Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

311–320 of 323 posts

Re: Second factor SMS: Worse than its reputation

#311

Post by zamber »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Banks like that exist. mBank from Poland does in-app approve/reject - similar to what you get on an Android phone when you try logging in on a new PC.

They also send phishing warnings when they find active campaigns.

That said, plain old social engineering works well on people. Last week one small-scale influencer fell victim to a bank transfer scam. Got phoned by a bank person telling her that her account is targeted by hackers, then a cybersec police head phoned her and asked to transfer her savings to a 'secure account'.

Re: Second factor SMS: Worse than its reputation

#312

Post by averageRoyalty »

TonyTrapp wrote: post #27
averageRoyalty wrote: post #18

Hardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.

It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.

Okay, but the transport layer (SMS) is independent of the issue here. Email, push, even carrier pidgeon OTPs would suffer the same issue.

Also, storing secrets is day to day life in a lot of scenarios.

Re: Second factor SMS: Worse than its reputation

#313

Post by JadeNB »

rezonant wrote: post #269
Thorrez wrote: post #262

Earlier quoted context omitted.

There were ads on google.com since at least 2000[1]. Chrome wasn't announced until 2008. Disclosure: I work at Google but not on ads or Chrome. [1] https://googlepress.blogspot.com/2000/10/google-launches-sel...

I believe they meant on https://google.com (the home page)

Yes, thank you, you are right!

Re: Second factor SMS: Worse than its reputation

#314

Post by JadeNB »

Thorrez wrote: post #294
rezonant wrote: post #269

Earlier quoted context omitted.

I believe they meant on https://google.com (the home page)

Oh, I didn't think of that. But I don't think that's really true either. There seem to be ads on the homepage before Chrome: Google News: https://web.archive.org/web/20021001073516/http://www.google... Google Calendar: https://web.archive.org/web/20060831050142/http://www.google... For comparison, Chrome: https://web.archive.org/web/20080904192205/http://www.google... Now admittedly the Chrome one is a bit flashier.…

Ah, either the author of the article I'm dimly remembering was mistaken, or, much more likely, they correctly inserted some caveat that made the claim true, and the precise caveat was just lost to my faulty memory and the mists of time. I didn't bother trying to check the Wayback Machine because, for some reason, I was convinced that Google would have requested that the home page not be crawled; thank you for doing it!

Re: Second factor SMS: Worse than its reputation

#315

Post by kalleboo »

hiatus wrote: post #56
jdiez17 wrote: post #39

Earlier quoted context omitted.

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

> Hot take: rooted phones are inherently less secure. My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?

When I access my bank from my computer, I need to authenticate using a secure token, where my options are an RSA-style dedicated device or a secure (non-rooted) smartphone.

Re: Second factor SMS: Worse than its reputation

#316

Post by Rygian »

aftbit wrote: post #100
Rygian wrote: post #86

Earlier quoted context omitted.

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.

I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice. Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.

Sending a one time code by email means that anyone with access to them inbox can both reset the password (first factor) and intercept one time codes ("second" factor).

Using SMS creates an opportunity to dissociate those two situations.

Re: Second factor SMS: Worse than its reputation

#317

Post by DanielHB »

mixmastamyk wrote: post #150
DanielHB wrote: post #112

Sweden solved this problem years ago with BankID https://en.wikipedia.org/wiki/BankID It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great. It is incredible there is no system like this for every country, heck it is incredible that ther…

Is it true that it doesn’t support Linux as the wiki implies? I guess the card form could be used instead.

It is pretty complicated for the average person to install custom certificates on their OS. I didn't even knew that BankID supported it, pretty much every one uses the app.

Re: Second factor SMS: Worse than its reputation

#318

Post by xp84 »

brandon272 wrote: post #292
akira2501 wrote: post #290

Earlier quoted context omitted.

"We face this. It's about 5% of users. Our margins are large enough we don't worry about this segment. They need our service more than we need them." - Any Large Bank Anywhere

Most large banks already largely offer non-SMS 2FA through their companion mobile apps. This is about pretty much every other service you have that does not have a dedicated mobile app and doesn't want to teach their users how to manage your 2FA codes.

The problem with the above statement is that merely “offering” a better option doesn’t solve the issue. The mere presence of SMS as one option gives the same risk as if it were SMS- only. An attacker can choose the sms option (after slipping $100 or even just a fake ID to the teen at the phone store to sim-swap you) even if you never would use it. It needs to be at minimum able to be permanently disabled on demand.

Re: Second factor SMS: Worse than its reputation

#319

Post by sleepyhead »

slow_typist wrote: post #301
sleepyhead wrote: post #245

Earlier quoted context omitted.

It's not really 2FA even. More like a magic link (which is what we use for verification via email). The customer has no password, just verifies using a code via sms/email.

Passwordless, so to speak. Does it help with conversion rates?

It’s for the booking site so most visitors come to make a booking thus conversion rate would be high generally. We never had passwords there so can’t compare conversion rates.

For signups to our app (to get an account with a booking site) we require a password.

Re: Second factor SMS: Worse than its reputation

#320

Post by bux93 »

namibj wrote: post #224
bux93 wrote: post #61

Earlier quoted context omitted.

Yes, the Payment Services Directive requires "dynamic linking" to a specific amount and a specific payee in article 97, and the RTS in article 5 go on to say that the payer should be "made aware of the amount of the payment transaction and of the payee". The most elegant implementation I saw of this were card readers with a 2D (colored) barcode scan ; the 2D barcode contained transaction details that the card reader…

I preferred the blinky bars; the reader for them is tiny, not locked to an account, battery lasts what feels like forever, and they're cheap enough that you can trivially eat a loss (from forgetting where it is or leaving it in a place where it disappears before you get a chance to collect it). Maybe just stick an airtag to the back?

The blinky bars were great! Already forgot about those. If I remember correctly, a problem with those were people with displays that had funky refresh rates? I think that in the current era that would be much less of a concern. Conceptually it's great to have an actual physical, airgapped device under your full control as your signing device.
Post reply on HN