4 ms·
What exactly is wrong with offering SMS 2FA? I don't have a smartphone, but I have a great little prepaid phone. Why should I get no features just because they
by microcolonel 10y ago
What exactly is wrong with offering SMS 2FA? I don't have a smartphone, but I have a great little prepaid phone. Why should I get no features just because they are not necessarily as good as it gets ? Also, as far as I'm aware, all of the major "attacks" on SMS 2FA are just the fact that a smartphone can be compromised in many ways. I have much less attack surface: an attacker would need to reprogram my undocumented exotic architecture phone with a bug in a parser which is probably too small to contain bugs of that nature.
The other way is SMS MITM, which on some networks is demonstrated feasible, but requires basically setting up an SDR near the victim, a lot more complicated.
With my prepaid provider, customer service is shoddy but would need considerably more to do a number port than just the number.
By removing SMS 2FA you gain nothing, and I lose my only viable second factor.
- deleted 10y ago[deleted]
- ksec 10y agoFrom my limited reading on the issue. SMS in US is unsafe. Not sure if the same can be said in other places like EU or Japan.
- whyagaindavid 10y agoThey should be fixing service providers and not blaming google as in couple of days ago. (of course, if a nation state is trying to hack you good-luck!)
- cerebellum42 10y agoThe attack angles are slightly different but it's not really any safer. The classic scenario is to call the provider to say the SIM card was "stolen" and either have them send the new SIM card to an address you control, or if that is not an option, snatch the new card as it arrives.
- boundlessdreamz 10y agoAll the major 2FA attacks I have read about involved social engineering of the phone provider's customer service to number port. The thing is, since it is not a software system but depends on humans, attackers can keep trying until they get a CS rep they can manipulate. Ex * https://www.wired.com/2016/06/deray-twitter-hack-2-factor-isnt-enough/ https://www.wired.com/2016/06/deray-twitter-hack-2-factor-is... * https://www.hackread.com/gmail-id-hacked-google-two-factor-authentication/ https://www.hackread.com/gmail-id-hacked-google-two-factor-a...
- arthurfm 10y ago> All the major 2FA attacks I have read about involved social engineering of the phone provider's customer service to number port. SS7 attacks don't. [1] http://www.forbes.com/sites/thomasbrewster/2016/06/01/whatsapp-telegram-ss7-hacks/ http://www.forbes.com/sites/thomasbrewster/2016/06/01/whatsa... ... hackers can bypass the encryption protections by exploiting SS7 to create duplicate accounts that receive all the messages intended for the target phone. This is done by tricking the telecoms networks into believing the hacker’s phone has the same number as the target’s. That means they can set up a new WhatsApp or Telegram account with the same number and will receive the supposedly secret code that confirms they are a “legitimate” user. From there, they can impersonate their target, sending and receiving new calls and texts.
- bramblerose 10y agoThere is a TOTP/Google Auth 2FA application for J2ME, which will run on many feature phones: http://totpme.sourceforge.net/ http://totpme.sourceforge.net/ In addition, 2FA systems are not limited to devices the consumer already has -- Paypal could easily send you a device that generates a one-time password, or that uses a challenge-response protocol to do so.
- microcolonel 10y agoYeah, I'll need to upgrade to a J2ME compatible phone when they kill GSM here anyway, so I guess that will be an option. Thanks for the char * * uri;