Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#61

Post by LinuxBender »

j45 wrote: post #31
jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

SMS will remain vulnerable as long as the mobile accounts that hold them upstream remain vulnerable. One option I’ve heard might be different is to not your your mobile sms on accounts, but to get a voip based sms number. It might leave things at the mercy of a different system but the footprint might be different.

I've tried this, but many companies block VoIP numbers for MFA/2FA. Some don't. This works with LinkedIn, but not any companies I have purchased things from.

Re: Tell HN: SMS-based two-factor authentication is not secure

#62

Post by staticassertion »

Wowfunhappy wrote: post #47
staticassertion wrote: post #37

Earlier quoted context omitted.

> The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP. I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else. Every piece of information the attacker can get is valuable for forging auth. What SMS is good at is being available. At this point cell phones are…

> I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else. So it's better to not consider that information at all? What is better? (1) Requiring a password to login or (2) Requiring a password and a code sent via SMS? The problem you're describing is that services accept SMS in leu of other forms of verification, such…

> So it's better to not consider that information at all?

Exactly

> What is better? (1) Requiring a password to login or (2) Requiring a password and a code sent via SMS?

They're equivalent in my mind - SMS is such a weak 2FA mechanism, and it's so easy to get wrong and have it decrease your overall security, any benefit is lost. Rather than pushing SMS because it's what we have we should make greater efforts to leverage technology that we know is considerably better in every regard except availability today - IMO that is the problem to solve.

Re: Tell HN: SMS-based two-factor authentication is not secure

#63

Post by michael_vo »

bszupnick wrote: post #10

Not only is it not secure, it's not a constant for everyone. I moved countries and I am now locked out of my bank account abroad since they verify logins via OTP over SMS.

For some countries (USA) you can forward your number to a google voice number and retain incoming sms. Call forwarding isn't possible to my knowledge.

Re: Tell HN: SMS-based two-factor authentication is not secure

#64

Post by 1cvmask »

1cvmask wrote: post #59
jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

The option for a delay of is great. The option of adding a custom security question/password etc. is even better. The option of completely turning off recovery is also great. The ability to have your solution on multiple devices without a need for a mobile phone number based recovery is great as well. I hate it that Twitter forces you to enter a mobile phone number even when you set up an authenticator code generator…

More details of customizable recovery and backup and restore is available here with visuals:

https://blog.saaspass.com/saaspass-password-manager-authenti...

Re: Tell HN: SMS-based two-factor authentication is not secure

#65

Post by staticassertion »

Wowfunhappy wrote: post #58
staticassertion wrote: post #41

Earlier quoted context omitted.

> Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability. So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.

A phone's TPM is the only U2F token that 99% of the world owns, assuming they own one at all.

Yes, as I've said, availability is the problem to solve. We should be shipping U2F tokens wherever we can. I'd like to see schools that require students to use GSuite and other U2F supporting sites giving students tokens for free. I'd like to see banks giving their customers tokens. I'd like to see companies giving them to employees.

IMO the problem is not "let's get some kind of 2FA" it's "let's get U2F in the hands of as many people as we can".

Re: Tell HN: SMS-based two-factor authentication is not secure

#66

Post by grishka »

grlass wrote: post #24
Zolt wrote: post #7

Earlier quoted context omitted.

I had to remove this detail from my original post as it was too long: Boost mobile is negligent and not following industry standards. Their whole security model is based on a 4-digit pin. At first I thought somebody had a script working its way up through all the combinations at the login screen, but I no longer feel that is the case. The fact that at least nine of us had this same issue within days makes me think th…

I don't have a source to hand, but I've heard from other post-mortems that in SIM-jacking attack the carrier has been socially engineered into not bothering with the pin, ongoing court cases RE negligence perhaps on-going.

If they're able to issue a new SIM card without the system requiring them to enter the PIN first, then it's a very terribly designed system.

Re: Tell HN: SMS-based two-factor authentication is not secure

#67

Post by TwoBit »

rocqua wrote: post #46
Zolt wrote: post #7

Earlier quoted context omitted.

I had to remove this detail from my original post as it was too long: Boost mobile is negligent and not following industry standards. Their whole security model is based on a 4-digit pin. At first I thought somebody had a script working its way up through all the combinations at the login screen, but I no longer feel that is the case. The fact that at least nine of us had this same issue within days makes me think th…

Does coinbase really allow account recovery with just an SMS? It seems to me like the attacker must have had more than just control over your SMS number.

Yeah the attacker now also has email control.

Re: Tell HN: SMS-based two-factor authentication is not secure

#68

Post by GhostVII »

chris_st wrote: post #13

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Unless they are requiring everyone to use 2FA, isn't that objectively worse than having the option of SMS 2FA? I'm sure there are a significant number of people who would just switch back to using a password instead of SMS 2FA rather than having to get a non-SMS second factor, since it is much less convenient than just putting in a phone number.

Re: Tell HN: SMS-based two-factor authentication is not secure

#69

Post by jsnell »

rocqua wrote: post #44
jsnell wrote: post #35

Earlier quoted context omitted.

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch. For most of the world, SMS is it. The Nordic countries have th…

> Some form of trust that can be bootstrapped again from scratch. This is not using it as a second factor. It is using it as the only factor. Having SMS as the only factor is not purely additive. As such it can (and obviously does) reduce security. Account recovery is hard, SMS is quite usable there, but way to insecure to be the only basis for bootstrapping account recovery.

I don't really understand why you think I'm advocating for SMS as the only factor, when I very clearly wrote the exact opposite.

Let's say that you remember your password, but your house just burned down. You cannot replace the U2F keys and backup codes that were lost in flames. But you almost certainly can bootstrap your real life identity far enough to get a replacement SIM.

Which, in combination with your password, should be enough to get your digital identity back.

Re: Tell HN: SMS-based two-factor authentication is not secure

#70

Post by artificialLimbs »

bszupnick wrote: post #10

Not only is it not secure, it's not a constant for everyone. I moved countries and I am now locked out of my bank account abroad since they verify logins via OTP over SMS.

I've signed up with voip.ms, which provides me a pay as you go sms number for basically $0/mo. since I only use it for auth.
Post reply on HN