Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How SMS fraud works and how to guard against it

apuchitnis.substack.com

Post reply on HN
Print view View original

41–50 of 107 posts

Re: How SMS fraud works and how to guard against it

#41

Post by moremetadata »

velavar wrote: post #22
Arch-TK wrote: post #12

I really want to know, why has everyone moved to SMS 2F"A"? What was wrong with authenticator applications? Were they really THAT user unfriendly?

I don't think that folks so much "moved" to SMS 2FA as much as were with it from the start. SMS 2FA is so ingrained in the finance/fintech industry that it's pretty rare for me to see a financial company offer the option to set up an Authenticator 2FA. Also, there is always some part of the consumer population that is still not on a smartphone and even if they are, they may not be "app-savvy" where they know how to i…

2FA works well with the geolocation service SS7 [1,2], so when your text message and OTP code arrives, the firm could also be using SS7 to get your location.

[1] https://en.wikipedia.org/wiki/Signalling_System_No._7

[2] https://web.archive.org/web/20201219144441/https://www.thebu...

Re: How SMS fraud works and how to guard against it

#42

Post by jimt1234 »

velavar wrote: post #22
Arch-TK wrote: post #12

I really want to know, why has everyone moved to SMS 2F"A"? What was wrong with authenticator applications? Were they really THAT user unfriendly?

I don't think that folks so much "moved" to SMS 2FA as much as were with it from the start. SMS 2FA is so ingrained in the finance/fintech industry that it's pretty rare for me to see a financial company offer the option to set up an Authenticator 2FA. Also, there is always some part of the consumer population that is still not on a smartphone and even if they are, they may not be "app-savvy" where they know how to i…

I finally got my 75-year-old mother to add 2FA/SMS to her online banking account. She calls me (from her landline) every time she tries to login. I have to walk her through the process. We usually have to request a new auth code be sent at least twice. It generally takes 10 or 15 minutes, although, admittedly, half the time is her complaining.

So, yeah, there's no way I could get her to use an Authenticator app. (Also, there's, "...all these apps scare me.", which isn't a bad thing considering the first (and last) app she installed on her Android phone was a malicious 'flashlight' app that kept displaying some sort of crypto ads.)

Re: How SMS fraud works and how to guard against it

#43

Post by lostlogin »

crazygringo wrote: post #32
Arch-TK wrote: post #12

I really want to know, why has everyone moved to SMS 2F"A"? What was wrong with authenticator applications? Were they really THAT user unfriendly?

People lose their phones and then your authenticator app doesn't work anymore, even if you restore from backup. And then the recovery mechanism is often a giant pain. Yes, that's pretty user unfriendly. It's a lot more common to lose your phone than lose your phone number.

I'd say that upgrades are the pain point. Every time I upgrade my phone the dread of sorting authenticator apps is real.

Re: How SMS fraud works and how to guard against it

#44

Post by lostlogin »

cfn wrote: post #11
AdamJacobMuller wrote: post #2

This makes the assumption that Twitter blocked it due to SMS fraud. While that's a plausible theory an equally plausible theory is that they were worried about account hijacking and security (and allowed twitter blue subscribers to continue to use it on a you can pay me to be stupid context) which seems equally plausible. I take issue with a lot of the assumptions in the article but this is funny: > Identify and bloc…

Elon Musk said that they were being fleeced by SMS fraud when the change was announced.

Does Elon stating something make it more or less likely to be true?

Re: How SMS fraud works and how to guard against it

#45

Post by yonixw »

malfist wrote: post #26
lotsofpulp wrote: post #21

Earlier quoted context omitted.

I use Strongbox to backup TOTP in Keepass databases.

That's good for you, is grandma going to do that?

I'm a programmer and when I was told to store backup codes, I saw the site still has a "Forgot Password?" button so I dismissed it as a QUICK way to recovery, Not the ONLY way!

The only one who told me losing backup codes means losing your data forever was my bitcoin wallet. (Ironic)

Re: How SMS fraud works and how to guard against it

#46

Post by crazygringo »

mcherm wrote: post #33
crazygringo wrote: post #32

Earlier quoted context omitted.

People lose their phones and then your authenticator app doesn't work anymore, even if you restore from backup. And then the recovery mechanism is often a giant pain. Yes, that's pretty user unfriendly. It's a lot more common to lose your phone than lose your phone number.

There are numerous tools, Google Authenticator and Authy for example, that protect against this by securely storing the keys. In fact, I would venture to say that MOST users of authentication apps are using ones that provide a backup in case the phone is lost.

No, Google Authenticator does not securely store keys anywhere but your physical phone. If you lose your phone, they're gone.

The only thing it provides is a way to export from one device to another, but that requires having the first device still with you. [1]

On the other hand, yes fortunately Authy does provide cloud backups. But your average end user generally doesn't have the slightest idea of why they should use one authenticator app over another. Expecting them to do the research to figure out that they should use Authy over Google Authenticator in case they lose their phone is asking way too much. Again, completely user unfriendly.

[1] https://support.google.com/accounts/answer/1066447

Re: How SMS fraud works and how to guard against it

#47

Post by autoexec »

Arch-TK wrote: post #12

I really want to know, why has everyone moved to SMS 2F"A"? What was wrong with authenticator applications? Were they really THAT user unfriendly?

authenticator apps come with privacy concerns. Right now, Microsoft has no means to collect my location data, they don't have any access to my phone, including my phone's camera. The moment I install Microsoft authenticator that situation changes. No thanks.

Re: How SMS fraud works and how to guard against it

#48

Post by jsmith99 »

Arch-TK wrote: post #38
cultofmetatron wrote: post #17

Earlier quoted context omitted.

my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone

Wouldn't most people just use Google Authenticator and have it automagically back up to google's nigh unlimited storage space? Obviously not something anyone who respects their privacy would subject themselves to, but it seems to me like the easy path leads to these things being backed up. Obviously if google has your 2FA keys and you were using 2FA keys to log into your google account then you would need to recover…

You would think that. Actually, Google authenticator does NOT backup codes, although there are other apps that do.

Re: How SMS fraud works and how to guard against it

#49

Post by kentonv »

Arch-TK wrote: post #38
cultofmetatron wrote: post #17

Earlier quoted context omitted.

my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone

Wouldn't most people just use Google Authenticator and have it automagically back up to google's nigh unlimited storage space? Obviously not something anyone who respects their privacy would subject themselves to, but it seems to me like the easy path leads to these things being backed up. Obviously if google has your 2FA keys and you were using 2FA keys to log into your google account then you would need to recover…

Google Authenticator does not back up TOTP state to Google. In fact, AFAIK, the app does not talk to the internet, at all, much less does it associated with a Google account.

You can transfer your Google Authenticator state to another phone. This is accomplished through scanning QR codes -- no data is transferred over a network. This is a relatively new feature; for many years, Google Authenticator refused to provide any way to extract the authenticator state from the phone at all. You literally had to root your phone to get the state out.

It's designed this way because if your TOTP state were backed up to your Google account then it would no longer provide any additional security over Chrome's password manager, which is also backed up to Google. The two factors in "two factor" are supposed to be "something you know" (password) and "something you have" (phone, or security key). In order for the authenticator app to really be "something you have", it has to be hard to copy.

Post reply on HN