Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

51–60 of 323 posts

Re: Second factor SMS: Worse than its reputation

#51

Post by wiredfool »

rlpb wrote: post #45
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. My understanding of EU regulation is that it effectively requires this by requiring the 2FA to validate not just the identity but also the transaction (such as an amount, or d…

My EU bank uses an app for consumer accounts. It hasn’t used sms for a few years, except when setting the app up on a new phone/sim.

Re: Second factor SMS: Worse than its reputation

#52

Post by 0xbadcafebee »

I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor.

Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's password managers built into browsers in addition to the 3rd party ones. There are personal, family, and enterprise options. They could be installed as a system service to isolate them from userland attacks. They support advanced functionality like SSH keys, git signing and biometrics.

If you're a stickler about having a completely independent factor from your desktop/phone/etc, password managers could be used with different profiles on different devices, and allow several easy ways to pass an auth token between devices (via sound, picture, bluetooth, network, etc), ensuring an independent device authenticates the login to avoid malware attacking the password manager.

We already have the tools to do something way more secure than SMS, and it's already on most of our devices/browsers. We just have to make it the preferred factor.

Re: Second factor SMS: Worse than its reputation

#53

Post by intelVISA »

kkfx wrote: post #6

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope…

We have that with FIDO2, unfortunately there is too much $$$ to be made perpetuating the problem, propping up adjacent ecosystems like cloud and leaky auth apps.

Re: Second factor SMS: Worse than its reputation

#54

Post by hedora »

jdiez17 wrote: post #39
didntcheck wrote: post #38

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

"Less secure" depends on your threat model.

I'm much less worried a hypothetical attack where I accidentally give sudo access to a malicious app than I am about the well-established ongoing attacks where Google violates the entire population's privacy, or the regular stream of malware that makes it into the official app store.

Re: Second factor SMS: Worse than its reputation

#55

Post by [deleted] »

upofadown wrote: post #23
ossobuco wrote: post #14

Earlier quoted context omitted.

As the linked post says itself, "2FA-SMS is Better Than Nothing"

I would argue that a 1FA unguessable password used once is just as good. Certainly better than the case where the provider offers account resets using just SMS thus having effectively 1FA SMS.

[deleted]

Re: Second factor SMS: Worse than its reputation

#56

Post by hiatus »

jdiez17 wrote: post #39
didntcheck wrote: post #38

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

> Hot take: rooted phones are inherently less secure.

My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?

Re: Second factor SMS: Worse than its reputation

#58

Post by 0xbadcafebee »

kardianos wrote: post #48
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

We have it: FIDO U2F. you could even treat it like the new password less manager, with a computer/phone specific store. My gut? It actually works, and people didn't like that. Users and orgs like authentication slightly broken so they can work around systems.

It only works in a couple of situations and it's difficult to manage. When the site doesn't support it (which is almost all of them), when you don't have USB, when you lose or forget your YubiKey, when you don't have a phone with NFC or lose it, when you can't afford the device, or it's difficult for the user to set up, etc it fails. Now you need a different factor to finish logging in, which is probably weaker, so attackers will try to degrade this first factor to force the second weaker one.

It's a nice-to-have but not even close to a universal solution.

Re: Second factor SMS: Worse than its reputation

#59

Post by armada651 »

kardianos wrote: post #48
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

We have it: FIDO U2F. you could even treat it like the new password less manager, with a computer/phone specific store. My gut? It actually works, and people didn't like that. Users and orgs like authentication slightly broken so they can work around systems.

> My gut? It actually works, and people didn't like that. Users and orgs like authentication slightly broken so they can work around systems.

People like authentication systems that are secure enough to keep bad actors out, but not so secure that it keeps legitimate users out. It's got nothing to do with users wanting to break into a system.

Re: Second factor SMS: Worse than its reputation

#60

Post by rlpb »

wiredfool wrote: post #51
rlpb wrote: post #45

Earlier quoted context omitted.

> So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. My understanding of EU regulation is that it effectively requires this by requiring the 2FA to validate not just the identity but also the transaction (such as an amount, or d…

My EU bank uses an app for consumer accounts. It hasn’t used sms for a few years, except when setting the app up on a new phone/sim.

> except when setting the app up on a new phone/sim.

So it does when it needs to authenticate you :)

Post reply on HN