SMS is not 2FA-secure • Hacker News Board

Re: SMS is not 2FA-secure

#331

Post by imtringued » Sat, Jan 11, 2020, 8:52 PM UTC

cortesoft wrote: post #180

tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

So how SHOULD this problem be solved? How should account recovery work?

Well first of all using a password manager should be the last resort recovery strategy. Unlike device based 2FA a password manager allows you to make an unlimited number of backups.

After that 2FA should always be device specific. If you want to do 2FA with your phone then the 2FA challenge should not get sent via an identifier like a phone number that may change owners. Instead you should download a 2FA app that generates a private/public key pair where the public key is linked to your account. That way the only thing you need to do is wipe your phone remotely if it gets lost.

Re: SMS is not 2FA-secure

#332

Post by imtringued » Sat, Jan 11, 2020, 8:54 PM UTC

kccqzy wrote: post #131

mumblemumble wrote: post #113

Earlier quoted context omitted.

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

>Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome.

If that were possible then you would face the same problems that reused SMS numbers suffer from.

Re: SMS is not 2FA-secure

#333

Post by jandrese » Sat, Jan 11, 2020, 8:56 PM UTC

tzs wrote: post #297

jandrese wrote: post #224

Earlier quoted context omitted.

People chasing perfect security by only putting their TOTP codes in one place seems like perfect being the enemy of good. Back up you codes people! Put them in an encrypted file and back that file up in a bunch of places. Encrypting a file is a bit arcane, but not difficult: openssl enc -aes-256-cbc -pbkdf2 -iter 1024 -in plaintext.txt -out cryptotext.dat Decrypting is about the same: openssl enc -aes-256-cbc -pbkdf2…

Do you have one encrypted file with all the codes, or do you have one file per code? I prefer one file per code. When I get a new code, I make a directory named after the account the code is for, save a screenshot of the QR code in there, save a text file with the text version of of the code and any one-time recovery codes the site provided. I then make a .zip for .tgz from that directory, encrypt that, and save a co…

Having a simple encrypted file means you can stuff it on an online backup though. The point is to have the keys stashed in several places so the loss of any one or two devices doesn't lock you out of your life.

I prefer keeping it as simple as possible since the consequences of screwing it up are a whole lot of hassle and possibly being locked out of some accounts forever. One downside is when you add or change a code you have to update all of your backups. A second script that syncs all of the backup files is also helpful to have.

Re: SMS is not 2FA-secure

#334

Post by surround » Sat, Jan 11, 2020, 9:00 PM UTC

http://isThisYourPaperOnSingleServingSites.com/

Re: SMS is not 2FA-secure

#335

Post by dr_dshiv » Sat, Jan 11, 2020, 9:15 PM UTC

Isn't perfect the enemy of the good, especially in security?

Re: SMS is not 2FA-secure

#336

Post by alamortsubite » Sat, Jan 11, 2020, 9:33 PM UTC

frutiger wrote: post #264

egwor wrote: post #245

Earlier quoted context omitted.

In Europe you have a telephone PIN codes, you have number generators on the app. There are lots of ways to authenticate yourself. IN Europe you no longer need to tell them whether you're abroad or not; I guess the ML algo's that monitor for fraud are so much better than before that this isn't needed.

> IN Europe you no longer need to tell them whether you're abroad or not The same is true with my major US bank (and probably other banks too).

YMMV. An ING ATM in Romania swallowed my gf's U.S. Santander card a couple months ago. We were told it was because she hadn't set a travel notice.

Re: SMS is not 2FA-secure

#337

Post by lol768 » Sat, Jan 11, 2020, 10:04 PM UTC

DaiPlusPlus wrote: post #126

sfifs wrote: post #97

Earlier quoted context omitted.

They (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access. In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets de…

HOTP-based 2FA systems (like Google Authenticator) do not require internet connections.

Don't most folks uses TOTP-based schemes with Google Authenticator?

Unless you're using HOTP to mean HOTP and all extending schemes.

Re: SMS is not 2FA-secure

#338

Post by samatman » Sat, Jan 11, 2020, 10:19 PM UTC

__david__ wrote: post #280

balladeer wrote: post #209

Earlier quoted context omitted.

I use Authy on iPhone and Mac. I am looking for an OSS replacement but would not want to setup everything from scratch after I change device reinstall the app like Google Authenticator.

https://freeotp.github.io/ iPhone backups back up its data correctly—my codes survive new phone restores where they do not with Google Authenticator.

Thanks for sharing this link.

I've wanted to get off Google Authenticator for awhile now, mostly because of the backup-restore problem, also a general trend of limiting my involvement with the company.

Re: SMS is not 2FA-secure

#339

Post by cortesoft » Sat, Jan 11, 2020, 10:48 PM UTC

ozim wrote: post #236

Lucadg wrote: post #197

Earlier quoted context omitted.

What if you are abroad? My debit card was recently blocked and I had to wait until I went back, walked in the bank and show my face and ID.

Before you go abroad you could notify your bank. Then in period you declared you are abroad they should lower expectation from "in person and ID" to phone call and other means of verification. After that period you are automatically back to normal security. That is for example how my debit card works. If I want to use it abroad I have to turn that feature on for whatever time I am abroad.

So the bad guy can just notify the bank that you are traveling abroad, and then use the easier method to gain access.

Re: SMS is not 2FA-secure

#340

Post by sneak » Sat, Jan 11, 2020, 11:10 PM UTC

AaronFriel wrote: post #318

sneak wrote: post #214

Earlier quoted context omitted.

Bitwarden does a decent job of storing and syncing TOTP codes. Make sure you always use a long password with Bitwarden though, to avoid a known and unpatched issue with their password-based key derivation.

What issue is that?

CVE-2019-19766

https://github.com/bitwarden/server/issues/589