SMS is not 2FA-secure • Hacker News Board

Re: SMS is not 2FA-secure

#301

Post by Nextgrid » Sat, Jan 11, 2020, 4:33 PM UTC

xenospn wrote: post #80

tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

I wish Apple added iMessage as a service to make 2FA more secure.

iMessage still depends on verifying your ownership of a phone number and can be taken over with a SIM swap attack.

Re: SMS is not 2FA-secure

#302

Post by Lucadg » Sat, Jan 11, 2020, 4:35 PM UTC

ozim wrote: post #236

Lucadg wrote: post #197

Earlier quoted context omitted.

What if you are abroad? My debit card was recently blocked and I had to wait until I went back, walked in the bank and show my face and ID.

Before you go abroad you could notify your bank. Then in period you declared you are abroad they should lower expectation from "in person and ID" to phone call and other means of verification. After that period you are automatically back to normal security. That is for example how my debit card works. If I want to use it abroad I have to turn that feature on for whatever time I am abroad.

I'm going abroad all the time and I'm sure this wouldn't work anyway. Last time I was in their office I realized how backwards they are.

Re: SMS is not 2FA-secure

#303

Post by Nextgrid » Sat, Jan 11, 2020, 4:36 PM UTC

fedorareis wrote: post #146

pxeboot wrote: post #100

Earlier quoted context omitted.

Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.

It depends. If your iMessage account is tied to an Apple ID used on multiple devices with 2FA enabled then the code is sent to one of those other devices to validate the login on the new device. So if you are fully in the Apple ecosystem and have 2FA enabled then I believe it would be secure. I know I get alerts on my other devices any time I have had to re-add my phone number to an Apple ID. It tells me my phone num…

iMessage is only tied to an Apple ID for the e-mail part (where they can send iMessage to your e-mail). The phone number part is independent of that and you can take it over provided you prove ownership of the phone number (by inserting the SIM into an iPhone, it'll send an invisible SMS to Apple and back and that then activates iMessage on that number on that new device).

Re: SMS is not 2FA-secure

#304

Post by Nextgrid » Sat, Jan 11, 2020, 4:38 PM UTC

laurentdc wrote: post #119

Andrew_nenakhov wrote: post #6

Not in Russia. Numerous examples exist when victim's number was linked to attacker's sim card to obtain 2FA code, then linked back to victim's sim so he does not notice anything. This happened both by government-linked parties, where they are able to coerce providers to do it, mostly targeting prominent political opposition members. It also happened without government involvement, done by provider's personnel with su…

> if you do, use a foreign SIP number with SMS capabilities Any good providers? I've tried Twilio SMS forwarding, but different services (e.g. Steam) reject it for 2FA since they're pretty much considered throwaway numbers, I suppose there's some sort of blacklist

For UK numbers lookup Andrews & Arnold. They have mobile numbers from a national carrier's numbers block so no way for them to be flagged as VoIP. They work fine with both calls & SMS.

Re: SMS is not 2FA-secure

#305

Post by fastball » Sat, Jan 11, 2020, 4:39 PM UTC

Nextgrid wrote: post #300

fastball wrote: post #293

Earlier quoted context omitted.

My DL has a barcode that can be swiped. They already use it at grocery stores to confirm that you are over 21 and that it's a real ID.

Does the bar code act as a key to lookup a record in a central database, or does it just encode "I am 21, trust me" without any cryptographic signature? Unless it's the former it's as good as a standard paper ID as far as forgeries go. If anything, having it machine-readable decreases security as it means the person inspecting it spends less time looking at it and just scans it in a machine.

I can almost guarantee it's not the latter.

Re: SMS is not 2FA-secure

#306

Post by Nextgrid » Sat, Jan 11, 2020, 4:42 PM UTC

chirau wrote: post #78

hocuspocus wrote: post #73

In Switzerland, we have Mobile ID: https://www.mobileid.ch/en It uses the SIM to implement a challenge-response mechanism where a PIN is prompted by your phone. While not perfect, it's vastly better than using SMS, without being less convenient. I don't know if other places leverage the fact that SIMs are smart cards which are perfectly able to perform this kind of stuff given the proper infrastructure.

How does this work?

Presumably there's an applet in the SIM card that holds a key pair and allows you to sign stuff by providing the SIM PIN. You interact with it via STK which is an old standard allowing SIMs to tell the phone to draw rudimentary UIs and ask the user for input.

Re: SMS is not 2FA-secure

#307

Post by Nextgrid » Sat, Jan 11, 2020, 4:43 PM UTC

dmoy wrote: post #40

0xff00ffee wrote: post #35

Earlier quoted context omitted.

> What happens if the user loses a yubikey. Always buy two. ;-) Joking aside, I've moved almost every 2FA to hard token, soft-token, or google voice. But the root of trust is still LastPass & Google. I don't see an easy way out of dependency other than power of attorney. Even worse: I worry what happens to my protected assets as I age and possibly face memory loss.

Backup access in a bank safety deposit box is what I do.

I read an article here some time ago that banks take no responsibility if they lose/destroy the contents of their boxes as someone learnt the hard way with precious family possessions.

Re: SMS is not 2FA-secure

#308

Post by Nextgrid » Sat, Jan 11, 2020, 4:46 PM UTC

rvz wrote: post #53

You know what's funny? LinkedIn is supposed to be a 'professional' social network (Microsoft owned) and a friend of mine was asked to add a phone number 'For security purposes'. I knew this was suspiciously involving 2FA SMS + a bonus of spam callers and I told him to press "Not Now". Whilst the world is moving to U2F and time-sensitive codes, a security system using SMS 2FA is now equivalent to a single PC running W…

LinkedIn is absolute scum in that regard. They pestered me for my number for ages until eventually they finally implemented TOTP 2FA which I then enabled.

They still ask for a phone number when applying to jobs through their platform. I always put zeros or random digits in the field and put the real one in the resume.

Re: SMS is not 2FA-secure

#309

Post by Nextgrid » Sat, Jan 11, 2020, 4:49 PM UTC

trimbo wrote: post #191

I'm surprised more websites aren't taking advantage of TouchId. It's so easy for people to use. Even login.gov supports it! https://www.slashgear.com/chrome-is-adding-touch-id-and-fing...

Touch ID and other biometrics are enforced locally.

The device is first enrolled, the website gives the device a secret value which the device can put in its secure element. When needing to authenticate again the device checks biometrics locally and if correct then the secure element releases the secret value which is then either passed onto the website or used as part of a challenge-response authentication.

This means if you lose or reset your device you can't get back in despite having the right biometrics.

Re: SMS is not 2FA-secure

#310

Post by Nextgrid » Sat, Jan 11, 2020, 4:51 PM UTC

dzhiurgis wrote: post #125

In many European countries SIM cards are actually locked to a number. If you change your SIM card you'll have to reset your 2FA setup on the banks site. It's done on the carrier side. I still hate it tho, as you are locked to a phone number and it sucks when you move countries a lot.

This relies on carrier cooperation. Given they are the ones that caused this shit-show in the first place I wouldn't trust them to make it right. An insider capable of SIM-swaps would also be able to override this mechanism.