Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

221–230 of 323 posts

Re: Second factor SMS: Worse than its reputation

#221

Post by S201 »

crazygringo wrote: post #136
didntcheck wrote: post #38

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

That is a security win. On a rooted phone, you've made it possible for other apps to spy on and steal your banking information. Bank apps not running on phones where security has been compromised seems entirely reasonable.

> Bank apps not running on phones where security has been compromised seems entirely reasonable.

I have root access on my laptop and I log in to my bank's website just fine. Making apps not run on rooted phones is just perpetuating the cycle of forcing users to comply with the restrictions placed upon them by Apple and Google. Root access != less secure. It means control over the device you paid for and own.

Re: Second factor SMS: Worse than its reputation

#222

Post by slow_typist »

sleepyhead wrote: post #11
slow_typist wrote: post #4

Earlier quoted context omitted.

Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).

We at MakePlans were affected by this breach as we use Twilio. We are not using Twilio Verify (their 2FA api) but rather handle 2FA SMS ourselves in our app using Twilio as one of our providers. So the CCC definition of this being only 2FA-SMS is incorrect, it was all SMS sent through this Twilio third party gateway that was exposed to a limited set of countries (France, Italy, Burkina Faso, Ivory Coast, and Gambia).…

I think 2FA via texts is better than no 2FA. But only if you do not make the texts world readable.

Apart from that, to me it seems justifiable to follow a risk based approach. Booking systems up to a certain value/amount, fine. Online Banking and health related services, thank you, no.

Re: Second factor SMS: Worse than its reputation

#223

Post by gcr »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Your solution wouldn’t have prevented the attack you describe unless the user can immediately tell the difference between login 2FA codes and “new payee” 2FA codes and knows not to enter one code into the wrong form.

Re: Second factor SMS: Worse than its reputation

#224

Post by namibj »

bux93 wrote: post #61
rlpb wrote: post #45

Earlier quoted context omitted.

> So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. My understanding of EU regulation is that it effectively requires this by requiring the 2FA to validate not just the identity but also the transaction (such as an amount, or d…

Yes, the Payment Services Directive requires "dynamic linking" to a specific amount and a specific payee in article 97, and the RTS in article 5 go on to say that the payer should be "made aware of the amount of the payment transaction and of the payee". The most elegant implementation I saw of this were card readers with a 2D (colored) barcode scan ; the 2D barcode contained transaction details that the card reader…

I preferred the blinky bars; the reader for them is tiny, not locked to an account, battery lasts what feels like forever, and they're cheap enough that you can trivially eat a loss (from forgetting where it is or leaving it in a place where it disappears before you get a chance to collect it).

Maybe just stick an airtag to the back?

Re: Second factor SMS: Worse than its reputation

#225

Post by freeopinion »

freeopinion wrote: post #169
bckr wrote: post #43

Earlier quoted context omitted.

Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank

I'd like to throw a little blame onto many namebrand websites. Sites like Digital Ocean try to load dozens of third-party trackers for a single page. Their supposedly secure payment processing includes cross-site violations that are blocked by modern browsers. When their credit card management pages fail to work with reasonable browser defaults or sane browser add-ons they immediately advise their users to strip out…

I'd be interested in anybody explaining why a welcome page needs assets from 17 other domains, including paypal and stripe.

https://cloud.digitalocean.com/welcome

Why are multiple payment processors included on this page that doesn't involve any payment?

Re: Second factor SMS: Worse than its reputation

#226

Post by lolinder »

rafram wrote: post #70
elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!

> the new SSNs - unique identifiers that never change and connect you across services

And just like SSNs both the "unique" and the "never change" are only true of the spherical cow version of the system. Phone numbers are actually substantially worse at being unique and unchanging, what with people in families sharing a phone or trading phone numbers, people forgetting to transfer the number when switching carriers, people intentionally switching numbers in an attempt to end spam calls... The number of ways to break the assumed invariants is actually quite high.

See Falsehoods Programmers Believe About Phone Numbers [0].

[0] https://github.com/google/libphonenumber/blob/master/FALSEHO...

Re: Second factor SMS: Worse than its reputation

#227

Post by lolinder »

arp242 wrote: post #132
nolist_policy wrote: post #107

Earlier quoted context omitted.

No, most companies actually want your phone number for spam prevention. I think the contribution of Spammers to the decline of the Internet is underrated.

Only by those who never worked on these kind of services. Running something like a webmail service is being flypaper for dickheads. As soon as you gain any sort of popularity you will have some very hard and sharp lessons about the lengths spammers will go through to make abuse your service. First rule of designing anything: "if some cunt can make a buck by completely fucking over your system then that cunt will comp…

You don't even have to be running a webmail service, the instant you use any service to send an email with even one user-controlled field (even something as innocuous as their name) you already have a problem.

Re: Second factor SMS: Worse than its reputation

#228

Post by TonyTrapp »

commandersaki wrote: post #32
TonyTrapp wrote: post #27

Earlier quoted context omitted.

It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.

I don't see why SMS would need to write to a store, public or not. One can implement SMS-2FA using TOTP for example, it's just that the TOTP secret is not shared with the recipient.

Yes, it is not a technical necessity to store these messages. But there is the option to do it (and some people are evidently doing it). The point is that for one-time-passwords, it's not even an option, not matter how hard you try. You simply cannot make this class of mistake. Unless you try really really hard to fuck up and, say, for some very weird reason, exfiltrate the one-time passwords generated on the user's device every few seconds.

Re: Second factor SMS: Worse than its reputation

#229

Post by lmz »

S201 wrote: post #221
crazygringo wrote: post #136

Earlier quoted context omitted.

That is a security win. On a rooted phone, you've made it possible for other apps to spy on and steal your banking information. Bank apps not running on phones where security has been compromised seems entirely reasonable.

> Bank apps not running on phones where security has been compromised seems entirely reasonable. I have root access on my laptop and I log in to my bank's website just fine. Making apps not run on rooted phones is just perpetuating the cycle of forcing users to comply with the restrictions placed upon them by Apple and Google. Root access != less secure. It means control over the device you paid for and own.

I don't think the root permission ban is for the website. In most cases it's about how your phone + the bank's app has become the new hardware token / key generator. Before smartphones I could log on to the bank's website but any transaction will have to be authenticated using a hardware token (presumed secure). That's moved into an app now.
Post reply on HN