Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

61–70 of 323 posts

Re: Second factor SMS: Worse than its reputation

#61

Post by bux93 »

rlpb wrote: post #45
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. My understanding of EU regulation is that it effectively requires this by requiring the 2FA to validate not just the identity but also the transaction (such as an amount, or d…

Yes, the Payment Services Directive requires "dynamic linking" to a specific amount and a specific payee in article 97, and the RTS in article 5 go on to say that the payer should be "made aware of the amount of the payment transaction and of the payee".

The most elegant implementation I saw of this were card readers with a 2D (colored) barcode scan ; the 2D barcode contained transaction details that the card reader would display on its screen. This was an effective control against MITM. But even I myself always misplaced the card reader.

So now, most confirmations are done using the banking app. Even if I use a credit card by filling in its details on a US website, I get a push notification on my phone to confirm the tx on my app.

The app asks for a password or uses biometrics, so thats 1FA, and the app is enrolled at some point, so the token on your phone (I presume in some secure storage) counts as the 'thing you have' for 2FA.

Enrolling the app nowadays usually entails scanning your ID card and a 'live selfie' (blink your eyes). And of course you get notified (via e-mail) that you just installed the app on some device.

Re: Second factor SMS: Worse than its reputation

#62

Post by throwaway290 »

hiatus wrote: post #56
jdiez17 wrote: post #39

Earlier quoted context omitted.

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

> Hot take: rooted phones are inherently less secure. My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?

> What threat

The threat to majority. Very very few people own a computer than a phone. And those people are much more tech savvy.

Re: Second factor SMS: Worse than its reputation

#63

Post by amluto »

0xbadcafebee wrote: post #52

I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's…

> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor.

A password manager is, in essentially every respect except interoperability, inferior to WebAuthn. Let’s not make an inferior solution mandatory when we already have a superior solution.

Re: Second factor SMS: Worse than its reputation

#65

Post by hbn »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> an attacker who paid for Google Ads for a search term like "BANKNAME login"

I tried out buy Google ads once out of curiosity cause they gave me a free credit. It was crazy how many ridiculous stipulations and guidelines I had to work around before they'd accept my ad.

How are they that strict for me, but seemingly they'll sell to a phishing page that's impersonating a bank and targeting it to people searching for that bank?

Re: Second factor SMS: Worse than its reputation

#66

Post by elric »

bckr wrote: post #43
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank

This might not be sufficient anymore. Many online payments are rendered either on the shop's pages or on a third party payment provider, including 3DSecure implementations. These don't redirect to any sensible bank URLs.

Both of my banks use a payment flow which uses a hardware authenticator. But only one bank seems secure: it prompts for an amount and a reference and generates an OTP based on that. This is distinct from any other signing operations with the same authenticator. The other bank tells me to enter a 6 digit number (which is allegedly made up out of a part of the amount and a reference), but it is impossible to tell this apart from any other signing operation. It doesn't strike me as too hard to abuse that to either log in to my account, to sign another payment, or even to create a direct debit...

Re: Second factor SMS: Worse than its reputation

#67

Post by Ozzie_osman »

hbn wrote: post #65
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> an attacker who paid for Google Ads for a search term like "BANKNAME login" I tried out buy Google ads once out of curiosity cause they gave me a free credit. It was crazy how many ridiculous stipulations and guidelines I had to work around before they'd accept my ad. How are they that strict for me, but seemingly they'll sell to a phishing page that's impersonating a bank and targeting it to people searching for t…

Because the impersonator is probably a lot more sophisticated at this than you or I, and it's likely that 999 impersonators were rejected and this is just the 1/1000 who found a way around it.

The system probably produces a lot of false positives AND negatives.

Re: Second factor SMS: Worse than its reputation

#68

Post by 2Gkashmiri »

dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

How did entering login and 2fa do the following things.

1. Login

2. Add payee

3. Create transaction

4. Verify transaction

This appears to be a banking issue where they do not try to maximize the attack surface.

Sure people will try to game the system by doing phishing but its the responsibility of banks to actively make it harder

Re: Second factor SMS: Worse than its reputation

#70

Post by rafram »

elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!
Post reply on HN