Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second factor SMS: Worse than its reputation

ccc.de

Post reply on HN
Print view View original

91–100 of 323 posts

Re: Second factor SMS: Worse than its reputation

#91

Post by jampekka »

hedora wrote: post #54
jdiez17 wrote: post #39

Earlier quoted context omitted.

Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.

"Less secure" depends on your threat model. I'm much less worried a hypothetical attack where I accidentally give sudo access to a malicious app than I am about the well-established ongoing attacks where Google violates the entire population's privacy, or the regular stream of malware that makes it into the official app store.

Not that long ago it was considered a problem to have a rootkit on your machine [1]. Nowadays it's getting hard to acquire a device that hasn't been rootkitted at the factory.

[1] https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo...

Re: Second factor SMS: Worse than its reputation

#92

Post by JohnMakin »

LorenDB wrote: post #64

I think we should just ban companies from implementing SMS 2FA. https://lorendb.dev/posts/lets-ban-sms-2fa/

This causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.

Re: Second factor SMS: Worse than its reputation

#93

Post by account42 »

ossobuco wrote: post #14
throw0101d wrote: post #9

If the choice between no 2FA and SMS, which is better?

As the linked post says itself, "2FA-SMS is Better Than Nothing"

That really depends what else the company uses your number for now that you have given it to them for 2FA. Often enough it ends up being usable as a one factor for account "recovery".

Re: Second factor SMS: Worse than its reputation

#94

Post by JohnMakin »

ajross wrote: post #36
ossobuco wrote: post #14

Earlier quoted context omitted.

As the linked post says itself, "2FA-SMS is Better Than Nothing"

The linked article says that at the very end, in the very last sentence , just so they can evade this kind of discussion. Clearly the takeaway any regular user (also the typical too-pedantic-for-their-own-good HN commenter) is going to take away is clearly "Don't use SMS 2FA", and they will therefore make the wrong decision . Use 2FA. Use 2FA. Use 2FA. Worry about the design decisions in your spare time.

Exactly this. The concerns about SIM swapping are real but simply do not apply in 99.999999% of cases. It's an extremely targeted attack. Adoption rates of SMS are higher than other more secure methods like authenticator apps, and given the choice of no 2FA and 2FA SMS, you obviously should pick the latter and understand it isn't bulletproof. I find it difficult to come up with any argument otherwise.

I think there is this false idea that if SMS was not an option, people would gravitate to authenticators and other such solutions. I've provided technical support trying to get supposedly technical people to use these tools, and trust me, there are huge hurdles of adoption here. The amount of people that are unable to enter 6 digits into a prompt within 15 seconds is astounding.

Passwordless solutions are cool, and I have implemented them, but are extremely prone to footguns.

Re: Second factor SMS: Worse than its reputation

#95

Post by aftbit »

hbn wrote: post #65
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

> an attacker who paid for Google Ads for a search term like "BANKNAME login" I tried out buy Google ads once out of curiosity cause they gave me a free credit. It was crazy how many ridiculous stipulations and guidelines I had to work around before they'd accept my ad. How are they that strict for me, but seemingly they'll sell to a phishing page that's impersonating a bank and targeting it to people searching for t…

I once tried to buy a domain which contained the word "Google" from Namecheap, but I was rejected with an error telling me that I needed to contact support and show that my use of the trademark was approved by Google. So instead I went to Google Domains and bought it from them with no issues.

Re: Second factor SMS: Worse than its reputation

#96

Post by UncleMeat »

throw0101d wrote: post #9

If the choice between no 2FA and SMS, which is better?

Two perspectives: the business and the user.

For a sophisticated user who can confidently use distinct and strong passwords for each service and protect those passwords, SMS-based 2FA offers minimal safety improvement.

For a business, they know that a significant number of their users don't do this. These users are exposed to credential stuffing attacks. SMS-based 2FA means you need to phish somebody (or otherwise obtain the code). That's an improvement for these users.

The only time where there is an active reduction in security is when SMS can be used as single factor. This is frustratingly common for password reset flows, which allows a sim-swap attack to fully compromise an account.

Re: Second factor SMS: Worse than its reputation

#97

Post by aftbit »

kardianos wrote: post #48
dools wrote: post #42

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…

We have it: FIDO U2F. you could even treat it like the new password less manager, with a computer/phone specific store. My gut? It actually works, and people didn't like that. Users and orgs like authentication slightly broken so they can work around systems.

I like FIDO U2F as a second factor, although you always need a fallback of some kind in case you are stuck using a device without a USB port. I don't like it as a single factor, as most devices make it hard or impossible to back up your keys. Using Passkeys with Bitwarden is pretty interesting though, and appears to satisfy most of my concerns, as they're just stored in my password manager and move devices with me.

Re: Second factor SMS: Worse than its reputation

#98

Post by captrb »

TonyTrapp wrote: post #27
averageRoyalty wrote: post #18

Hardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.

It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.

What if my OTP base data is exported to a publically-readable datastore? I could be tricked into exporting the QR codes from Google Authenticator, for example. Though I see that there are significantly better 2FA methods, it does seem like the biggest flaws with SMS 2FA are in the insecure implementations, not the actual concept.

Re: Second factor SMS: Worse than its reputation

#99

Post by aftbit »

elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

They often want your phone number for anti-fraud or anti-sybil reasons. If they have free accounts, requiring a phone number helps prevent you from creating a new account to evade a ban and makes it easier to link bad behavior across accounts.

Re: Second factor SMS: Worse than its reputation

#100

Post by aftbit »

Rygian wrote: post #86
elric wrote: post #69

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.

I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice.

Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.

Post reply on HN