Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

311–320 of 379 posts

Re: SMS is not 2FA-secure

#311

Post by Pxtl »

Nextgrid wrote: post #298
ChuckNorris89 wrote: post #292

Earlier quoted context omitted.

On the contrary, in most European countries, due to anti terror regulations, you now need an ID to buy a SIM card or if you've bought one before this new law came into place you have to send a picture of your ID to the Telecom operator or your sim card gets deactivated. Not saying I like this or that this is good way forward but it's a reality that contradicts your assumption.

This will do nothing to deter malicious SIM swaps. Someone who's happy to take over your number and then steal your money is also happy to present a fake ID and pretend to be you.

What kind of ID is it? A proper barcoded photo ID that corresponds to a government database? Because with that you can verify that the ID picture matches the one in the government database.

Re: SMS is not 2FA-secure

#312

Post by olah_1 »

alkonaut wrote: post #260
pwg wrote: post #187

Earlier quoted context omitted.

> I want my things protected by a human with a process to unlock/reset/.. given some kind of proof of identity. Anytime you have a human in the loop you have the risk of human failings. I.e., that human forgets to follow critical step X in the protocol. Or that human falls for the attackers emotional sob story and takes pity on the attacker and lets the attacker unlock your account. Or that particular human is amenab…

> Anytime you have a human in the loop you have the risk of human failings. I.e., that human forgets to follow critical step X in the protocol This is exactly my point. If the risk of an attack is X, the risk of me being that person who fails or forgets a critical step of the protocol (backup yubikey, whatever) is a hundred times higher. So this system of “flawed humans interacting” to me looks like the lesser evil.…

Bingo. This is why crypto currency won't take off without more humane tech being inserted into the process. People aren't robots. We want many many ways to un-screw ourselves when we inevitably screw ourselves.

That's why I'm bullish on things like Shamir's Secret Sharing and other social recovery tools.

Re: SMS is not 2FA-secure

#313

Post by jaclaz »

fastball wrote: post #295
jaclaz wrote: post #261

Earlier quoted context omitted.

>In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. Can you detail which "most" of Europe you are talking about? In Italy, while obviously you have to produce an ID card, there i…

Plus Italy's national ID is laughably insecure. It's a laminated piece of paper. I remember when I was growing up I had an Italian friend in the UK who went out to a bar for her actual 18th birthday. When they asked for ID, she showed it to them and they kicked us out because they thought it was fake. It was not.

No, it isn't (anymore), not everywhere, but in spots.

For the record - for a period it was laminated, and then it was forbidden to laminate it (as forgeries were somewhat simpler with the laminated one, though I don't know the details).

Old ID card (paper, large, duration - theorical - 5 years, then extended to 10 years, practically indestructible, i.e. they actually lasted the 5 or 10 years):

https://carinola.modulisticacomune.it/modulistica/categorie/...

New ID card (electronic, credit card size, with chip[1], duration - theorical - 10 years, usually illegible after 2 or 3 years in a wallet unless you use a protective cover):

https://www.formatrieti.it/carta-didentita-elettronica

And whether you get the one or the other may depend on the city (comune) as most will use all the empty paper documents they have in storage before starting issuing the new electronic format.

[1] for which noone or nearly noone has a reader BTW, the whole stuff is somehow experimental, even now that we have an app (Android only):

https://www.cartaidentita.interno.gov.it/identificazione-fis...

https://www.idea.ipzs.it/

Re: SMS is not 2FA-secure

#314

Post by adrr »

chewz wrote: post #273
paranoidrobot wrote: post #272

Earlier quoted context omitted.

Or like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-he...

The clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake. So easy for evildoers and so much friction for law-abiding customers.

If you make the carrier liable for damages in case of fraud, there would be process to mitigate the risk from one bad actor. Like the bank requires a manager approval for certain high risk transactions like international wires.

Re: SMS is not 2FA-secure

#315

Post by esolyt »

danellis wrote: post #163

The title is mangled, because someone misparsed the question. The question is "Is SMS 2FA secure?", not "Is SMS 2FA-secure?" There is no such property as 2FA-secure. Title should read: "SMS 2FA is not secure".

I agree. "SMS is not 2FA-secure" implies SMS is not suitable for 2FA at all. In reality, SMS 2FA is still very valuable to most people, even though it's not secure enough.

Re: SMS is not 2FA-secure

#316

Post by trimbo »

Nextgrid wrote: post #309
trimbo wrote: post #191

I'm surprised more websites aren't taking advantage of TouchId. It's so easy for people to use. Even login.gov supports it! https://www.slashgear.com/chrome-is-adding-touch-id-and-fing...

Touch ID and other biometrics are enforced locally. The device is first enrolled, the website gives the device a secret value which the device can put in its secure element. When needing to authenticate again the device checks biometrics locally and if correct then the secure element releases the secret value which is then either passed onto the website or used as part of a challenge-response authentication. This mea…

Yes, that's a security feature. It's also true for Google Authenticator, by design. You cannot officially back up/share codes because of the potential vulnerabilities that a backup would open up.

Yubikey has the same problem you describe. If your key stops working, you'd also be locked out. Yubikeys can spontaneously stop working in my experience.

To mitigate this, sites like login.gov allow you to add multiple devices, so you can have it on e.g. your laptop and your phone, and yubikeys if you'd like. I generally do all three for important sites (or multiple Yubikey when touchID is not offered).

Anyway, my point is that offering TouchID makes a more secure 2FA very, very convenient for the average person. I'm just surprised more developers haven't offered it even though it's been in Chrome for a couple years.

Re: SMS is not 2FA-secure

#317

Post by 0xff00ffee »

1996 wrote: post #108
0xff00ffee wrote: post #35

Earlier quoted context omitted.

> What happens if the user loses a yubikey. Always buy two. ;-) Joking aside, I've moved almost every 2FA to hard token, soft-token, or google voice. But the root of trust is still LastPass & Google. I don't see an easy way out of dependency other than power of attorney. Even worse: I worry what happens to my protected assets as I age and possibly face memory loss.

Bad idea: google will disable your google voice after some time of not logging in. I got bitten in a bad way! Hopefully twilio will start creating "recognized" numbers someday, as my twilio number is unusable for TOTP. There seems to be a blacklist of all twilio voip numbers.

Interesting! I generally check it once a week. Any idea what their timeout is?

Re: SMS is not 2FA-secure

#318

Post by AaronFriel »

sneak wrote: post #214
balladeer wrote: post #209

Earlier quoted context omitted.

I use Authy on iPhone and Mac. I am looking for an OSS replacement but would not want to setup everything from scratch after I change device reinstall the app like Google Authenticator.

Bitwarden does a decent job of storing and syncing TOTP codes. Make sure you always use a long password with Bitwarden though, to avoid a known and unpatched issue with their password-based key derivation.

What issue is that?

Re: SMS is not 2FA-secure

#319

Post by missingrib »

cortesoft wrote: post #201
wyxuan wrote: post #186

Earlier quoted context omitted.

Apps like Google authenticator, or more conveniently, a Google voice number. The Google voice solution works well since it can't be Sim swapped, and can be accessed via email (admittedly, a potential downside).

How do you recover your google voice account if you lose that?

Long recovery passphrase that you write down and keep in a safe

Re: SMS is not 2FA-secure

#320

Post by wool_gather »

fastball wrote: post #305
Nextgrid wrote: post #300

Earlier quoted context omitted.

Does the bar code act as a key to lookup a record in a central database, or does it just encode "I am 21, trust me" without any cryptographic signature? Unless it's the former it's as good as a standard paper ID as far as forgeries go. If anything, having it machine-readable decreases security as it means the person inspecting it spends less time looking at it and just scans it in a machine.

I can almost guarantee it's not the latter.

You would lose; the barcodes are just machine-readable packaging of the information already on the licenses: name, DOB, address, etc.
Post reply on HN