Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker got all my texts for $16

vice.com

Post reply on HN
Print view View original

51–60 of 296 posts

Re: A hacker got all my texts for $16

#51

Post by sneak »

hn_throwaway_99 wrote: post #42

Lots of comments here along the lines of "SMS 2FA is bad", but hell, if the phone companies had an appropriate level of liability here (which should be a shit ton), this should be impossible. And it's not just about 2FA, most of humanity expects that if someone else texts them, those texts will go to their phone and only their phone unless they've given explicit verifiable consent. I mean, in this case all the hacker…

This would also be impossible if services stopped demanding your phone number to make an account.

This is a growing trend in consumer services, and it's a privacy nightmare.

Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days.

There are widespread reports of delivery businesses selling their phone number databases (with associated credit card suffixes, delivery addresses, order history, et c) to large advertising companies for data mining.

Providing your direct cell number to an app is basically like providing your home address and a bunch of other sensitive data. Don't do it, or make a burner gmail account to get a disposable Google Voice number for each account that you must have that demands a phone number. Then, that number isn't reused and an attacker that obtains your mobile number can't attack your login method for other apps.

Reusing phone numbers is about as bad as reusing passwords.

Re: A hacker got all my texts for $16

#52

Post by angst_ridden »

pgsimp wrote: post #49
angst_ridden wrote: post #47

So, when my nontechnical friends ask me what they should be using for 2FA, I'm kind of at a loss what to tell them. It's either a false sense of security (e.g., SMS), or too complicated for them (Yubikey). There's got to be a better system.

Authenticator Apps?

The difficulty there is evaluating which ones are reliable, secure, and easy to use. I'd welcome recommendations.

Re: A hacker got all my texts for $16

#54

Post by AnimalMuppet »

coding123 wrote: post #50
hn_throwaway_99 wrote: post #42

Lots of comments here along the lines of "SMS 2FA is bad", but hell, if the phone companies had an appropriate level of liability here (which should be a shit ton), this should be impossible. And it's not just about 2FA, most of humanity expects that if someone else texts them, those texts will go to their phone and only their phone unless they've given explicit verifiable consent. I mean, in this case all the hacker…

When they invented text messaging, heck even the phone system itself, did they provide anything that said there was an expectation of privacy? Not sure which is why I'm asking.

If I understand correctly, the initial telephone systems were run by manual operators at a physical switchboard, who could listen in to anything that was said on any line. Many people also had party lines, where someone (in another house or apartment) could pick up their phone and listen to your conversations.

So, no, not much of an expectation of privacy - at least, there shouldn't have been.

Re: A hacker got all my texts for $16

#55

Post by sushid »

floss_silicate wrote: post #38
voicedYoda wrote: post #36

Voip.ms, vonage/twilio, et al let you set up an SMS capable number really quickly and cheaply, available globally... And you'd be fully in control

I tried to set up a Twilio number specifically to handle these services that demand SMS for login. Weirdly it only works for a minority of services, I expect many use Twilio to send their auth texts and Twilio blocks sending these to their own numbers?

I'm not sure if Twilio blocks sending to their own numbers but you can't receive from or send to short codes, which will limit you a lot when verifying with services like Uber.

Re: A hacker got all my texts for $16

#56

Post by easton »

angst_ridden wrote: post #52
pgsimp wrote: post #49

Earlier quoted context omitted.

Authenticator Apps?

The difficulty there is evaluating which ones are reliable, secure, and easy to use. I'd welcome recommendations.

The integrated TOTP in 1Password is pretty good, it can grab the QR code off the screen and everything.

https://support.1password.com/one-time-passwords/

Re: A hacker got all my texts for $16

#57

Post by t-writescode »

177tcca wrote: post #43
t-writescode wrote: post #19

Earlier quoted context omitted.

I like not being locked out of my applications when my phone goes for an unexpected swim and I have to replace it. The numerous emails I get when I log in from a new device serve me pretty well, all things considered

Secure phones are sub-$200. If you have multiple accounts, services, etc, then backing up your 2FA codes, or registering two devices/phones at the same time should be on your radar.

This doesn't sound like something your average user is going to be doing in most cases - keeping a backup, secondary phone.

We've already successfully gotten people to start using some level of 2FA in the form of SMS-based identity validation along with their password.

That's a pretty impressive step forward, and sufficient for most non-specifically targeted users' usage.

Re: A hacker got all my texts for $16

#58

Post by late2part »

InvertedRhodium wrote: post #48
lostlogin wrote: post #35

Earlier quoted context omitted.

The whole 2 factor thing really falls down if sms is a part and you aren’t getting the messages. I had a miserable time trying to get into Backblaze recently, with even the ability it offered to switch sms providers failing. The list of valid keys they give you on setup bailed me out eventually, but it took me a while to remember them.

> remember them Uh. You're supposed to memorise them? I printed them out and stuck them in a safe place.

I put mine on stickies on my laptop. Or if they're really important on a sticky in my desk drawer.

Re: A hacker got all my texts for $16

#59

Post by shishy »

supernova87a wrote: post #41
testfoobar wrote: post #9

How do you protect against this type of attack?

I believe the practical solution for many people is to switch the 2FA to an authenticator on-your-phone code generator, which someone cannot hack easily. Most important account / banks / etc services now offer this option. The only thing is, though, make sure to keep backups of the codes you use to initialize the authenticator app, because for some services there is no recovery if you lose your phone or don't have ba…

Hi, which bank(s) offer this?

> switch the 2FA to an authenticator on-your-phone code generator, which someone cannot hack easily.

I remember looking a few months ago and they only offered SMS 2FA.

Thanks

Re: A hacker got all my texts for $16

#60

Post by slickdork »

angst_ridden wrote: post #52
pgsimp wrote: post #49

Earlier quoted context omitted.

Authenticator Apps?

The difficulty there is evaluating which ones are reliable, secure, and easy to use. I'd welcome recommendations.

I personally use andOTP [0] which I'm a fan of. I've been thinking of switching to aegis [1] for nothing more than a UI change.

[0]https://github.com/andOTP/andOTP

[1]https://github.com/beemdevelopment/Aegis

Post reply on HN