Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#91

Post by cortesoft »

rocqua wrote: post #40
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

Its generally not "second factor authentication" but 2-factor authentication. The idea is that you have 2 separate authentication factors. Preferably both with decent security. Besides, I don't believe coinbase does SMS only account recovery. So here SMS really did fail as a second factor. Since it seems attackers must have had a password and SMS. (I am not 100% on the coinbase account recovery process)

No, it sounds like coinbase used email recovery, but his email provider used SMS recovery.

So the hacker only needed to hijack his SMS.... with that, they gained access to his email, and then with that gained access to coinbase. No password required.

Re: Tell HN: SMS-based two-factor authentication is not secure

#92

Post by 2rsf »

cik wrote: post #73
jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

Exactly this. Here in Israel, SMS is used extensively as part of a multi-factor authentication system. I also require my National ID. To move my phone number (consent or not) between any phone companies requires an SMS, my National ID, and verification of my ID, and personal details in the government database. SMS by itself is not secure.

And still numbers are being hijacked even in Israel [1], and even in Sweden, where I live now, I swept my SIM without my ID being properly checked

[1] https://www.gov.il/he/departments/news/sim

Re: Tell HN: SMS-based two-factor authentication is not secure

#93

Post by 2rsf »

UncleMeat wrote: post #82
raesene9 wrote: post #8

Earlier quoted context omitted.

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the ac…

TOTP is phishable, which is a way way way more common attack than sim swaps.

phishable how? "your account has been hacked, please provide us a TOTP code"?

Re: Tell HN: SMS-based two-factor authentication is not secure

#94

Post by 2rsf »

ThePowerOfFuet wrote: post #23
bszupnick wrote: post #10

Not only is it not secure, it's not a constant for everyone. I moved countries and I am now locked out of my bank account abroad since they verify logins via OTP over SMS.

Why cancel your old phone number in that country when you still have a bank account there? I suggest a bank which doesn't suck, such as bunq.

if you immigrate, like I did, but still have some pension funds or saving accounts in your home country. Why would I want a local phone line?

Re: Tell HN: SMS-based two-factor authentication is not secure

#95

Post by cik »

2rsf wrote: post #92
cik wrote: post #73

Earlier quoted context omitted.

Exactly this. Here in Israel, SMS is used extensively as part of a multi-factor authentication system. I also require my National ID. To move my phone number (consent or not) between any phone companies requires an SMS, my National ID, and verification of my ID, and personal details in the government database. SMS by itself is not secure.

And still numbers are being hijacked even in Israel [1], and even in Sweden, where I live now, I swept my SIM without my ID being properly checked [1] https://www.gov.il/he/departments/news/sim

Absolutely. This is the problem - it's not the ideal method.

Re: Tell HN: SMS-based two-factor authentication is not secure

#96

Post by profsnuggles »

addingnumbers wrote: post #89
profsnuggles wrote: post #87

Earlier quoted context omitted.

If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.

You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.

Except you have no way of knowing if that will be the case ahead of time. Unless the first thing you do after enabling 2FA is to social engineer a password reset for your account? Even then that doesn't guarantee that there isn't a more clueless service rep that will make a mistake.

Asking before you sign up, "will you allow my account to be hacked through social engineering?" isn't going to an answer other than no. Even if the answer is possibly yes.

Re: Tell HN: SMS-based two-factor authentication is not secure

#97

Post by bun_at_work »

Wowfunhappy wrote: post #22
staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

What about an authentication app? Google Authenticator or something similar can be installed on the phone which is necessary for SMS, improves the security more than SMS, and doesn't suffer from the problem of losing it, at least not more than SMS auth does.

Re: Tell HN: SMS-based two-factor authentication is not secure

#98

Post by ysavir »

Zolt wrote: post #21
meowster wrote: post #9

I think crypto companies should block withdraws for a period of time after a password recovery. (OP, you are calculating your losses, but didn't specify what those losses were. Did the theif get your crypto?)

I have not regained access to my bitcoin account, in part because I have not contacted customer support to do so. I’ve been too busy regaining access and continuing to support my client base. My account is locked, and I am pretty sure my funds are still there. It will be a significant loss, but not devastating as this was my non-primary investment account. I still don’t know the full extent of my losses. So far, my l…

> I now understand why banks do not use email addresses as the login id. The thief would not (easily) be able to align my email address with my bank login id.

This is an important point and one I've been thinking about for years. There's so much discussion about using password managers and good password practices and 2fA but almost no discussion on how using a single identifier to log into all these various services is in itself a huge security vulnerability. If we had different login usernames for each service, gaining access to people's accounts would be that much more difficult.

Email should be reserved for communications and not double as a means for authentication.

Re: Tell HN: SMS-based two-factor authentication is not secure

#99

Post by toss1 »

artificialLimbs wrote: post #90
lazide wrote: post #78

Earlier quoted context omitted.

Many services go out of their way to detect and block the use of VoIP numbers for SMS auth :s

What's the reasoning behind that? Maybe to prevent bots?

I'd start with VOIP numbers being so easy to spoof... and move onto the entire telephone network being insanely insecure and unverified, despite decades of efforts to link people to telnos -- until they implement actual caller-recipient full verification, they've effectively got nothing.

Re: Tell HN: SMS-based two-factor authentication is not secure

#100

Post by geephroh »

esolyt wrote: post #86
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I'm glad someone is bringing this up. I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

Services like Authy address some of the loss of device issue, and always a good idea to have a backup token (e.g., yubikey) physically escrowed somewhere like a safe-deposit box.

But it is a whole lot of extra work to set up and maintain long-term, even with the best intentions.

Post reply on HN