13 ms·

On Phone Numbers and Identity

301 points by cmurf 10y ago

cmurf 10y ago
"That other little thing the attacker did? He started a port of the phone number from Verizon to a VOIP provider, and that port had completed overnight." One take away is how SMS as 2FA depends on a flawed assumption. The other I found cute is using random strings as answers to the stupid account recovery questions companies continue to ask. Things not mentioned in the blog is exactly what personal information the attacker had, that authenticated him to Verizon. PIN? Some portion of his SSN? It must not have been account recovery questions because the target of the attack used random strings as answers.
- JoshGlazebrook 10y ago
  Verizon definitely does ask for account pin whenever I call in, usually entered via number keypad before you're routed to an actual person.
  - josu 10y ago
    Apparently, the PIN is opt-in. >With Verizon on the phone, it was a fairly simple matter to re-reset the portal password, set an account PIN to prevent attacker re-entry and un-do the phone forward.
  - nbadg 10y ago
    Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit. [1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m... [2] https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg [3] https://youtu.be/bjYhmX_OUQQ?t=98 https://youtu.be/bjYhmX_OUQQ?t=98
    - x0x0 10y ago
      Holy crap, watch video #3 it's worth it. She adds herself to the account by calling and asking.
      - JoshGlazebrook 10y ago
        Wow that really was crazy easy for her to do that. I guess it also taps into emotions with the crying baby as well.
  - initram 10y ago
    I have many accounts that require a PIN. Many of them I set up years ago and have no idea what the PIN would be. I'm always able to talk my way out of it, though. (And this is not something I practice or know how to do well. I literally just say something like, "PIN? I have no idea. I don't even remember having the option to set one.")
  - stanleydrew 10y ago
    The problem is that the default PIN (which is what 99% of customers still have probably) is just the last four digits of the primary account holder's SSN.
- nbadg 10y ago
  > One take away is how SMS as 2FA depends on a flawed assumption. NIST (among many others) has recommended you stop using SMS for MFA: https://threatpost.com/nist-recommends-sms-two-factor-authentication-deprecation/119507/ https://threatpost.com/nist-recommends-sms-two-factor-authen...
- eridius 10y ago
  Some time ago I started doing the random strings too. I use 1Password for everything, so I just add the questions as free-form fields to 1Password, set up password fields for the answers, and have 1Password generate (pronounceable) passwords to use as the answers.
  - dapearce 10y ago
    Will 1Password detect and autofill these or do you have to look it up?
    - eridius 10y ago
      I have to look it up. There's no way 1Password would be able to detect this. But I can look it up via the 1Password Mini window (the same thing you use to fill the password in the same place) so it's no trouble.
  - tajen 10y ago
    ...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the other questions were, but she seemed satisfied with such an answer (and granted me access).
    - mpolichette 10y ago
      Did this really happen? I mean, you know what they say about the weakest link...
    - mikeash 10y ago
      In my case, I forgot I had a randomly generated answer, gave them the real answer, and the representative got very confused when he tried to compare that to what he had in the system.
    - eridius 10y ago
      Is this a hypothetical or something that actually happened? Because if it's the latter then the rep that you talked to needs to be retrained, because that's equivalent to saying "oh it's some street in San Francisco" when asked what street you grew up on. In any case, I have 1Password generate pronounceable passwords specifically to avoid the problem of the rep trying to compare random alphanumeric strings. 1Password can even generate random phrases of N words (e.g. xkcd passwords) which works well for this sort of thing because it's easy to say those over a phone.
- arielb1 10y ago
  2FA is supposed to be 2-factor authentication: a password and a phone number. If you allow the phone number to reset the password, it becomes 1-factor authentication.
jstanley 10y ago
It sounds like Coinbase's security is on point which is good to know, in an industry where security flaws are disastrous: characterised most prominently by the MtGox hack, and more recently Bitfinex's. I've long maintained that a phone number is not an identity, and (shameless plug) this month released a service allowing anyone to acquire phone numbers anonymously, with Bitcoin: https://smsprivacy.org/ https://smsprivacy.org/
- ikeboy 10y ago
  >I've long maintained that a phone number is not an identity, and (shameless plug) this month released a service allowing anyone to acquire phone numbers anonymously, with Bitcoin: https://smsprivacy.org/ https://smsprivacy.org/ This is pretty cool (and I think I've mentioned the need for it previously on HN). Is there any current solution for phone calls (over Tor or something) without giving up identity?
  - jstanley 10y ago
    https://dtmf.io/ https://dtmf.io/ These guys operate in roughly the same space, and they provide phone calls. My service provides voicemail, but currently not phone calls!
    - ikeboy 10y ago
      >Can I connect using Tor? Yes, but voice will not work as Tor does not support UDP. We are looking at ways to work around this.
      - jstanley 10y ago
        My mistake! I don't know the answer then.
        ikeboy 10y ago
        I guess someone could sign up for Google voice using your SMS and then only use it over tor. Don't know how good the quality would be then. https://support.google.com/a/answer/1279090?hl=en https://support.google.com/a/answer/1279090?hl=en implies it doesn't need UDP.
cowholio4 10y ago
It's always great to see effective incidence response and proactive employees. Congrats Coinbase and thank you for sharing. Your experience will make the rest of us more aware. Two months ago the NIST announced that SMS for out of band authentication was deprecated. It makes sense. Phone numbers have a much bigger attack vector compared to Yubikey and Google Authenticator. This incident is a perfect example. https://techcrunch.com/2016/07/25/nist-declares-the-age-of-sms-based-2-factor-authentication-over/ https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s... https://news.ycombinator.com/item?id=12163046 https://news.ycombinator.com/item?id=12163046
josu 10y ago
I just went to see what my recovery options are for my phone provider's portal. It creates a temporary password that it's sent to your phone through SMS so you can access your account. This makes sense, since the only way to gain access to your account is either cracking your password or controlling your phone. I have no idea why Verizon would give access to the account through a voice call, instead of sending an SMS to your phone number. I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. If you were to find yourself in that situation, Verizon's position should be: OK, first sort out the phone thing, this is, go to a store and get a new SIM card and/or phone, and then we'll reset your account.
- zeveb 10y ago
  > I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. 'I just lost my phone, and I haven't logged into the portal in years. All my passwords were on my phone. I'm out of the country/in the sticks and there is no Verizon store nearby.' Yes, Verizon's response ought to probably be something like, 'go to a Verizon store where an employee will verify your identity,' but that of course means trusting many more than just call-centre employees to verify identity; it also means that a government identity-card issuer would still be able to covertly reset one's number.
  - josu 10y ago
    > it also means that a government identity-card issuer would still be able to covertly reset one's number. Sure, but that seems like a much greater crime than just impersonating somebody on a phone call, plus greater exposure and chances of getting caught. > and I haven't logged into the portal in years. My point is exactly that, in which situation would you need to urgently access your portal?
    - zeveb 10y ago
      > My point is exactly that, in which situation would you need to urgently access your portal? The lost-phone situation: the number-owner has lost his phone, has bought a new one and wishes to change service immediately. It's not at all unlikely, and is likely to be perceived as urgent (I certainly wouldn't want all my account access messages going to a lost phone …).
zeveb 10y ago
In a way, this seems like an at-speed version of the Social Security Number's slow-motion train wreck: just as SSNs are not secret (and in many cases are actually pretty easily guessable), so too possession of a phone number is too-easily changed. We need a good solution to identity. Right now most web services use 'has control of an email account,' while some others — to include email services — use 'has control of a phone number.' I don't trust governments in general, so 'is vouched for by a state' doesn't really work either, although for many institutions (e.g. banks) that's probably good enough (if a government wishes to confiscate one's funds, it will do that, rather than create a fake driver's license and hand it to someone to clean one's accounts out). Perhaps some sort of social identity is possible? 'Charles is vouched for by Alice, Bob, Dave and Frank' might work, although there's the issue that someone has to vouch for each of Alice, Bob, Dave and Frank — there's a Sybil attack where someone, or a group of real people operating together, could create false identities. For my own accounts though, if I nominate two persons I work with, four persons I go to church with, four more in my family and three friends then I'd feel pretty good if nine of those were allowed to vouch for my email. I think.
- nbadg 10y ago
  > We need a good solution to identity We have one: public keys (or more appropriately, their fingerprints). Building social trust on top of that is another layer of scope; you use the fingerprint to ensure you're communicating with a consistent digital entity, and then have an out-of-band way of confirming (for yourself) that this consistent digital entity is equivalent to this other consistent physical entity. Note that here I'm treating a web of trust as an out of band exchange: it only works because you have an existing (out of band) connection to someone, or because you are implicitly trusting consensus. "Bootstrapping" trust, at least in this context, is a psychological/social question that really cannot be answered technologically, and is different for every person. That's all well and good, but the problem is finding a business-sustainable way to scalably deploy such a system.
  - ThatGeoGuy 10y ago
    > That's all well and good, but the problem is finding a business-sustainable way to scalably deploy such a system. Is this effectively not how keybase.io works / what they are doing? Bootstrapping identity is pretty easy, unless you're working remotely. Even then, trust-on-first-use can probably go marginally farther than what we have now. I don't think the problem is scaling that web of trust, as not everyone should need to know / sign for every employee immediately. I think the bigger issue is just getting people to adopt public keys and digital identities based on them. Hijacking identity through social engineering is pretty rare, even if it's not particularly "hard." So most people won't want to bother with something like this until it's too late.
ikeboy 10y ago
I use Google Voice as my main number, and the google account that it's set up under has 2FA with my "real" number with ringplus. How vulnerable am I?
- wyldfire 10y ago
  Aside: do you see enormous latency on calls w/RP?
  - ikeboy 10y ago
    Not really, no. I recently switched to a MAD plan which routs it over sprint directly, but even before calls were ok.
127001brewer 10y ago
... Just as we should no longer trust SMS for two-factor authentication, we shouldn’t trust it for account recovery. Disable this anywhere you can. This is interesting, but, instead of SMS, what should be used for 2FA?
- gruez 10y ago
  TOTP tokens?
  - meepmorp 10y ago
    Presumably, TOTP tokens not delivered via SMS
  - nileshtrivedi 10y ago
    DigitalOcean does this, but then they fall back on SMS in case you uninstall the TOTP app.
    - bckygldstn 10y ago
      This is unfortunately quite common. Facebook won't even let you use TOTP unless you have a validated phone number to use as a fallback.
      - Declanomous 10y ago
        Furthermore, you have to install their entire app to use TOTP. Their app includes everything but the kitchen sink, and murders phone batteries even when in the background. On top of this, I don't see a point in installing apps if the functionality is also provided by their website. If I'm using my phone for 2FA, I'd like my phone to be secure, and I trust the security of my phone with just Chrome on it more than I trust my phone with Chrome and a million other apps.
      - avh02 10y ago
        this is the comment I was looking for. not only do they do this (which is not a good excuse), they also BEG you to put in your phone number every other day. I've seen websites (I believe it was netflix) which ask for your phone number in order to provide you a way to reset your password... what happened to good old email resets?
devy 10y ago
Unfortunately, in countries like China, your identity is your cellphone number. Almost all of the internet giants (QQ, WeChat, Weibo, Taobao, AliPay, Online Banking apps) predominantly use SMS to authenticate user login and/or as a 2FA step. As a result, identity thefts and telecommunications frauds are very common. Sad state of reality.
- AstralStorm 10y ago
  In fact, a more important step is to notify the customer immediately through all set channels of critical account changes. 1) Password changes 2) Adding a subuser 3) Weird login attempts Something like whatever Valve is doing in Steam.
- contingencies 10y ago
  identity thefts and telecommunications frauds are very common Not sure I agree, let's tackle those in order: first, QQ is like ICQ, it's almost dead and therefore irrelevant. On WeChat, phone number is simply used to look people up so you can find them. If you lose a phone or WeChat account, the social identity thing is used to recover it (you get a few friends to send a special magic number to you, then a reset is made). It doesn't trust your number. No idea about Weibo. Taobao does take your phone number but they have to because they need to be able to get in touch with suppliers when there are issues/complaints, and many customers want merchant phone numbers anyway. I don't see trust issues. You can log in with your phone but it's the pre-authenticated instance of your account on a mobile device that it cares about, not your phone number. AliPay, no idea. Online banking is not frequently used because until recently it totally sucked, and often was Windows only (yet macs are really popular), and people here like cash. I think the Chinese ID card number (largely guessable with a birthday and knowledge of where someone was born) is far more dangerous here than a phone number: https://en.wikipedia.org/wiki/Resident_Identity_Card#Identity_card_number https://en.wikipedia.org/wiki/Resident_Identity_Card#Identit... I feel like most financial fraud here is confidence and pyramid schemes.
kalleboo 10y ago
The best advice for SMS 2FA I've seen was what was given to YouTuber boogie2988 by his attacker after he was hacked the same way - use a separate prepaid phone number that you never make public.
- tener 10y ago
  It doesn't scale as you need to share the number across different services. To be completely decoupled you'd need to have 1 number per account all bundled into one sim card. I don't think this is something you can setup with current services and phone software.
  - snuxoll 10y ago
    I mean, you could do it with Flowroute or Twilio. I already pay $1.25/mo for a DID for my home from Flowroute, if I cared enough about security buying another isn't going to put a dent in my pocketbook and I could just have a small little flask app somewhere forward them to a prepaid phone.
  - x0x0 10y ago
    Or once a company gets hacked, since that will be unencrypted in the users table. eg the linkedin data dump.
- paulsutter 10y ago
  Be nice to have a special device with sole purpose sms/2fa, that's very small (easier to carry than a spare phone). A secret number of course, but also running on a service with no human operators who can intervene.
  - icebraining 10y ago
    A cheap featurephone is pretty small, and you can even run a J2ME TOTP client, besides SMS.
  - AstralStorm 10y ago
    Good banks issue true tokens or one time random code cards for exactly this purpose. A token is a device that generates a known set of pseudorandom numbers. These are relatively cheap - and many modern auth systems depend on the token being installed on a much less secure shared hardware, such as a phone. Still harder to crack than SMS.
raverbashing 10y ago
But if the employee had long passwords, was his fb account compromised through the use of password reset through SMS then?
- PwdRsch 10y ago
  Yes. They didn't need to know his strong password to log on, they just needed access to his mobile phone SMS in order to complete the account recovery process and change his account password to a value they chose.
carsonreinke 10y ago
I'm a little confused on why these other 2FA approaches are seen as more secure. Is it simply because the port transfer process can happen?
- URSpider94 10y ago
  The point of 2FA is that you combine something you have, and something you know. For the something you have to be a strong authentication factor, you have to maintain tight control over it. When you use SMS as the factor, you're effectively mailing the second factor to someone with a lot of intermediate steps in the chain of custody. When I use an authentication app on my phone (assuming that I destroyed the seed immediately after loading it), or I use my physical OTP token, then those keys are pretty direct proof that I have possession of that object at that time. If I lose my token, then I know I lost it and I can disable it and get a new one. As this thread demonstrates, it's possible for someone to hijack your phone without you realizing it for a period of hours to days.
  - bhandziuk 10y ago
    Pardon my ignorance but what's to stop them from impersonating your authentication app, too?
    - URSpider94 10y ago
      No need to apologize. With an authentication app, you seed it with a key which only you and the service use. Each successive PIN is generated by doing a complex mathematical operation on the initial key, and then dropping most of the digits, so it's basically impossible to infer the key by seeing even dozens or hundreds of the responses. Typically, the key is only good for a minute or so, and/or is only good for one login attempt. As long as nobody else has that key, it's virtually impossible for anyone to figure out what the next token your authentication app will offer up. The data only exists inside the app, and a copy lives on the host that authenticates your login. For someone to impersonate your authentication app, they would have to: a. Gain access to your phone and somehow extract the key, which probably means getting past the phone's native encryption as well as the authentication app's encryption. You do have a passphrase on your phone, right? b. Find a leftover copy of the key. Don't leave one of these lying around for someone to find ... c. Hack the authentication software used on the server side. If hackers can do this, then it's pretty much game over anyway. So, basically, if you never give someone your unlocked phone (in a context where they could take a memory dump, not just casually so they can type in their number), and you don't leave copies of the key lying around, it will be very hard for someone to spoof your authenticator app. OK, I left one attack out -- someone could man-in-the-middle you and get you to give your password and the latest key to them, which they then use to log in. That's why you should only operate over a secure channel (HTTPS or equivalent) where you are sure you're talking with a known endpoint (manually enter the URL, or at least check it in the address bar).
ejdyksen 10y ago
> We also put out some company wide guidance on cellphone account security. Are there published best-practices somewhere on a per-provider basis?
Hydraulix989 10y ago
I was really impressed that a Korean friend had an overseas bank card with an e-ink display on it for displaying TFA codes, just like Authy/Authenticator.
divbit 10y ago
I've raised the issue with Coinbase support before, and I don't know if it's fixed (this was probably last year sometime), but when I used to use Coinbase heavily, it was actually impossible to turn off sms 2fa. Even now, I have totp codes, but still get an sms with a code whenever I try to login to their service. This was a real issue for me and an actual real reason that I stopped using their service for most of last year, as I use google voice / skype for my number, it's not really two factor. I mentioned this issue in an e-mail chain with their support ( and their response was basically that I should use authy instead of totp (Google-authenticator), or some weird workaround involving installing authy / uninstalling authy in a certain sequence which didn't work for me. However- we see here in this post, that all the attacker had to do to compromise the Authy was to compromise the phone number! (I also raised this issue with their support.) Their response to the Authy question was that since Authy / e-mail are running on two different servers, it's considered 2-factor by them... hrm..
otto_ortega 10y ago
Do you know where can I learn about designing a U2F key? Or any other similar token? And I mean from the programming perpesctive not the harware per-se, like some sort of open source firmware for this.
homero 10y ago
That's why authy is a joke
- joshstrange 10y ago
  How is authy a joke? I have to enter my backup password even after I auth with my phone number on a new phone (same number).
  - twr 10y ago
    Authy's developer FAQ implies that ownership of the original phone number is sufficient to restore API-created tokens (e.g., Coinbase). > What happens when a person loses their phone? > Authy automatically synchronizes all accounts. If a user loses his phone when he buys a new one he'll be able to access back all of his account's by registering the app using the same phone number he previously had. https://docs.authy.com/developer_faq.html https://docs.authy.com/developer_faq.html
    - homero 10y ago
      Yeah I really hate that CloudFlare doesn't support other otp at all
    - twr 10y ago
      So I spent some time playing with the Authy app. Here's the drop: 1) Dave has an active Authy account. 2) Dave configures 2FA for Coinbase using Authy. 3) Coinbase, rather than asking Dave to manually enter a TOTP secret, registers a 2FA token on Dave's Authy account via the Authy TOTP API. 4) Mallory takes over Dave's phone number. 5) Mallory resets Dave's Authy account at https://www.authy.com/phones/reset https://www.authy.com/phones/reset. 6) Mallory gains access to Dave's email account (using SMS recovery?). 7) Mallory confirms the Authy reset email. 8) Mallory logs into Authy using Dave's stolen phone number. 9) Mallory now has access to all of Dave's Authy API tokens (Coinbase, CloudFlare, etc). 10) Mallory can try guessing the backup password for Dave's other non-API tokens. Assuming Authy transmits the entire encrypted blob (I'm guessing it does), offline brute-forcing is possible. tl;dr: Don't use Authy for services using the Authy API.
camkego 10y ago
Would anyone care to comment on which cellphone providers allow the highest security? The article recommended the following: "Call your cell phone provider and set up a PIN or password, ask for a port freeze and ask to lock your account to your current SIM." It seems maybe we need a website/git-repo along the lines of https://twofactorauth.org/ https://twofactorauth.org/, but explaining phone provider security supported by provider. Other than that there was a suggestion to have a special cellphone which is only used for SMS auth, and which you don't publish the number for.
peterhartree 10y ago
> Call your cell phone provider and set up a PIN or password, ask for a port freeze and ask to lock your account to your current SIM. Seriously — do this. I’ve twice had the experience of walking into the retail store of a major UK network, supplying my mobile number, name, date of birth and postcode, and walking out with a replacement SIM card activated for my current number. In both cases I subsequently complained loudly to the network management and received apologies and assurances that the retail staff were not following protocol, training procedures would be reviewed etc.

301 points by cmurf 10y ago

cmurf 10y ago

"That other little thing the attacker did? He started a port of the phone number from Verizon to a VOIP provider, and that port had completed overnight." One take away is how SMS as 2FA depends on a flawed assumption. The other I found cute is using random strings as answers to the stupid account recovery questions companies continue to ask. Things not mentioned in the blog is exactly what personal information the attacker had, that authenticated him to Verizon. PIN? Some portion of his SSN? It must not have been account recovery questions because the target of the attack used random strings as answers.

JoshGlazebrook 10y ago
Verizon definitely does ask for account pin whenever I call in, usually entered via number keypad before you're routed to an actual person.
- josu 10y ago
  Apparently, the PIN is opt-in. >With Verizon on the phone, it was a fairly simple matter to re-reset the portal password, set an account PIN to prevent attacker re-entry and un-do the phone forward.
- nbadg 10y ago
  Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit. [1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m... [2] https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg [3] https://youtu.be/bjYhmX_OUQQ?t=98 https://youtu.be/bjYhmX_OUQQ?t=98
  - x0x0 10y ago
    Holy crap, watch video #3 it's worth it. She adds herself to the account by calling and asking.
    - JoshGlazebrook 10y ago
      Wow that really was crazy easy for her to do that. I guess it also taps into emotions with the crying baby as well.
- initram 10y ago
  I have many accounts that require a PIN. Many of them I set up years ago and have no idea what the PIN would be. I'm always able to talk my way out of it, though. (And this is not something I practice or know how to do well. I literally just say something like, "PIN? I have no idea. I don't even remember having the option to set one.")
- stanleydrew 10y ago
  The problem is that the default PIN (which is what 99% of customers still have probably) is just the last four digits of the primary account holder's SSN.
nbadg 10y ago
> One take away is how SMS as 2FA depends on a flawed assumption. NIST (among many others) has recommended you stop using SMS for MFA: https://threatpost.com/nist-recommends-sms-two-factor-authentication-deprecation/119507/ https://threatpost.com/nist-recommends-sms-two-factor-authen...
eridius 10y ago
Some time ago I started doing the random strings too. I use 1Password for everything, so I just add the questions as free-form fields to 1Password, set up password fields for the answers, and have 1Password generate (pronounceable) passwords to use as the answers.
- dapearce 10y ago
  Will 1Password detect and autofill these or do you have to look it up?
  - eridius 10y ago
    I have to look it up. There's no way 1Password would be able to detect this. But I can look it up via the 1Password Mini window (the same thing you use to fill the password in the same place) so it's no trouble.
- tajen 10y ago
  ...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the other questions were, but she seemed satisfied with such an answer (and granted me access).
  - mpolichette 10y ago
    Did this really happen? I mean, you know what they say about the weakest link...
  - mikeash 10y ago
    In my case, I forgot I had a randomly generated answer, gave them the real answer, and the representative got very confused when he tried to compare that to what he had in the system.
  - eridius 10y ago
    Is this a hypothetical or something that actually happened? Because if it's the latter then the rep that you talked to needs to be retrained, because that's equivalent to saying "oh it's some street in San Francisco" when asked what street you grew up on. In any case, I have 1Password generate pronounceable passwords specifically to avoid the problem of the rep trying to compare random alphanumeric strings. 1Password can even generate random phrases of N words (e.g. xkcd passwords) which works well for this sort of thing because it's easy to say those over a phone.
arielb1 10y ago
2FA is supposed to be 2-factor authentication: a password and a phone number. If you allow the phone number to reset the password, it becomes 1-factor authentication.

jstanley 10y ago

It sounds like Coinbase's security is on point which is good to know, in an industry where security flaws are disastrous: characterised most prominently by the MtGox hack, and more recently Bitfinex's. I've long maintained that a phone number is not an identity, and (shameless plug) this month released a service allowing anyone to acquire phone numbers anonymously, with Bitcoin: https://smsprivacy.org/ https://smsprivacy.org/

ikeboy 10y ago
>I've long maintained that a phone number is not an identity, and (shameless plug) this month released a service allowing anyone to acquire phone numbers anonymously, with Bitcoin: https://smsprivacy.org/ https://smsprivacy.org/ This is pretty cool (and I think I've mentioned the need for it previously on HN). Is there any current solution for phone calls (over Tor or something) without giving up identity?
- jstanley 10y ago
  https://dtmf.io/ https://dtmf.io/ These guys operate in roughly the same space, and they provide phone calls. My service provides voicemail, but currently not phone calls!
  - ikeboy 10y ago
    >Can I connect using Tor? Yes, but voice will not work as Tor does not support UDP. We are looking at ways to work around this.
    - jstanley 10y ago
      My mistake! I don't know the answer then.
      - ikeboy 10y ago
        I guess someone could sign up for Google voice using your SMS and then only use it over tor. Don't know how good the quality would be then. https://support.google.com/a/answer/1279090?hl=en https://support.google.com/a/answer/1279090?hl=en implies it doesn't need UDP.

cowholio4 10y ago

It's always great to see effective incidence response and proactive employees. Congrats Coinbase and thank you for sharing. Your experience will make the rest of us more aware. Two months ago the NIST announced that SMS for out of band authentication was deprecated. It makes sense. Phone numbers have a much bigger attack vector compared to Yubikey and Google Authenticator. This incident is a perfect example. https://techcrunch.com/2016/07/25/nist-declares-the-age-of-sms-based-2-factor-authentication-over/ https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s... https://news.ycombinator.com/item?id=12163046 https://news.ycombinator.com/item?id=12163046

josu 10y ago

I just went to see what my recovery options are for my phone provider's portal. It creates a temporary password that it's sent to your phone through SMS so you can access your account. This makes sense, since the only way to gain access to your account is either cracking your password or controlling your phone. I have no idea why Verizon would give access to the account through a voice call, instead of sending an SMS to your phone number. I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. If you were to find yourself in that situation, Verizon's position should be: OK, first sort out the phone thing, this is, go to a store and get a new SIM card and/or phone, and then we'll reset your account.

zeveb 10y ago
> I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. 'I just lost my phone, and I haven't logged into the portal in years. All my passwords were on my phone. I'm out of the country/in the sticks and there is no Verizon store nearby.' Yes, Verizon's response ought to probably be something like, 'go to a Verizon store where an employee will verify your identity,' but that of course means trusting many more than just call-centre employees to verify identity; it also means that a government identity-card issuer would still be able to covertly reset one's number.
- josu 10y ago
  > it also means that a government identity-card issuer would still be able to covertly reset one's number. Sure, but that seems like a much greater crime than just impersonating somebody on a phone call, plus greater exposure and chances of getting caught. > and I haven't logged into the portal in years. My point is exactly that, in which situation would you need to urgently access your portal?
  - zeveb 10y ago
    > My point is exactly that, in which situation would you need to urgently access your portal? The lost-phone situation: the number-owner has lost his phone, has bought a new one and wishes to change service immediately. It's not at all unlikely, and is likely to be perceived as urgent (I certainly wouldn't want all my account access messages going to a lost phone …).

zeveb 10y ago

In a way, this seems like an at-speed version of the Social Security Number's slow-motion train wreck: just as SSNs are not secret (and in many cases are actually pretty easily guessable), so too possession of a phone number is too-easily changed. We need a good solution to identity. Right now most web services use 'has control of an email account,' while some others — to include email services — use 'has control of a phone number.' I don't trust governments in general, so 'is vouched for by a state' doesn't really work either, although for many institutions (e.g. banks) that's probably good enough (if a government wishes to confiscate one's funds, it will do that, rather than create a fake driver's license and hand it to someone to clean one's accounts out). Perhaps some sort of social identity is possible? 'Charles is vouched for by Alice, Bob, Dave and Frank' might work, although there's the issue that someone has to vouch for each of Alice, Bob, Dave and Frank — there's a Sybil attack where someone, or a group of real people operating together, could create false identities. For my own accounts though, if I nominate two persons I work with, four persons I go to church with, four more in my family and three friends then I'd feel pretty good if nine of those were allowed to vouch for my email. I think.

nbadg 10y ago
> We need a good solution to identity We have one: public keys (or more appropriately, their fingerprints). Building social trust on top of that is another layer of scope; you use the fingerprint to ensure you're communicating with a consistent digital entity, and then have an out-of-band way of confirming (for yourself) that this consistent digital entity is equivalent to this other consistent physical entity. Note that here I'm treating a web of trust as an out of band exchange: it only works because you have an existing (out of band) connection to someone, or because you are implicitly trusting consensus. "Bootstrapping" trust, at least in this context, is a psychological/social question that really cannot be answered technologically, and is different for every person. That's all well and good, but the problem is finding a business-sustainable way to scalably deploy such a system.
- ThatGeoGuy 10y ago
  > That's all well and good, but the problem is finding a business-sustainable way to scalably deploy such a system. Is this effectively not how keybase.io works / what they are doing? Bootstrapping identity is pretty easy, unless you're working remotely. Even then, trust-on-first-use can probably go marginally farther than what we have now. I don't think the problem is scaling that web of trust, as not everyone should need to know / sign for every employee immediately. I think the bigger issue is just getting people to adopt public keys and digital identities based on them. Hijacking identity through social engineering is pretty rare, even if it's not particularly "hard." So most people won't want to bother with something like this until it's too late.

ikeboy 10y ago

I use Google Voice as my main number, and the google account that it's set up under has 2FA with my "real" number with ringplus. How vulnerable am I?

wyldfire 10y ago
Aside: do you see enormous latency on calls w/RP?
- ikeboy 10y ago
  Not really, no. I recently switched to a MAD plan which routs it over sprint directly, but even before calls were ok.

127001brewer 10y ago

... Just as we should no longer trust SMS for two-factor authentication, we shouldn’t trust it for account recovery. Disable this anywhere you can. This is interesting, but, instead of SMS, what should be used for 2FA?

gruez 10y ago
TOTP tokens?
- meepmorp 10y ago
  Presumably, TOTP tokens not delivered via SMS
- nileshtrivedi 10y ago
  DigitalOcean does this, but then they fall back on SMS in case you uninstall the TOTP app.
  - bckygldstn 10y ago
    This is unfortunately quite common. Facebook won't even let you use TOTP unless you have a validated phone number to use as a fallback.
    - Declanomous 10y ago
      Furthermore, you have to install their entire app to use TOTP. Their app includes everything but the kitchen sink, and murders phone batteries even when in the background. On top of this, I don't see a point in installing apps if the functionality is also provided by their website. If I'm using my phone for 2FA, I'd like my phone to be secure, and I trust the security of my phone with just Chrome on it more than I trust my phone with Chrome and a million other apps.
    - avh02 10y ago
      this is the comment I was looking for. not only do they do this (which is not a good excuse), they also BEG you to put in your phone number every other day. I've seen websites (I believe it was netflix) which ask for your phone number in order to provide you a way to reset your password... what happened to good old email resets?

devy 10y ago

Unfortunately, in countries like China, your identity is your cellphone number. Almost all of the internet giants (QQ, WeChat, Weibo, Taobao, AliPay, Online Banking apps) predominantly use SMS to authenticate user login and/or as a 2FA step. As a result, identity thefts and telecommunications frauds are very common. Sad state of reality.

AstralStorm 10y ago
In fact, a more important step is to notify the customer immediately through all set channels of critical account changes. 1) Password changes 2) Adding a subuser 3) Weird login attempts Something like whatever Valve is doing in Steam.
contingencies 10y ago
identity thefts and telecommunications frauds are very common Not sure I agree, let's tackle those in order: first, QQ is like ICQ, it's almost dead and therefore irrelevant. On WeChat, phone number is simply used to look people up so you can find them. If you lose a phone or WeChat account, the social identity thing is used to recover it (you get a few friends to send a special magic number to you, then a reset is made). It doesn't trust your number. No idea about Weibo. Taobao does take your phone number but they have to because they need to be able to get in touch with suppliers when there are issues/complaints, and many customers want merchant phone numbers anyway. I don't see trust issues. You can log in with your phone but it's the pre-authenticated instance of your account on a mobile device that it cares about, not your phone number. AliPay, no idea. Online banking is not frequently used because until recently it totally sucked, and often was Windows only (yet macs are really popular), and people here like cash. I think the Chinese ID card number (largely guessable with a birthday and knowledge of where someone was born) is far more dangerous here than a phone number: https://en.wikipedia.org/wiki/Resident_Identity_Card#Identity_card_number https://en.wikipedia.org/wiki/Resident_Identity_Card#Identit... I feel like most financial fraud here is confidence and pyramid schemes.

kalleboo 10y ago

The best advice for SMS 2FA I've seen was what was given to YouTuber boogie2988 by his attacker after he was hacked the same way - use a separate prepaid phone number that you never make public.

tener 10y ago
It doesn't scale as you need to share the number across different services. To be completely decoupled you'd need to have 1 number per account all bundled into one sim card. I don't think this is something you can setup with current services and phone software.
- snuxoll 10y ago
  I mean, you could do it with Flowroute or Twilio. I already pay $1.25/mo for a DID for my home from Flowroute, if I cared enough about security buying another isn't going to put a dent in my pocketbook and I could just have a small little flask app somewhere forward them to a prepaid phone.
- x0x0 10y ago
  Or once a company gets hacked, since that will be unencrypted in the users table. eg the linkedin data dump.
paulsutter 10y ago
Be nice to have a special device with sole purpose sms/2fa, that's very small (easier to carry than a spare phone). A secret number of course, but also running on a service with no human operators who can intervene.
- icebraining 10y ago
  A cheap featurephone is pretty small, and you can even run a J2ME TOTP client, besides SMS.
- AstralStorm 10y ago
  Good banks issue true tokens or one time random code cards for exactly this purpose. A token is a device that generates a known set of pseudorandom numbers. These are relatively cheap - and many modern auth systems depend on the token being installed on a much less secure shared hardware, such as a phone. Still harder to crack than SMS.

raverbashing 10y ago

But if the employee had long passwords, was his fb account compromised through the use of password reset through SMS then?

PwdRsch 10y ago
Yes. They didn't need to know his strong password to log on, they just needed access to his mobile phone SMS in order to complete the account recovery process and change his account password to a value they chose.

carsonreinke 10y ago

I'm a little confused on why these other 2FA approaches are seen as more secure. Is it simply because the port transfer process can happen?

URSpider94 10y ago
The point of 2FA is that you combine something you have, and something you know. For the something you have to be a strong authentication factor, you have to maintain tight control over it. When you use SMS as the factor, you're effectively mailing the second factor to someone with a lot of intermediate steps in the chain of custody. When I use an authentication app on my phone (assuming that I destroyed the seed immediately after loading it), or I use my physical OTP token, then those keys are pretty direct proof that I have possession of that object at that time. If I lose my token, then I know I lost it and I can disable it and get a new one. As this thread demonstrates, it's possible for someone to hijack your phone without you realizing it for a period of hours to days.
- bhandziuk 10y ago
  Pardon my ignorance but what's to stop them from impersonating your authentication app, too?
  - URSpider94 10y ago
    No need to apologize. With an authentication app, you seed it with a key which only you and the service use. Each successive PIN is generated by doing a complex mathematical operation on the initial key, and then dropping most of the digits, so it's basically impossible to infer the key by seeing even dozens or hundreds of the responses. Typically, the key is only good for a minute or so, and/or is only good for one login attempt. As long as nobody else has that key, it's virtually impossible for anyone to figure out what the next token your authentication app will offer up. The data only exists inside the app, and a copy lives on the host that authenticates your login. For someone to impersonate your authentication app, they would have to: a. Gain access to your phone and somehow extract the key, which probably means getting past the phone's native encryption as well as the authentication app's encryption. You do have a passphrase on your phone, right? b. Find a leftover copy of the key. Don't leave one of these lying around for someone to find ... c. Hack the authentication software used on the server side. If hackers can do this, then it's pretty much game over anyway. So, basically, if you never give someone your unlocked phone (in a context where they could take a memory dump, not just casually so they can type in their number), and you don't leave copies of the key lying around, it will be very hard for someone to spoof your authenticator app. OK, I left one attack out -- someone could man-in-the-middle you and get you to give your password and the latest key to them, which they then use to log in. That's why you should only operate over a secure channel (HTTPS or equivalent) where you are sure you're talking with a known endpoint (manually enter the URL, or at least check it in the address bar).

ejdyksen 10y ago

> We also put out some company wide guidance on cellphone account security. Are there published best-practices somewhere on a per-provider basis?

Hydraulix989 10y ago

I was really impressed that a Korean friend had an overseas bank card with an e-ink display on it for displaying TFA codes, just like Authy/Authenticator.

divbit 10y ago

I've raised the issue with Coinbase support before, and I don't know if it's fixed (this was probably last year sometime), but when I used to use Coinbase heavily, it was actually impossible to turn off sms 2fa. Even now, I have totp codes, but still get an sms with a code whenever I try to login to their service. This was a real issue for me and an actual real reason that I stopped using their service for most of last year, as I use google voice / skype for my number, it's not really two factor. I mentioned this issue in an e-mail chain with their support ( and their response was basically that I should use authy instead of totp (Google-authenticator), or some weird workaround involving installing authy / uninstalling authy in a certain sequence which didn't work for me. However- we see here in this post, that all the attacker had to do to compromise the Authy was to compromise the phone number! (I also raised this issue with their support.) Their response to the Authy question was that since Authy / e-mail are running on two different servers, it's considered 2-factor by them... hrm..

otto_ortega 10y ago

Do you know where can I learn about designing a U2F key? Or any other similar token? And I mean from the programming perpesctive not the harware per-se, like some sort of open source firmware for this.

homero 10y ago

That's why authy is a joke

joshstrange 10y ago
How is authy a joke? I have to enter my backup password even after I auth with my phone number on a new phone (same number).
- twr 10y ago
  Authy's developer FAQ implies that ownership of the original phone number is sufficient to restore API-created tokens (e.g., Coinbase). > What happens when a person loses their phone? > Authy automatically synchronizes all accounts. If a user loses his phone when he buys a new one he'll be able to access back all of his account's by registering the app using the same phone number he previously had. https://docs.authy.com/developer_faq.html https://docs.authy.com/developer_faq.html
  - homero 10y ago
    Yeah I really hate that CloudFlare doesn't support other otp at all
  - twr 10y ago
    So I spent some time playing with the Authy app. Here's the drop: 1) Dave has an active Authy account. 2) Dave configures 2FA for Coinbase using Authy. 3) Coinbase, rather than asking Dave to manually enter a TOTP secret, registers a 2FA token on Dave's Authy account via the Authy TOTP API. 4) Mallory takes over Dave's phone number. 5) Mallory resets Dave's Authy account at https://www.authy.com/phones/reset https://www.authy.com/phones/reset. 6) Mallory gains access to Dave's email account (using SMS recovery?). 7) Mallory confirms the Authy reset email. 8) Mallory logs into Authy using Dave's stolen phone number. 9) Mallory now has access to all of Dave's Authy API tokens (Coinbase, CloudFlare, etc). 10) Mallory can try guessing the backup password for Dave's other non-API tokens. Assuming Authy transmits the entire encrypted blob (I'm guessing it does), offline brute-forcing is possible. tl;dr: Don't use Authy for services using the Authy API.

camkego 10y ago

Would anyone care to comment on which cellphone providers allow the highest security? The article recommended the following: "Call your cell phone provider and set up a PIN or password, ask for a port freeze and ask to lock your account to your current SIM." It seems maybe we need a website/git-repo along the lines of https://twofactorauth.org/ https://twofactorauth.org/, but explaining phone provider security supported by provider. Other than that there was a suggestion to have a special cellphone which is only used for SMS auth, and which you don't publish the number for.

peterhartree 10y ago

> Call your cell phone provider and set up a PIN or password, ask for a port freeze and ask to lock your account to your current SIM. Seriously — do this. I’ve twice had the experience of walking into the retail store of a major UK network, supplying my mobile number, name, date of birth and postcode, and walking out with a replacement SIM card activated for my current number. In both cases I subsequently complained loudly to the network management and received apologies and assurances that the retail staff were not following protocol, training procedures would be reviewed etc.