Earlier quoted context omitted.
Authenticator Apps?
The difficulty there is evaluating which ones are reliable, secure, and easy to use. I'd welcome recommendations.
Google Authenticator seems fine?
A hacker got all my texts for $16
61–70 of 296 posts
Re: A hacker got all my texts for $16
#62Lots of comments here along the lines of "SMS 2FA is bad", but hell, if the phone companies had an appropriate level of liability here (which should be a shit ton), this should be impossible. And it's not just about 2FA, most of humanity expects that if someone else texts them, those texts will go to their phone and only their phone unless they've given explicit verifiable consent. I mean, in this case all the hacker…
This would also be impossible if services stopped demanding your phone number to make an account. This is a growing trend in consumer services, and it's a privacy nightmare. Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days. There are widespread reports of delivery businesses selling their phone number databases (with ass…
> Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days.
The goal is for the service to have a unique identifier, and phone numbers happen to be a really good one to prevent spam also since it outsources verification of human entity to the phone companies.
Re: A hacker got all my texts for $16
#63Earlier quoted context omitted.
The whole 2 factor thing really falls down if sms is a part and you aren’t getting the messages. I had a miserable time trying to get into Backblaze recently, with even the ability it offered to switch sms providers failing. The list of valid keys they give you on setup bailed me out eventually, but it took me a while to remember them.
> remember them Uh. You're supposed to memorise them? I printed them out and stuck them in a safe place.
Maybe “remember that they exist”? I can’t imagine remembering those.
Re: A hacker got all my texts for $16
#64Too many services use phone numbers as the keys to the kingdom. It's a convenient and stable identifier, but holy shit it's not designed for security at all .
Agreed. Users have it in their power not to use services that require a phone number for SMS verifcation.
Re: A hacker got all my texts for $16
#65Too many services use phone numbers as the keys to the kingdom. It's a convenient and stable identifier, but holy shit it's not designed for security at all .
It's neither convenient nor stable for anyone moving between countries either. When given the choice between a service that uses my phone number as my permanent user identifier and one that uses my email, I'll always go for the latter. Unfortunately, big parts of the industry seem to be headed the other direction.
I just transferred my phone number to google voice when I moved out of the country. When I moved it back I simply transfer it back to my carrier
Re: A hacker got all my texts for $16
#66In Australia it's mandated you're sent a message before rerouting or migrating to another provider. Surprised this isn't enforced in the other countries, it costs next to nothing to implement and is just an additional step in the account migration process. I'd love to see companies allow for opt in additional security measures, like banks or telco's calling me - having a verbal password to confirm things, that level…
I think this particular issue is specific to North America, due to peculiarities of the NANP phone number scheme (inter-provider texts are routed quite differently from voice calls, if I understand it correctly).
In other countries, the two channels are more closely coupled (but SIM swap and/or number porting attacks are still possible, depending on the provider‘s security protocols).
Re: A hacker got all my texts for $16
#67Voip.ms, vonage/twilio, et al let you set up an SMS capable number really quickly and cheaply, available globally... And you'd be fully in control
I tried to set up a Twilio number specifically to handle these services that demand SMS for login. Weirdly it only works for a minority of services, I expect many use Twilio to send their auth texts and Twilio blocks sending these to their own numbers?
The reason most services require a phone number is so you can't just create a new account if you get banned and ideally your account is somewhat tied to a real person. They ban VOIP numbers because it would defeat the whole point.
Re: A hacker got all my texts for $16
#68Earlier quoted context omitted.
This would also be impossible if services stopped demanding your phone number to make an account. This is a growing trend in consumer services, and it's a privacy nightmare. Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days. There are widespread reports of delivery businesses selling their phone number databases (with ass…
> Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days. The goal is for the service to have a unique identifier, and phone numbers happen to be a really good one to prevent spam also since it outsources verification of human entity to the phone companies.
You’re not wrong. The problem is the lack of an authoritative identity provider in the US.
Re: A hacker got all my texts for $16
#69Earlier quoted context omitted.
Does anyone know why services like Google Authenticator were ditched industry wide in favor of SMS codes? It has never made any sense to me. Feels like the industry needs to push for a dedicated, universal, probably physical, tool for 2FA.
They have it, it’s called FIDO2, and it even works with existing devices such as Touch ID or Windows Hello in common browsers such as Chrome. Even Google doesn’t promote Google Authenticator now, but they keep it around for legacy reasons because it still works, until you lose your phone. That’s where FIDO2 shines: just authenticate more than one device, including purchased hardware tokens if you want something cheap…
can FIDO2 be implemented for day-to-day use right now, such as email access? sms 2FA and authenticator are built-in to most applications, so it makes it easy to use.
and how do you do estate planning? I'd like to give my family access to all of my private keys for everything when I pass.
Re: A hacker got all my texts for $16
#70Earlier quoted context omitted.
This would also be impossible if services stopped demanding your phone number to make an account. This is a growing trend in consumer services, and it's a privacy nightmare. Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days. There are widespread reports of delivery businesses selling their phone number databases (with ass…
> Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days. The goal is for the service to have a unique identifier, and phone numbers happen to be a really good one to prevent spam also since it outsources verification of human entity to the phone companies.
> since it outsources verification of human entity to the phone companies.
That's not the reason phone numbers are used. They are used, because they are something you have in addition to something you know like an SSN or password. This is two factor authentication.