Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SMS is not 2FA-secure

issms2fasecure.com

Post reply on HN
Print view View original

361–370 of 379 posts

Re: SMS is not 2FA-secure

#361

Post by ahaseeb »

alamortsubite wrote: post #336
frutiger wrote: post #264

Earlier quoted context omitted.

> IN Europe you no longer need to tell them whether you're abroad or not The same is true with my major US bank (and probably other banks too).

YMMV. An ING ATM in Romania swallowed my gf's U.S. Santander card a couple months ago. We were told it was because she hadn't set a travel notice.

Losing a bank card isn't as critical as losing a phone # so companies have to act quickly. Think about it - Can you live without your bank card for few days vs living without your #

Re: SMS is not 2FA-secure

#362

Post by ahaseeb »

kelnos wrote: post #344
Lucadg wrote: post #197

Earlier quoted context omitted.

What if you are abroad? My debit card was recently blocked and I had to wait until I went back, walked in the bank and show my face and ID.

I think we just need to be prepared for these sorts of things. Travel with cash, your debit card, and one or two credit cards. If you can afford it, have a backup SIM (Twilio sells SIM cards for about $3 and the cost to keep them activated is $1/mo, and nothing more if you don't use it [0]). Use a Twilio or Google Voice number that you don't use for anything else for 2FA or account recovery for services that require…

It's about convenience. 99% of the people will take convenience over security. Changing behaviour is difficult

Re: SMS is not 2FA-secure

#363

Post by ahaseeb »

fauigerzigerk wrote: post #274
hanney wrote: post #267

Earlier quoted context omitted.

".. a recovery email address" This just moves your security issues to another account.. how many layers of recovery email address are you willing to go before hitting the end?

What you can do with email is move the problem to your most secure account or to an account that you know how to recover under essentially all circumstances.

As I mentioned before that it's just convenience. SMS based authentication is flawed and is also prone to SS7 Attacks but people just do it because it's simple. Nothing in the world is hack proof

Re: SMS is not 2FA-secure

#364

Post by ahaseeb »

tialaramex wrote: post #288
vladvasiliu wrote: post #237

Earlier quoted context omitted.

I have a counterpoint from my experience in France. A few years back I have lost my phone and went to get a new SIM. The attendant in the shop only had a quick look over my ID card. He didn't scan it nor did he enter the ID number in the computer to check anything. I think he only verified that the name was the same as the one on file and the photo looked like me. The same happens at the post office when you go to co…

The pen contains a chemical that interacts with the paper that's always used to make these bank notes. Specifically it blackens the starch found in wood pulp, and the paper in your laser printer, photocopier, etcetera uses wood pulp because that's cheap. Bank notes use a higher quality paper and so they aren't turned black. This forces crooks to use more expensive and traceable high quality papers for their counterfe…

I still think the system is very much gameable. In US atleast it'll take lot of time. We still have to swipe cards and checks are accepted

Re: SMS is not 2FA-secure

#365

Post by ahaseeb »

konschubert wrote: post #322
cortesoft wrote: post #180

Earlier quoted context omitted.

So how SHOULD this problem be solved? How should account recovery work?

A sim transfer/ account recovery process should come with a transition period of multiple days during which SMSs with warnings are sent to the original sim card. On top of that, one could think of: A passphrase to authenticate a number transfer to another sim. Sending a code through physical mail.

I've implemented something like this at Dontport. There are few work arounds but again security isn't something that's on top of traditional carrier because it's a problem with a small set of people

Re: SMS is not 2FA-secure

#366

Post by tinus_hn »

ahaseeb wrote: post #359
tinus_hn wrote: post #353

Earlier quoted context omitted.

The clerk has to use some kind of online system to connect the new sim to the customers phone number. The system would obviously require the clerk to authenticate himself and could require him to enter the passport number or other document ID he checked to verify the customers identity. If later it turns out this was a sim swapping attack you can verify if the clerk entered a valid document ID. He can’t do that witho…

Its just convenience over security. Lot of things can be done but then the extra burden that companies have to go through. Think about that people don't use app based authentication because it's inconvenient even though it matters to them. How can you expect carriers to do it

That’s easy, just make the carrier financially liable for the damages caused by sim swapping attacks.

Re: SMS is not 2FA-secure

#367

Post by ahaseeb »

Pxtl wrote: post #283
tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

Seems straightforward, all these phone companies have endless kiosks and offices. Legislate that a phone number can only be transferred by making a confirmation call to the old phone or in-person with a salesperson who is checking ID.

People can be bribed and that's the basic flaw

Re: SMS is not 2FA-secure

#368

Post by juskrey »

ossguy wrote: post #289
juskrey wrote: post #248

Earlier quoted context omitted.

Good luck trying to use VOIP numbers with US banks these days

In practice it seems to work fine with the banks I've tried. There may be one or two that don't accept numbers whose type is listed as "voip", but they are in the minority. There is also work being done to update the type field of JMP numbers so they appear as "mobile" instead.

Note this is a pretty recent movement in banking security, several months or so. E.g. Wells Fargo did work previous autumn, not anymore. More can be googled.

Type field is interesting. Not sure this can pass the radars for too long though.

Re: SMS is not 2FA-secure

#369

Post by jorvi »

SpaethCo wrote: post #327
jorvi wrote: post #179

Earlier quoted context omitted.

Its great functionality but it reduces your security. Say someone somehow figures out your 1Password password and security key - if you store your OTPs in Authy, your passwords are useless (well, less useful anyway). If you store your OTPs in 1Password, they have the keys to the kingdom.

This is technically true, but the most likely scenarios that result in the discovery of your secret key (128bits of entropy) + master password (?? additional bits) involve things like a device compromise. If your machine is compromised, you’re probably already exposed to things like session cookie stealing. At that point your attack surface is already blown wide open. The biggest thing 2FA protects against is credent…

TBH for me my threat model looks like this:

Passwords - protect against unauthorized access of my service accounts, and 1Password - can be compromised via logging or breaches or just plain peeping

Secret key - acts as 2FA for my 1Password and thus protects my master password from unauthorized use - can be compromised if someone steals the physical paper on which it's stored

TOTP - protect against unauthorized use of my service accounts - can be compromised if someone compromises my mobile phone or phone number. Highly unlikely someone would spend that kind of effort and €€€ on me though

All in all its a pretty nicely tiered system. If someone gets my master password, they still need the secret key. If a burglar steals my secret key, they don't have my master password. If someone somehow compromises both of those, they still don't have access to my TOTPs and thus can't login into any of my 'cricital' accounts (basically e-mail, hosting providers, finance, etc. etc.)

Now imagine you have an malicious spouse or housemate or whatever: they could easily learn your master password by peeping over your shoulder, piecing it together bit by bit (ha). They have a lot of opportunity to search for your secret key as well. If you put your TOTPs on 1Password, you're boned. But if you have them in an authenticator app, even having access to your password manager means jack because they can't login without your TOTPs.

I know one of the big faux pas is to talk about your security but most of this stuff can be deducted pretty easily so I don't feel too exposed.

Re: SMS is not 2FA-secure

#370

Post by konschubert »

ahaseeb wrote: post #365
konschubert wrote: post #322

Earlier quoted context omitted.

A sim transfer/ account recovery process should come with a transition period of multiple days during which SMSs with warnings are sent to the original sim card. On top of that, one could think of: A passphrase to authenticate a number transfer to another sim. Sending a code through physical mail.

I've implemented something like this at Dontport. There are few work arounds but again security isn't something that's on top of traditional carrier because it's a problem with a small set of people

Nice product!

https://dontport.com/

Do you know if something like this exists in europe?

Post reply on HN