Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

301–310 of 323 posts

Re: Second factor SMS: Worse than its reputation

#301

Post by slow_typist »

sleepyhead wrote: post #245
slow_typist wrote: post #222

Earlier quoted context omitted.

I think 2FA via texts is better than no 2FA. But only if you do not make the texts world readable. Apart from that, to me it seems justifiable to follow a risk based approach. Booking systems up to a certain value/amount, fine. Online Banking and health related services, thank you, no.

It's not really 2FA even. More like a magic link (which is what we use for verification via email). The customer has no password, just verifies using a code via sms/email.

Passwordless, so to speak. Does it help with conversion rates?

Re: Second factor SMS: Worse than its reputation

#302

Post by yencabulator »

kevincox wrote: post #300
elric wrote: post #66

Earlier quoted context omitted.

This might not be sufficient anymore. Many online payments are rendered either on the shop's pages or on a third party payment provider, including 3DSecure implementations. These don't redirect to any sensible bank URLs. Both of my banks use a payment flow which uses a hardware authenticator. But only one bank seems secure: it prompts for an amount and a reference and generates an OTP based on that. This is distinct…

I ran into this. I'm trying to set up an account on wise.com. The way they want me to set up my bank for direct deposit is to type my banks password into their site! I asked support if there was any other way to do this (for example the regular institution, branch, account numbers) and they said no. But they reassured me that despite me typing the password into their site that they don't have access to it! (Ok, it wa…

Plaid is a cancer of the payment system. It's amazing how they're trying to normalize entering your banking credentials into their third-party site.

Re: Second factor SMS: Worse than its reputation

#303

Post by kevincox »

yencabulator wrote: post #302
kevincox wrote: post #300

Earlier quoted context omitted.

I ran into this. I'm trying to set up an account on wise.com. The way they want me to set up my bank for direct deposit is to type my banks password into their site! I asked support if there was any other way to do this (for example the regular institution, branch, account numbers) and they said no. But they reassured me that despite me typing the password into their site that they don't have access to it! (Ok, it wa…

Plaid is a cancer of the payment system. It's amazing how they're trying to normalize entering your banking credentials into their third-party site.

It's not even their site as far as the user can tell. It is a full-screen iframe. At least if it was their site a bank could say "plaid.com is fine". Still bad to make acceptable domains more than one but at least it isn't infinite.

Re: Second factor SMS: Worse than its reputation

#304

Post by skrtskrt »

rsync wrote: post #293
skrtskrt wrote: post #233

Earlier quoted context omitted.

most people publishing a website either cannot or do not care to host the ad server on the same domain, they just want to monetize the site. things could get a lot better, but this self hosting suggestion in particular will never see wide adoption unless major hosting providers build it and host for their customers. most people don't even bother to self-host/bundle stuff like their fonts and JS libraries unless they…

Who said anything about an ad server ? An ad is a particularly sized JPEG that you place in your images directories… and then point to with an HTML tag. Everything we tried to build for you was lost once you deviated from that level of complexity.

one suggestion more arrogant, ridiculous, and in bad faith than the last

you're now implying everyone hosting a website should pound the pavement to sell their own ads - or use a a static export from an ad network and build it into the website themselves? Sure maybe they should but they never will. Dream on.

> Everything we tried to build for you

You are a speck of dust in the universe of computing. Get a grip.

Re: Second factor SMS: Worse than its reputation

#305

Post by smeej »

Negitivefrags wrote: post #242
smeej wrote: post #210

Earlier quoted context omitted.

For a long time (still?) Kraken also refused to add SMS 2FA as an option due to its weak security. I still don't see how that's worse than no 2FA at all, which was an option, but I appreciated that they were banging the "SMS 2FA isn't very secure" drum.

It’s worse in a lot of implementations because often SMS is often used as part of a recovery flow in cases where you lose the first factor. I find it more secure in some contexts to never give a company my phone number at all if possible, so that it simply can’t be used as any kind of authentication no matter what.

Yeah, I'd draw a hard line between "SMS 2FA is better than no 2FA" and "SMS should never become a single-factor recovery method."

I agree SMS should never be an option for single-factor recovery.

Re: Second factor SMS: Worse than its reputation

#306

Post by rafram »

dylan604 wrote: post #111
rafram wrote: post #70

Earlier quoted context omitted.

That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!

since COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device. I know I'm not the first person to be unable to port a number, so calling a phone number something th…

Yeah, I didn’t mean that they never change in reality, but that they’re treated as if they never change. (Same with SSNs.) I can only imagine how many hundreds of services I’d lose access to if I lost my number. Hours and hours talking to customer service.

Re: Second factor SMS: Worse than its reputation

#307

Post by skrtskrt »

JadeNB wrote: post #289
skrtskrt wrote: post #263

Earlier quoted context omitted.

there are plenty of site owners that would voluntarily choose a more ethical ad hosting network if it was a good and easy option. adding a pain-in-the-ass hurdle like "has to be hosted on the same domain" that 99.99% of people won't see the value of or understand is only going to hurt adoption of the better solutions.

> adding a pain-in-the-ass hurdle like "has to be hosted on the same domain" that 99.99% of people won't see the value of or understand is only going to hurt adoption of the better solutions. Right, but that's my point—this is not a situation where visitors have to hope that site owners will be responsive to their preferences; rather, visitors are in a position to enforce their preferences via ad blockers, so there's…

agree - but that gets to the larger point that mass adoption of anything like has to be fairly frictionless.

We are barely getting a third of people to use adblockers - you'd have to squeeze the ad server industry a lot more to make them change. How to squeeze them? Get more people to use an adblocker that enforces serving from the same domain. How to get more people to use an adblocker? Make it frictionless, like enabled by default on browsers.

Then by squeezing them, they would be forced to respond by building tooling making it more frictionless to serve ads form the same domain, etc.

Re: Second factor SMS: Worse than its reputation

#308

Post by baxtr »

AegirLeet wrote: post #80
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web. In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBl…

And at the same time ads are the reason we can use many services for free.

Re: Second factor SMS: Worse than its reputation

#309

Post by alistairSH »

DowagerDave wrote: post #241
alistairSH wrote: post #209

Earlier quoted context omitted.

Or skip the website and use their native app.

then you can't block anything

I don't understand - what would I block that's being delivered by my bank's native app? IF I can't trust their app, I can't trust the institution as a whole.

Re: Second factor SMS: Worse than its reputation

#310

Post by alistairSH »

michaelt wrote: post #113
bckr wrote: post #43

Earlier quoted context omitted.

Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank

In the past I've heard people say the opposite - that if less computer savvy people are using google instead of URLs, it's a good thing. The reasoning was it protects them against typosquatters and whitehouse.com situations. I guess when people were giving out that advice, google wasn't the way it is now.

Native app on phone > bookmarked site > typing site name (but only if using native browser password manager to auto-complete when the domain is correct).

Or something like that. I hate when I have to type site URLs from printed material (usually only doctor's bills, yet another reason to move to single-payer/socialized care) because I'm paranoid I'll get it wrong. Even more so with some of the janky URLs used by medical payment processors (contrived but realistic example: http://paymemoney.doctors.systemhealth.net/~drabdullahriaz/l...). Le Sigh.

Post reply on HN