5 ms·

Ouch! Also, PayPal really needs to stop using SMS for 2fa. I expect more from a payment processor that is linked to my bank account.

vinay427 10y ago
As I just mentioned elsewhere on this thread, SMS isn't the problem here. I use a VeriSign dongle for PayPal 2FA but PayPal still offers the same option of using security questions instead. I was previously under the reasonable assumption that the security questions form was ar least handled correctly, but apparently not.
necessity 10y ago
Everyone except maybe phone apps should stop using SMS for 2FA.
aguo 10y ago
Agreed, NIST stopped recommending SMS 2FA a few months back (https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...) I really wish they had Google authenticator or Yubikey support.
- jlgaddis 10y ago
  They have both. I have a "Symantec VIP" co-branded Yubikey that I've used with PayPal for years along with an authenticator app on my phone as a fallback.
  - tP5n 10y ago
    I have both a yubikey and an auth app but can't seem to find a way to use them with paypal. Do you have some kind of special account or is that a feature bound to a certain market?
    - jlgaddis 10y ago
      I don't think there's anything special about my account. It was a "personal" account when I created it, probably almost 15 years or so ago, then upgraded to a business account maybe 8-10 years ago. I don't have my password handy right now so I can't login to check, but look for settings related to their "security key". I don't know if they still do or not but at one point they offered a hardware OTP generator (similar to the old RSA SecurID key fob) for a one-time $5 fee. Alternatively, you could use an existing one you already had just by entering its "ID number"; I used the IDs of my Symantec VIP Yubikey and also the app. Sorry I can't be more specific or give you better guidance. I know that the option does exist, though; perhaps just explore the available options and maybe you'll stumble across it. Good luck!
microcolonel 10y ago
What exactly is wrong with offering SMS 2FA? I don't have a smartphone, but I have a great little prepaid phone. Why should I get no features just because they are not necessarily as good as it gets ? Also, as far as I'm aware, all of the major "attacks" on SMS 2FA are just the fact that a smartphone can be compromised in many ways. I have much less attack surface: an attacker would need to reprogram my undocumented exotic architecture phone with a bug in a parser which is probably too small to contain bugs of that nature. The other way is SMS MITM, which on some networks is demonstrated feasible, but requires basically setting up an SDR near the victim, a lot more complicated. With my prepaid provider, customer service is shoddy but would need considerably more to do a number port than just the number. By removing SMS 2FA you gain nothing, and I lose my only viable second factor.
- deleted 10y ago
  [deleted]
- ksec 10y ago
  From my limited reading on the issue. SMS in US is unsafe. Not sure if the same can be said in other places like EU or Japan.
  - whyagaindavid 10y ago
    They should be fixing service providers and not blaming google as in couple of days ago. (of course, if a nation state is trying to hack you good-luck!)
  - cerebellum42 10y ago
    The attack angles are slightly different but it's not really any safer. The classic scenario is to call the provider to say the SIM card was "stolen" and either have them send the new SIM card to an address you control, or if that is not an option, snatch the new card as it arrives.
- boundlessdreamz 10y ago
  All the major 2FA attacks I have read about involved social engineering of the phone provider's customer service to number port. The thing is, since it is not a software system but depends on humans, attackers can keep trying until they get a CS rep they can manipulate. Ex * https://www.wired.com/2016/06/deray-twitter-hack-2-factor-isnt-enough/ https://www.wired.com/2016/06/deray-twitter-hack-2-factor-is... * https://www.hackread.com/gmail-id-hacked-google-two-factor-authentication/ https://www.hackread.com/gmail-id-hacked-google-two-factor-a...

vinay427 10y ago

As I just mentioned elsewhere on this thread, SMS isn't the problem here. I use a VeriSign dongle for PayPal 2FA but PayPal still offers the same option of using security questions instead. I was previously under the reasonable assumption that the security questions form was ar least handled correctly, but apparently not.

necessity 10y ago

Everyone except maybe phone apps should stop using SMS for 2FA.

aguo 10y ago

Agreed, NIST stopped recommending SMS 2FA a few months back (https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...) I really wish they had Google authenticator or Yubikey support.

jlgaddis 10y ago
They have both. I have a "Symantec VIP" co-branded Yubikey that I've used with PayPal for years along with an authenticator app on my phone as a fallback.
- tP5n 10y ago
  I have both a yubikey and an auth app but can't seem to find a way to use them with paypal. Do you have some kind of special account or is that a feature bound to a certain market?
  - jlgaddis 10y ago
    I don't think there's anything special about my account. It was a "personal" account when I created it, probably almost 15 years or so ago, then upgraded to a business account maybe 8-10 years ago. I don't have my password handy right now so I can't login to check, but look for settings related to their "security key". I don't know if they still do or not but at one point they offered a hardware OTP generator (similar to the old RSA SecurID key fob) for a one-time $5 fee. Alternatively, you could use an existing one you already had just by entering its "ID number"; I used the IDs of my Symantec VIP Yubikey and also the app. Sorry I can't be more specific or give you better guidance. I know that the option does exist, though; perhaps just explore the available options and maybe you'll stumble across it. Good luck!

microcolonel 10y ago

What exactly is wrong with offering SMS 2FA? I don't have a smartphone, but I have a great little prepaid phone. Why should I get no features just because they are not necessarily as good as it gets ? Also, as far as I'm aware, all of the major "attacks" on SMS 2FA are just the fact that a smartphone can be compromised in many ways. I have much less attack surface: an attacker would need to reprogram my undocumented exotic architecture phone with a bug in a parser which is probably too small to contain bugs of that nature. The other way is SMS MITM, which on some networks is demonstrated feasible, but requires basically setting up an SDR near the victim, a lot more complicated. With my prepaid provider, customer service is shoddy but would need considerably more to do a number port than just the number. By removing SMS 2FA you gain nothing, and I lose my only viable second factor.

deleted 10y ago
[deleted]
ksec 10y ago
From my limited reading on the issue. SMS in US is unsafe. Not sure if the same can be said in other places like EU or Japan.
- whyagaindavid 10y ago
  They should be fixing service providers and not blaming google as in couple of days ago. (of course, if a nation state is trying to hack you good-luck!)
- cerebellum42 10y ago
  The attack angles are slightly different but it's not really any safer. The classic scenario is to call the provider to say the SIM card was "stolen" and either have them send the new SIM card to an address you control, or if that is not an option, snatch the new card as it arrives.
boundlessdreamz 10y ago
All the major 2FA attacks I have read about involved social engineering of the phone provider's customer service to number port. The thing is, since it is not a software system but depends on humans, attackers can keep trying until they get a CS rep they can manipulate. Ex * https://www.wired.com/2016/06/deray-twitter-hack-2-factor-isnt-enough/ https://www.wired.com/2016/06/deray-twitter-hack-2-factor-is... * https://www.hackread.com/gmail-id-hacked-google-two-factor-authentication/ https://www.hackread.com/gmail-id-hacked-google-two-factor-a...