251–260 of 328 posts
Earlier quoted context omitted.
I’m sorry how is this related to roaming? I roam all the time in Europe and have roamed a lot outside of it, I have never had any trouble receiving any SMS?
A lot of US carriers charge per SMS when roaming (as if it were 2006).
Earlier quoted context omitted.
A lot of US carriers charge per SMS when roaming (as if it were 2006).
Sure but with 2FA you only recieve SMS so so what?
>> Some of the comments pointed out that this is hostile behaviour for people roaming as well
> I’m sorry how is this related to roaming?
Earlier quoted context omitted.
I don't think SMS senders can actually tell the difference between Google Voice and other VoIP providers.
Twilio has a lookup API, which returns the subscriber name and carrier. Here's an example response (subscriber name redacted): { "data": { "name": "LASTNAME, FIRSTNAME", "line_provider": "Google/Bandwidth.com (SVR)", "carrier": "Bandwidth.com", "line_type": "landline" } }
Earlier quoted context omitted.
Putting the username and password fields together has other advantages than you mentioned. It means no additional requests (or JavaScripts or CSS) are required between entering the username and password, and it also makes it more difficult for attackers to guess usernames. I would want to see X.509 client authentication used more often. It has many advantages, such as: - Cookies and JavaScripts are not required. - Th…
I kinda like client certificates, and have made simple uses of them, for Web services and occasionally corporate-internal humans. But with the current browser support, client certs haven't seemed viable for consumer sites. Unless the browser developers are inspired to offer better support for mass consumer users, but I couldn't make a strong case why they should. (I'd rather most consumer sites resume making password…
OK, I agree, stop with the counterproductive surveillance capitalism mechanisms.
Making password authn work well (using the ideas you mention about improving it) and integrating 2FA (also improving it in the ways you mention), would also be OK, although that should be an alternative choice, so that users who do want to use X.509 and are able to do so, can use that more secure mechanism and not requiring other mechanisms. The 2FA really shouldn't be required especially when it causes problems (such as the ones mentioned in the "SMS 2FA is not just insecure..." article, but also such things as the set-up for 2FA not working very well in GitHub, some mechanisms requiring JavaScripts, etc); those who want to and are able to use X.509 should use X.509 instead.
Another thing that I dislike is the "security questions" such as your date of birth or your mother's maiden name or whatever, which do not help with security at all, and those should not be used at all.
Earlier quoted context omitted.
Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.
1) It's possible they do not have an Internet connection. In fact, it doesn't seem necessary. 2) Bluetooth can ensure that you are in proximity of the locker, otherwise you could accidentally unlock a locker while standing at the wrong rack.
Can we just go back to having passwords please. I hate this state of authentication on the web.
Passwords are terrible. They're Human Memorable Shared Secrets, it's "What if somebody who doesn't know the first thing about cryptography tried to invent secure authentication?" and should have died out last century yet here we are. We have known for decades how to do better than that. The fact that at least twice a month (often much more) I read an HN comment saying passwords are great is like discovering most of y…
Passwords do have some benefits. They dont require a phone, it being charged, and fetching it 5 times to go through a couple services. They can be used from any machine.
Yes theyre not as secure, but as user Id prefer to be able to choose for myself whether I want to opt in for additional security. For most sites I dont even give a shit if my account gets hacked, and I have to go through a ton of annoyance everyday for no reason
Something somewhere is always hostile to particular group. That's just facts of life. You do your best to minimize but can never eliminate it. As someone who has dealt with 2FA support, all the methods suck. SMS 2FA is least secure but has broadest support with quickest recovery method. TOTP Applications (Google Auth, Authy, iOS Passwords) is more secure but people switch phones, lose phones and so forth and recovery…
Recovery is relatively straightforward if you have more than one key. You enroll all your keys, and if you lose one, you buy a new key and use one of the other keys to enroll it.
This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. Your carrier is already capable of redirecting your SMS messages to other carriers, that's what they do when you're abroad and roaming with a foreign operator. You could make a fake carrier that speaks the right protocols on the roaming side, but communicates with the customer over the internet (using an API or…
> Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't. You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.
Well, I'm not so sure about that. SS7 redirection attacks exist, so clearly shenanigans like these are very hard to stop for carriers. The question here is whether such "attacks" are legal if performed with the consent of the customer, but against the wishes of their carrier.
One could also do some "legal optimization" here, and ally themselves with a major carrier outside the US. There are plenty of those, and all of them have access to the networks (SS7 and IPX) on which roaming happens.
Earlier quoted context omitted.
This is probably compliance-related. For me, TOTP isn’t “something I have”, it’s another thing I toss into my password manager and sync to all devices. I really agree with it, but that’s probably their rationale.
I do the same, and it somewhat defeats the spirit of 2FA, but I still believe it's more secure. It's basically a second password where intercepting it in transit once isn't enough to be able to repeat the login in the future.
> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…