Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker got all my texts for $16

vice.com

Post reply on HN
Print view View original

231–240 of 296 posts

Re: A hacker got all my texts for $16

#231

Post by decrypt »

neartheplain wrote: post #207
albertgoeswoof wrote: post #204

Earlier quoted context omitted.

That’s great until your users lose/break their phone and have no backups for their 2FA codes. “Sorry you’re locked out forever, good luck lol” Is not a response you can give to them.

Printed/saved backup codes are still an option. Can also attach multiple 2FA tokens to one account. That's what Google and many others provide. Their customers seem satisfied.

>Can also attach multiple 2FA tokens to one account

This is new to me. Most websites that I have seen offer only one 2FA token, but it could be scanned on any number of TOTP apps.

Re: A hacker got all my texts for $16

#232

Post by jfrunyon »

supernova87a wrote: post #181
jfrunyon wrote: post #166

Earlier quoted context omitted.

Unfortunately, Fidelity (at least for my account) only offers some non-standard "Symantec VIP" product. Does someone reading this know if there's a way to turn it into standard TOTP?

Yes, Symantec VIP is their TOTP solution they're chosen. Etrade also uses it. I find it less friendly than the normal QR code, since you can't back it up or clone it (and it's proprietary, although that is not a huge concern for me). Basically the app is both the server and the code generator (?) because the website you log on to does not issue you a shared secret, the app creates it itself. Every device has its own…

I was able to find this. Haven't attempted it yet but it appears that it is in fact standard TOTP, only the VIP app generates the seed and you have to provide the seed to (in this case) Fidelity. https://gist.github.com/jarbro/ca7c9d3eebba1396d53b4a7228575...

And yeah, my biggest problem with it is that I already have a solution for TOTP; I don't really want to also figure out some solution for their proprietary garbage.

Re: A hacker got all my texts for $16

#233

Post by UncleMeat »

arsome wrote: post #103
UncleMeat wrote: post #98

Earlier quoted context omitted.

TOTP is only better than SMS against SIM swapping, a rare threat. They are identical against phishing, an enormously more common problem. For a typical user the delta in security when transitioning from SMS to TOTP is minimal.

... or trivial number porting attacks like the one described in this exact article. Depends on your threat model, but unlike SIM swapping this may not be out of the reach of even a mildly technical angry ex.

And a mildly technical angry ex is a lot less likely than phishing. These are valuable topics but people go way way way too far and say that SMS is horrible and should be basically banned while TOTP is fabulous and a completely viable alternative, which is just fantasy.

Re: A hacker got all my texts for $16

#234

Post by goblin89 »

berkes wrote: post #209
albertgoeswoof wrote: post #204

Earlier quoted context omitted.

That’s great until your users lose/break their phone and have no backups for their 2FA codes. “Sorry you’re locked out forever, good luck lol” Is not a response you can give to them.

I've never encountered this. All of my 20-something 2fa tokens I could recover with processes ranging from making videocalls to identify myself to getting a 24 hour slot in which all but the 2fa reset was locked.

I’d be curious to know which services are confirmed to have solid 2FA reset practices (i.e., you can do it if you lose your keys; no one else can do it).

These would probably be smaller businesses that earn their revenue directly from paying customers (and would lose if you give up and cancel your card/block their transactions)—I can’t imagine this ever working for ad-driven whales like Google or Facebook, or large corporations to whom you’re small fish and need them more than they need you.

Also, it’ll be interesting to see how 2FA reset options evolve in near future. A 24-hour slot to reset only 2FA, for example, looks like a valid attack vector. Also, I suspect deepfaking videocalls won’t be out of reach of a dedicated but average attacker for long.

Re: A hacker got all my texts for $16

#235

Post by jfrunyon »

tialaramex wrote: post #211
jfrunyon wrote: post #157

Earlier quoted context omitted.

Sure, and instead, people use apps like Signal or WhatsApp, which are tied to phone numbers, on which the attacker can now register to your phone number thanks to his receiving your SMS...

If you tell Signal not to allow anybody else to re-register from your phone number without your PIN it will enforce this until at least seven days passes without you using Signal. If you've uninstalled Signal or just never use your phone then yeah, after a week or so this proposed attack "works" and the safety numbers for any ongoing conversations with anybody reset (the attacker doesn't know the long term identity k…

> If you tell Signal not to allow

Big if already

> the safety numbers for any ongoing conversations with anybody reset ... which will be notified to the other participants

"Hi , I have a new device, can you help me ____"

Re: A hacker got all my texts for $16

#236

Post by jfrunyon »

albertgoeswoof wrote: post #204
jfrunyon wrote: post #141

Reminder: SMS 2FA adds only a negligible amount of security, if your company does 2FA via SMS you're doing nothing more than lulling your users into a false sense of security. Don't do it. Support proper 2FA. (And while you're at it, allow your users to decide how much they care about their account. Don't make the decision for them.)

That’s great until your users lose/break their phone and have no backups for their 2FA codes. “Sorry you’re locked out forever, good luck lol” Is not a response you can give to them.

There are many, many ways to handle backup authentication. SMS is not one of them.

Re: A hacker got all my texts for $16

#237

Post by jfrunyon »

freebuju wrote: post #226
neartheplain wrote: post #207

Earlier quoted context omitted.

Printed/saved backup codes are still an option. Can also attach multiple 2FA tokens to one account. That's what Google and many others provide. Their customers seem satisfied.

> Printed/saved backup codes are still an option Vast majority of users don't bother with such complexities. SMS is the easiest minimum entry barrier to 2FA. It is better than having just passwords.

> It is better than having just passwords.

That is false. Many incidents have been widely reported where huge names, who certainly could afford even a $50 hardware token to protect their reputation/brand, were 'hacked' because they thought SMS 2FA protected them - and it didn't. Even with services which do also offer TOTP or U2F etc.

Re: A hacker got all my texts for $16

#238

Post by swiley »

albertgoeswoof wrote: post #204
jfrunyon wrote: post #141

Reminder: SMS 2FA adds only a negligible amount of security, if your company does 2FA via SMS you're doing nothing more than lulling your users into a false sense of security. Don't do it. Support proper 2FA. (And while you're at it, allow your users to decide how much they care about their account. Don't make the decision for them.)

That’s great until your users lose/break their phone and have no backups for their 2FA codes. “Sorry you’re locked out forever, good luck lol” Is not a response you can give to them.

That's part of a well secured account. You don't need this for everything just two or three super important things (bank, dns etc.)

Re: A hacker got all my texts for $16

#239

Post by Sleepytime »

heroprotagonist wrote: post #230
Mandatum wrote: post #46

In Australia it's mandated you're sent a message before rerouting or migrating to another provider. Surprised this isn't enforced in the other countries, it costs next to nothing to implement and is just an additional step in the account migration process. I'd love to see companies allow for opt in additional security measures, like banks or telco's calling me - having a verbal password to confirm things, that level…

I tried to get T-Mobile to stop giving my location to anyone that hits their APIs with a 'Yes I have permission' flag set. There's no opt-out for it, and no enforcement of the permission requirement. Their support had me snail mail a letter to some PO box. I never got a response. And now they're going to start outright selling their customer activity after forcibly un-opt-outing* everyone who opted out in their priva…

I haven't heard anything about a t-mobile api leaking that data and my searches doetsn't return anything of value, can you provide more details?

Re: A hacker got all my texts for $16

#240

Post by [deleted] »

jfrunyon wrote: post #237
freebuju wrote: post #226

Earlier quoted context omitted.

> Printed/saved backup codes are still an option Vast majority of users don't bother with such complexities. SMS is the easiest minimum entry barrier to 2FA. It is better than having just passwords.

> It is better than having just passwords. That is false. Many incidents have been widely reported where huge names, who certainly could afford even a $50 hardware token to protect their reputation/brand, were 'hacked' because they thought SMS 2FA protected them - and it didn't. Even with services which do also offer TOTP or U2F etc.

[deleted]
Post reply on HN