Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

241–250 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#241

Post by seadan83 »

apexalpha wrote: post #175
nelblu wrote: post #159

Some of the comments pointed out that this is hostile behaviour for people roaming as well, and I completely agree. Here is my solution for this : When I am roaming internationally, I leave my SIM card in a spare android at home plugged into a charger. Android has an app that forwards SMS to API : https://f-droid.org/packages/tech.bogomolov.incomingsmsgatew... . Every time I receive a SMS I forward it to this API. Th…

I’m sorry how is this related to roaming? I roam all the time in Europe and have roamed a lot outside of it, I have never had any trouble receiving any SMS?

A lot of US carriers charge per SMS when roaming (as if it were 2006).

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#242

Post by seadan83 »

vanburen wrote: post #56
ethersteeds wrote: post #50

Earlier quoted context omitted.

While that is a solution someone could use, it wouldn't work for the subject here: > she usually doesn't even have service 100 meters down the road.

Yeah wont work for everyone, but a directional antenna mounted high up on house might have a better chance than a phone antenna.

MOUNTAIN valleys, need to get WAY higher up than the top of the house.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#243

Post by jabzd »

jjice wrote: post #52
lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.

We actually had it that way on accident in a few of our applications - we had a `#isTextable(e164)` function that would do a carrier lookup and voip carriers sometimes returned as landlines or as arbitrary values that didn't mean mobile. We eventually did some work to refine that function to be smarter and actually better represent if the number was textable. At least for us, it wasn't a conscious decision, it was a gate being aggressive in our SMS pipeline.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#245

Post by joe_the_user »

i did some digging, and it turns out messages from 5 digit shortcodes often aren't supported over wifi calling. sometimes they are, but in her case they're clearly not.

This seems like a rather specific problem that isn't related to mountain people as such but services blocking "shortcodes" apparently for a variety of reasons. It is true that text and call reliability is becoming a real problem generally where you have these authentication issues. I myself in the mountains and have dealt with reliability issues.

Here's a discussion of this specific problem with T-mobile: https://www.reddit.com/r/tmobile/comments/ardcnc/aargh_final...

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#246

Post by olalonde »

TonyTrapp wrote: post #26
Neywiny wrote: post #13

Much agreement with the others that there's too much expectation. I rented a lime scooter for the first time last year. But, I messed up my VPN settings so I had no Internet. There was no way to tell the scooter I'm done. Even though it was stopped, no button to end the ride. They refunded me the extra time (which was maybe 5 of the 10 minutes) because they could see it was just stopped at a bike rack on gps. Idk wha…

Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.

1) It's possible they do not have an Internet connection. In fact, it doesn't seem necessary.

2) Bluetooth can ensure that you are in proximity of the locker, otherwise you could accidentally unlock a locker while standing at the wrong rack.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#247

Post by quesera »

lxgr wrote: post #226
ravenstine wrote: post #85

Earlier quoted context omitted.

Execs at those companies probably think "Google = good".

I don't think SMS senders can actually tell the difference between Google Voice and other VoIP providers.

Twilio has a lookup API, which returns the subscriber name and carrier.

Here's an example response (subscriber name redacted):

  {
    "data": {
      "name": "LASTNAME, FIRSTNAME",
      "line_provider": "Google/Bandwidth.com (SVR)",
      "carrier": "Bandwidth.com",
      "line_type": "landline"
    }
  }

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#248

Post by jdofaz »

unethical_ban wrote: post #66
jjice wrote: post #52

Earlier quoted context omitted.

It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.

I absolutely cannot stand that no bank I have (US) supports generic TOTP, which is more secure and easier to recover from backup if my phone is broken or stolen. It's inexcusable.

Copper State Credit Union supports passkey

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#249

Post by quesera »

lxgr wrote: post #228
rsync wrote: post #219

Earlier quoted context omitted.

"port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi" ... "... unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons ..." Correct. This is, in fact, a terrible idea because even if you do find a VOIP provider that can receive SMS from "short codes" (the weird little numbers your bank sends codes from)…

> Your bona fide mobile phone number is a "proof of work" that these providers are relying on in absence of any real solution to this problem. Exactly, and I simply refuse to do their work.

... and they have decided to ignore you as a customer, because the risk of allowing VoIP numbers is greater than you are valuable.

So, everybody wins. :(

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#250

Post by neilv »

zzo38computer wrote: post #227
neilv wrote: post #171

Not only SMS 2FA, but in the past maybe couple years, many sites have been making their logins worse in many ways. For example, I'm actually liking Walmart.com more than Amazon in some ways lately, but logging into Walmart.com takes minutes while I wait for the 2FA after I already password authenticate. So Amazon wins all the casual browsing and impulse sales, and by the time I do log in to Walmart.com, it's only bec…

Putting the username and password fields together has other advantages than you mentioned. It means no additional requests (or JavaScripts or CSS) are required between entering the username and password, and it also makes it more difficult for attackers to guess usernames. I would want to see X.509 client authentication used more often. It has many advantages, such as: - Cookies and JavaScripts are not required. - Th…

I kinda like client certificates, and have made simple uses of them, for Web services and occasionally corporate-internal humans.

But with the current browser support, client certs haven't seemed viable for consumer sites. Unless the browser developers are inspired to offer better support for mass consumer users, but I couldn't make a strong case why they should.

(I'd rather most consumer sites resume making password authn work well, and then have them integrate 2FA judiciously and well. And stop with some of the counterproductive surveillance capitalism mechanisms.)

Post reply on HN