it, but I can receive SMS with it.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#224

Post by Eridrus » Mon, May 08, 2017, 2:59 AM UTC

bostik wrote: post #158

cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

> fingerprints have the unfortunate property of not being rotatable if compromised Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home. But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern…

Fingerprints can certainly be "amputationware" if you refuse to give up your passcode and your threat model has a credible threat of amputations.

For most people, having their unlocked phone snatched out of their hands on the street[0] is a far more credible threat and somehow we don't have everyone saying you shouldn't unlock your phone outside.

[0] https://www.theverge.com/2016/12/2/13819288/uk-police-encryp...

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#225

Post by virgilp » Fri, May 12, 2017, 8:45 AM UTC

thaumasiotes wrote: post #221

acdha wrote: post #220

Earlier quoted context omitted.

Think about it a bit longer: 1. Passwords are selected by the user; you cannot prevent reuse. While it's technically possible that a site could allow you to set the TOTP seed nobody does. 2. Password entropy is notoriously hard to calculate programmatically – e.g. well known movie passwords or leet-speak are often judged as stronger than shorter true-random sequences – but you generate the TOTP seed. 4. As with #1, p…

> “something you know" can be told to someone else, which isn't true of TOTP. It's also always valid and reusable whereas the one-time code is closer to an on-demand verification This is not correct. When I set up TOTP 2FA, the site generates a seed and tells it to me. It is always valid and always reusable, and it's no more difficult for me to communicate it to anyone else than it was for the site to communicate it…

Well, technically, everything that you have (and can provide as "proof") is susceptible to being interpreted as "something you know". If I know enough about that thing that you have, I can probably manufacture a good-enough replica that I can provide as "proof of ownership".

Think of the physical one-time tokens: If I know the data stored on it, I can replicate them too. So, are they "something you have", or "something you know"? The reason why they're "something you have" is that it's easier to have the physical ownership of the device, than to know they "secret" of the device. But, the same is true about Google Authenticator! In that respect, Google Authenticator can be, indeed, interpreted as "something you have".