Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

271–280 of 379 posts

Re: SMS is not 2FA-secure

#271

Post by saagarjha »

aloer wrote: post #249
kccqzy wrote: post #131

Earlier quoted context omitted.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

People recommend Authy. As far as I can tell they rely on cloud sync/backup like any other app in that space. Isn’t google authenticator not using this on purpose? Central account and sync is googles thing and yet they deem it too insecure. Completely understandable So how can using a central service that adds yet another attack vector be of value? What I would love to have is a paper export. Every time you add a new…

I can't see any, based on my slightly more than superficial dive into this area when working on my own two-factor application.

Re: SMS is not 2FA-secure

#272

Post by paranoidrobot »

chewz wrote: post #268
istjohn wrote: post #266

Earlier quoted context omitted.

On your second point, a determined criminal could always deploy rubber-hose cryptanalysis on a 2-factor authentication scheme, but it's still a significant improvement. Your first drawback is substantial, though.

> criminal could always deploy rubber-hose cryptanalysis That would be smart criminal with means. I was thinking more of a hood with fat neck passing $20 to clerk assistant to obtain SIM for $5k fraud.

Or like the recent case where it's alleged that carrier employees were actually in on SIM swap scams.

https://arstechnica.com/tech-policy/2019/10/att-employees-he...

Re: SMS is not 2FA-secure

#273

Post by chewz »

paranoidrobot wrote: post #272
chewz wrote: post #268

Earlier quoted context omitted.

> criminal could always deploy rubber-hose cryptanalysis That would be smart criminal with means. I was thinking more of a hood with fat neck passing $20 to clerk assistant to obtain SIM for $5k fraud.

Or like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-he...

The clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake.

So easy for evildoers and so much friction for law-abiding customers.

Re: SMS is not 2FA-secure

#274

Post by fauigerzigerk »

hanney wrote: post #267
fauigerzigerk wrote: post #254

Earlier quoted context omitted.

Use backup verification codes and a recovery email address. Also, remember the date when you created your Google account. The best way to find that date may be to look at the first email you received in the account.

".. a recovery email address" This just moves your security issues to another account.. how many layers of recovery email address are you willing to go before hitting the end?

What you can do with email is move the problem to your most secure account or to an account that you know how to recover under essentially all circumstances.

Re: SMS is not 2FA-secure

#275

Post by incompatible »

ekianjo wrote: post #250
adrr wrote: post #188

Earlier quoted context omitted.

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.

what store for online-only services?

Yes, like my mobile service is provided by a German supermarket chain that has outsourced the operation to somebody else, who run it as a virtual network over somebody else's cell network. The nearest of these supermarkets is hundreds of kilometres away, and the checkout operators are unlikely to be of much help.

Re: SMS is not 2FA-secure

#276

Post by solatic »

All of this happens because we've outsourced digital identity to the telecom companies. Telecom companies are not competent at establishing identity. It's not their job. There is only one entity that is the real root provider of identity and that is the government.

We are never going to get the benefits of digital identity until the government wakes up and brings its services into the digital age.

Re: SMS is not 2FA-secure

#277

Post by hocuspocus »

chirau wrote: post #78
hocuspocus wrote: post #73

In Switzerland, we have Mobile ID: https://www.mobileid.ch/en It uses the SIM to implement a challenge-response mechanism where a PIN is prompted by your phone. While not perfect, it's vastly better than using SMS, without being less convenient. I don't know if other places leverage the fact that SIMs are smart cards which are perfectly able to perform this kind of stuff given the proper infrastructure.

How does this work?

I'm not aware of the details, but I imagine something very similar to EMV payments.

The only difference is that you need to register your SIM with the service beforehand, using a reasonably secure process. Banks make you use their own MFA before you can enable Mobile ID (and no, it's never over SMS).

Re: SMS is not 2FA-secure

#278

Post by peterwwillis »

This research doesn't seem complete; particularly the use of a phone number for authentication, that isn't SMS.

Facebook Messenger uses a phone number either tied to your Facebook Account, or identified as the phone number on your mobile device, to immediately log you into a Messenger account, with zero authentication. They literally ask you "Is this your account?" and you just click "Yes" and you are in that account. Even if it's not yours.

If you use prepaid phone numbers, or link one to your account, you can often get into Facebook Messenger accounts that aren't yours.

Re: SMS is not 2FA-secure

#279

Post by lmilcin »

C14L wrote: post #255
TheDong wrote: post #134

Earlier quoted context omitted.

Only if they neglected to offer backup codes (which anyone who does TOTP should). Otherwise, you can just grab a few backup codes out of your fireproof safe and register your new totp code, or go to the bank and get them out of your bank vault. Sure, the fireproof safe costs as much as a few yubikeys, but if you go the yubikey route you both need the yubikeys and a fireproof safe and bank vault for your spare yubikey…

Fireproof safe? Just use a text file and encrypt it. Or a password manager file only for TOTP backups.

Don't use text file. Use regular piece of paper, put it in tamper-evident envelope and keep register with events regarding envelopes.

When you take something from envelope, note the date, the why, the number of envelope you opened and the number of envelope you then put the piece of paper in. Every time you open envelope check with the register that the numbers agree.

Re: SMS is not 2FA-secure

#280

Post by __david__ »

balladeer wrote: post #209
jkepler wrote: post #157

Earlier quoted context omitted.

Why not use an open TOTP app like AndOTP. I use it all the time for sites that claim to require Google Authenticator, it works, and its easy to backup the secrets as plain text or encrypted with a password. I keep it current on my primary phone and a cheap offline backup, in addition to backing up the encrypted secrets file.

I use Authy on iPhone and Mac. I am looking for an OSS replacement but would not want to setup everything from scratch after I change device reinstall the app like Google Authenticator.

https://freeotp.github.io/

iPhone backups back up its data correctly—my codes survive new phone restores where they do not with Google Authenticator.

Post reply on HN