Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#231

Post by bkdbkd »

jrochkind1 wrote: post #197
rawgabbit wrote: post #106

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to ba…

> As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling Uh... what does (in)secure mean to you?

exactly. "its not that the lock is insecure, its just that sometimes thieves figure out how to make keys."

Re: Tell HN: SMS-based two-factor authentication is not secure

#232

Post by oezi »

tgsovlerkhgsel wrote: post #221
oezi wrote: post #187

Earlier quoted context omitted.

Well, the European PSD2 has forbidden the use of SMS TANs last year for banking applications while requiring much more stringent 2FA use (for account balances more than 30 days in the past for instance). So, I would say quite the opposite to unstoppable.

And because it has not required some open standard as a replacement, I now have hundreds of MB of different bloatware bank apps on my phone, each of which I have to use in a slightly different way when logging into my bank accounts, usually with scanning barcodes or remembering yet another PIN. Migrating to a new phone is a nightmare. For extra convenience, PSD2 also mandated a logout after 5 minutes of inactivity. S…

Absolutely agreed. I expect consolidation to happen in the next couple of years on this. Banks who do it well, will win customers.

Re: Tell HN: SMS-based two-factor authentication is not secure

#233

Post by brewdad »

NotEvil wrote: post #214
andmalc wrote: post #200

Earlier quoted context omitted.

Password managers such as 1Password and Bitwarden can save and fill in TOTP codes. Maybe not perfect security but a big win for convenience and loss prevention.

I have received advice from way to many people to not use your password manager as a 2nd factor be ause 1) It's actually become the only point if failure (your pw getting hacked). 2) Both factors protected and saved on the same spot

I use BitWarden for my passwords while storing my 2FA backups in KeePass for exactly this reason.

Re: Tell HN: SMS-based two-factor authentication is not secure

#234

Post by jsnell »

tialaramex wrote: post #208
jsnell wrote: post #204

Earlier quoted context omitted.

Here's the same story without 2FA: "You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course. It was a phishing website. Your bank account will be emptied." It did not reduce security.

But in your revised story I don't receive reassurance that everything is going as planned. That's what I'm getting at, the SMS step is reassuring even though it actually shouldn't be.

If there is no 2FA, not being asked for a confirmation code is things going as normal. Also, it's totally irrelevant whether the user gets cold feet since in the password-only world they've just handed away the keys to the kingdom.

Re: Tell HN: SMS-based two-factor authentication is not secure

#236

Post by matheusmoreira »

rawgabbit wrote: post #106

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to ba…

> Consumers would go to the US Post Office or DMV and purchase a Yubi key from them.

> The additional value they add, is they can verify the identity of the consumers who is purchasing the Yubi key and replace the key if it is lost/stolen.

This is exactly how digital signatures work in my country. A government institution vouches for digital certificate companies which verify and certify people's identities. It can be used to file taxes and lawsuits, for example. To most people this is just yet another layer of bureaucracy.

Re: Tell HN: SMS-based two-factor authentication is not secure

#237

Post by UncleMeat »

derefr wrote: post #196
UncleMeat wrote: post #194

Earlier quoted context omitted.

> Every modern TOTP app is cloud-synced I've got a few services that only support Symantec VIP, which does not allow you to extract secrets. > Sufficient paranoia / user training is enough to protect against phishing. Considering how easily actual factual professional security engineers fall for phishing, I don't believe you.

> Symantec VIP See https://www.reddit.com/r/1Password/comments/8yey6y/how_do_i_... (PITA, I know, but running little auth gateways like this is part-and-parcel of doing security for an org.) > Considering how easily actual factual professional security engineers fall for phishing, I don't believe you. It's almost always the service's fault for being designed in such a way that its real async user interactions are ind…

I do use a similar approach to backup the Symantec secret - but what percentage of users do you think are capable of doing this? 0.1%?

> It's hard to train users to not forward TOTP tokens sent to them to someone else, if the real service will text or push-notifies the user their TOTP token "at random" (i.e. because the attacker tried to log in.) But if the service never does that — if you always have to go and fetch the token from your TOTP app — then you can just tell the user that the only time they are to go do that, is right after they've typed their username and password as part of logging in themselves; and that anything else is a phishing attempt.

A phishing attempt will do precisely this. You get a fake login page, type in your creds, and then you get a fake TOTP page.

> It's hard to train users to not type their username+password into phishing login pages, if the services you use constantly send you emails containing deep links. But if the service never does that — if the service always tells you to go your browser and navigate to the site yourself — then it's easy to teach users to never trust a login initiated through an email.

In a prior life I did some research on phishing. It is embarrassingly easy to fool even professional security researchers. Nobody is capable of consistently preventing phishing by using their own eyes and brain.

Re: Tell HN: SMS-based two-factor authentication is not secure

#238

Post by matheusmoreira »

toss1 wrote: post #99
artificialLimbs wrote: post #90

Earlier quoted context omitted.

What's the reasoning behind that? Maybe to prevent bots?

I'd start with VOIP numbers being so easy to spoof... and move onto the entire telephone network being insanely insecure and unverified, despite decades of efforts to link people to telnos -- until they implement actual caller-recipient full verification, they've effectively got nothing.

> until they implement actual caller-recipient full verification

Is it even possible to do this at this point? I'd expect something like this to fundamentally change the way telephone networks work.

Re: Tell HN: SMS-based two-factor authentication is not secure

#239

Post by scottmcdot »

Having had this almost happen to me, I always strongly recommend that you remove your phone number from Gmail as a recovery method. And then go and test it out to double check.

SMS 2fa is okay but SMS recovery is not okay and high risk.

It's also ideal to have obscure email addresses used for, say, coinbase so that in the data dump they they likely have, containing your email to phone number mapping, points them to the email address not linked to coinbase.

Post reply on HN