Tell HN: SMS-based two-factor authentication is not secure

Post by Extigy » Thu, Jun 10, 2021, 12:22 PM UTC

danieljacksonno wrote: post #137

rawgabbit wrote: post #106

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to ba…

We have something vaguely similar with "BankID" in Norway. It's a bank issued digital ID that submits a 2FA to your phone (not through SMS, but through some other system that takes over the whole screen - not sure what it is). It's usable for almost all government agencies or official stuff online here, but I haven't seen anyone use it for third party auth as it costs roughly 10 cents per login for the service using…

Post by Beldin » Thu, Jun 10, 2021, 3:03 PM UTC

a10c wrote: post #278

NotEvil wrote: post #214

Earlier quoted context omitted.

I have received advice from way to many people to not use your password manager as a 2nd factor be ause 1) It's actually become the only point if failure (your pw getting hacked). 2) Both factors protected and saved on the same spot

Mostly fear-mongering. 1Password in particular encrypts your vault with your master password and importantly an additional 128 bit secret key that is meant to be kept somewhere physically (e.g. in your safe). This key is needed the first time your vault is decrypted (e.g. a new device) An attacker would need to have access to all of the following: a) your encrypted vault b) your master password c) an 128-bit secret k…

Post by a10c » Thu, Jun 10, 2021, 10:34 PM UTC

Beldin wrote: post #283

a10c wrote: post #278

Earlier quoted context omitted.

Mostly fear-mongering. 1Password in particular encrypts your vault with your master password and importantly an additional 128 bit secret key that is meant to be kept somewhere physically (e.g. in your safe). This key is needed the first time your vault is decrypted (e.g. a new device) An attacker would need to have access to all of the following: a) your encrypted vault b) your master password c) an 128-bit secret k…

Since your own computer will typically have the vault unlocked, you don't need a+b+c. You can suffice with a circa 2000s Sony Music cd. Or any driveby malware, or malvertisement, etc. Using the 2nd factor on another device as the first means attackers need to either compromise 2 devices, or compromise a single point higher up in the hierarchy (e.g., your google account).

Post by toss1 » Sat, Jun 12, 2021, 12:18 PM UTC

matheusmoreira wrote: post #238

toss1 wrote: post #99

Earlier quoted context omitted.

I'd start with VOIP numbers being so easy to spoof... and move onto the entire telephone network being insanely insecure and unverified, despite decades of efforts to link people to telnos -- until they implement actual caller-recipient full verification, they've effectively got nothing.

> until they implement actual caller-recipient full verification Is it even possible to do this at this point? I'd expect something like this to fundamentally change the way telephone networks work.

Post by ncann » Fri, Jun 18, 2021, 3:02 PM UTC

lukeschlather wrote: post #261

ncann wrote: post #246

Earlier quoted context omitted.

+1 for Authy. Just get a used cheap Android phone for like $30 and use it as the backup device for Authy and never fear about losing your 2FA device again.

Does Authy actually offer 2FA? It sounds like the security boils down to your encryption passcode used to encrypt the 2FA secret, so you aren't actually using 2FA at the end of the day. For personal use it probably is a good compromise for services which don't implement 2FA properly (that is to say, services that don't allow you to register multiple 2FA devices.) But realistically you might want to just disable 2FA a…