Earlier quoted context omitted.
So your bank can send you the SMS you need to sign in (which in itself indicates their security is poor).
most banks don't support international numbers if that what you meant
No, that's not what I meant.
Tell HN: SMS-based two-factor authentication is not secure
271–280 of 291 posts
Re: Tell HN: SMS-based two-factor authentication is not secure
#272Earlier quoted context omitted.
But that's not an inherent problem of SMS 2FA. It's just bad implementation.
No, the inherent problem of SMS is that it can be stolen/redirected. Given that, and given that companies are too eager to use it as 1FA, you shouldn't use it. If I'm giving advice to companies, I say "don't use SMS 2FA as 1FA" (well, I actually say "don't use SMS 2FA at all, it's too tempting for a support person to use it as 1FA"), but this thread is about the user, and as a user, you shouldn't use SMS 2FA.
I wonder if companies that have your phone number and do such careless things as "phone-number based 1fa", will not also simply do that if you don't even have 2fa enabled... As long as they have your phone number, they'll abuse it.
So you are not against phone based 2fa or 1fa, your are against giving companies your phone number. But them, if they are soooo careless to try phone based 1fa when they can get away with it, they are also probably open to some social engineering.
In the words of RMS: "We should all try to make those companies fail."
Re: Tell HN: SMS-based two-factor authentication is not secure
#273Earlier quoted context omitted.
TOTP is an improvement over SMS in that identity is not tied to a phone number, which has been proven over and over again to be a terrible indicator of identity.
That isn't a meaningful distinction. Both cases involve you typing in a number into a web form.
It was a meaningful distinction to the OP...
While TOTP contains a bypass (phishing) SMS contains an additional vulnerability.
Re: Tell HN: SMS-based two-factor authentication is not secure
#274Earlier quoted context omitted.
> Some form of trust that can be bootstrapped again from scratch. This is not using it as a second factor. It is using it as the only factor. Having SMS as the only factor is not purely additive. As such it can (and obviously does) reduce security. Account recovery is hard, SMS is quite usable there, but way to insecure to be the only basis for bootstrapping account recovery.
I don't really understand why you think I'm advocating for SMS as the only factor, when I very clearly wrote the exact opposite. Let's say that you remember your password, but your house just burned down. You cannot replace the U2F keys and backup codes that were lost in flames. But you almost certainly can bootstrap your real life identity far enough to get a replacement SIM. Which, in combination with your password…
Confusion about the word bootstrapping. I read "bootstrapping trust" as regaining trust based solely on SMS.
But indeed, sms as a second factor is much easier to recover in catastrophic situations than some other second factors. That is a fair point, and an advantage of sms over other common second factors.
Re: Tell HN: SMS-based two-factor authentication is not secure
#275Earlier quoted context omitted.
I thought you needed the PIN if you wanted that, too? As in, if you lose your phone and don't have the PIN set up with your carrier, you've lost your number and can't restore it.
That would mean eventually there would be no phone numbers left for anyone.
No, that would mean they would eventually disconnect the service on that line for non-payment and give that number to a new subscriber.
Re: Tell HN: SMS-based two-factor authentication is not secure
#276Earlier quoted context omitted.
Can you explain how I'm weaker with 2FA via SMS than without 2FA? I agree SMS is not good 2FA but your statement is more extreme.
If I didn’t have SMS-2FA enabled, they would not have been able to take control of my email address without guessing the password.
“But we send YOU and sms on YOUR phone number you left in our systems!”
Re: Tell HN: SMS-based two-factor authentication is not secure
#277Earlier quoted context omitted.
Services like Authy address some of the loss of device issue, and always a good idea to have a backup token (e.g., yubikey) physically escrowed somewhere like a safe-deposit box. But it is a whole lot of extra work to set up and maintain long-term, even with the best intentions.
+1 for Authy. Just get a used cheap Android phone for like $30 and use it as the backup device for Authy and never fear about losing your 2FA device again.
Or just copy your TOTP codes to a second device without going via the internet.
I'm annoyed Google Authenticator makes it so easy to transfer accounts to a new phone, how will you know if someone's cloned your TOTP private key while you were sleeping?
Re: Tell HN: SMS-based two-factor authentication is not secure
#278Earlier quoted context omitted.
Password managers such as 1Password and Bitwarden can save and fill in TOTP codes. Maybe not perfect security but a big win for convenience and loss prevention.
I have received advice from way to many people to not use your password manager as a 2nd factor be ause 1) It's actually become the only point if failure (your pw getting hacked). 2) Both factors protected and saved on the same spot
Mostly fear-mongering.
1Password in particular encrypts your vault with your master password and importantly an additional 128 bit secret key that is meant to be kept somewhere physically (e.g. in your safe). This key is needed the first time your vault is decrypted (e.g. a new device)
An attacker would need to have access to all of the following:
a) your encrypted vault
b) your master password
c) an 128-bit secret key
in order for the fears you've outlaid to be realised.
Really the only attack vector I can see is a physically compromised device (brute forcing is out of the question). In which case, they'd still need to somehow know your Master password and you're no more vulnerable considering your OTP is likely to be in an application on your phone anyway.
Re: Tell HN: SMS-based two-factor authentication is not secure
#279As someone advocating against this for a while, who has a internet only sim these days and no phone number it is scary how many companies depend on SMS for security.
Even if it's only second factor today, what really prevents the company from allowing password resets one day? Nothing, I likely would not even notice it until it is to late.
I can own an email address, but I can never own a phone number. Nearly all contracts clearly state that the number is not actually yours in different wordings and nothing prevents anyone from reclaiming the number and give it to someone else.
It's stupid. And annoying.