Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS 2FA is not just insecure, it's also hostile to mountain people

blog.stillgreenmoss.net

Post reply on HN
Print view View original

31–40 of 328 posts

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#31

Post by hocuspocus »

vbezhenar wrote: post #21
hocuspocus wrote: post #11

Earlier quoted context omitted.

> I'm surprised ios and android don't have native TOTP apps (afaik). They do. Google's Authenticator is as close as it gets to a native Android app, and your secret keys are sync'ed in Google's cloud for a while now (it's a shame they waited so long). Apple's Keychain has supported TOTP for ages too. That said OTPs over RCS instead of SMS are a major improvement if you don't mind your phone number being used as an id…

Google Authenticator is a separate app that you need to download from Google Play. Native android solution is Google Password app which is pre-installed (at least on Pixel) and its functionality is extremely rudimentary even compared to Apple Passwords. No TOTP support there. I think that Google does not care about security for their users, because their passwords app is clearly some intern work, not something really…

It's not ideal but there's been some progress.

I'm not sure we can blame Google for not pushing their Authenticator more, most services have been dead set on SMS and are now slowly moving to Passkeys, probably for the best.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#32

Post by lxgr »

TonyTrapp wrote: post #26
Neywiny wrote: post #13

Much agreement with the others that there's too much expectation. I rented a lime scooter for the first time last year. But, I messed up my VPN settings so I had no Internet. There was no way to tell the scooter I'm done. Even though it was stopped, no button to end the ride. They refunded me the extra time (which was maybe 5 of the 10 minutes) because they could see it was just stopped at a bike rack on gps. Idk wha…

Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.

Are you sure that the locker has an Internet connection?

Requiring Bluetooth and an Internet connection on your phone suggests that that's exactly what they removed on their side. Quite clever, if true – why pay for network connectivity if you can just piggy back on your customers'? (Nevermind those customers without a smart phone and data plan...)

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#33

Post by dboreham »

dingnuts wrote: post #10
jaoane wrote: post #6

When you choose an eccentric lifestyle you should accept the loss of certain features.

the article is about a retired woman who lives twenty minutes from Asheville, NC. The terrain is rugged there, but it is not an "eccentric lifestyle" It is extremely typical, however, to see the most basic needs of Appalachian people ignored on the grounds of their perceived choice of lifestyle just this weekend I endured yet another incest joke.. I bet you have one of those ready too

There's plenty of locations with houses in Montana that have no cell service too.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#34

Post by lxgr »

zkms wrote: post #24

"Wi-Fi calling" (LTE over IP over wifi) often allows you to get SMS messages over wifi only, on an ordinary cell plan: https://support.apple.com/en-us/108066 (Android supports it too)

The article mentions that they've encountered problems receiving messages from short codes via that.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#35

Post by dheera »

modeless wrote: post #16
pyrale wrote: post #12

Earlier quoted context omitted.

> When you choose an eccentric lifestyle Many "eccentric" lifestyles are not chosen. For instance not owning a smartphone or not having access to power easily is not necessarily limited to well-off tech-savv hipsters who want to make a statement, homeless people, older people in less connected areas or people in developing countries can also be in that situation. When you make your services depend on specific access,…

Homeless people get free smartphones and free service in the US. Living in very rural areas is in fact a lifestyle choice. Not all choices need to be subsidized.

We should support the rural lifestyle choice. For one, the food you eat comes from there.

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#37

Post by baby_souffle »

lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

> That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I really wish that were illegal. A phone number is a phone number.

It pisses me off to no end. I use a few different banks and some are fine with google voice, others are not. One only allows customer service to send SMS tokens to google voice but not through the regular flow. In all but one case, they will happily robo call my google voice number and have a tts engine read me the same code that they didn’t want to SMS.

Security policy by rng, ffs!

Re: SMS 2FA is not just insecure, it's also hostile to mountain people

#38

Post by lxgr »

Calwestjobs wrote: post #2

TOTP, HOTP. SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.

Neither TOTP nor HOTP provide "what you see is what you sign" property, unfortunately, which can be critical for bank and other transactions.

"Enter this code only if you want to pay to " is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example).

Not even WebAuthN provides that property on a compromised computer; for that, you'd need something like the SPC extension [1] and a hardware authenticator with a small display.

That's unfortunately why we're currently stuck with proprietary bank confirmation apps that can provide it. I really wish there was a vendor-neutral standard for it, but given how push notifications work (or rather don't work) for federated client apps, I'm not holding my breath.

[1] https://www.w3.org/TR/secure-payment-confirmation/

Post reply on HN