5 ms·

It's completely ridiculous for a service to offer 2FA with SMS and also password recovery via SMS to the same phone number. It sounds like that's how this guy g

It's completely ridiculous for a service to offer 2FA with SMS and also password recovery via SMS to the same phone number. It sounds like that's how this guy got hacked. He was effectively using more like half-a-factor authentication. He probably didn't realize because his email service didn't clearly show him how it will grant access. It would be great if online services showed a clear matrix of authentication methods so you can see which combinations are sufficient and necessary to access your account. Simply adding a 2nd factor is a bad idea because it means if you lose either one, you're locked out of your account, so you also need a 3rd factor to protect you from yourself. I personally have 4 factors for my gmail account - regular SMS 2FA, a friend's phone number for password recovery and paper backup codes. This way, I can lose almost any two factors and still have access. If I forget my password and also lose access to my friend's phone for password recovery, then perhaps I'll be in trouble but Google doesn't make it clear if they'll let you in using only your backup codes and 2nd factor phone number.

exhilaration 10y ago
It's completely ridiculous for a service to offer 2FA with SMS and also password recovery via SMS to the same phone number Why is this ridiculous? Isn't this the same thing that Gmail offers for your own account? If you lose your password, Gmail will only send the recovery info to your friend's phone?
- averagewall 10y ago
  The problem happens if the password can be recovered with the same phone number as used for 2FA since then anyone who steals the phone/phone account can get both the password reset and the 2FA SMS. However, using two different numbers means a hacker has to hack two phone accounts instead of one. At least I hope that's what they have to do.
bitmapbrother 10y ago
It's even more ridiculous for a telco CSR to transfer his number to another provider without doing any sort of proper validation beforehand. A simple callback to ensure that the person calling was indeed the owner of the number would have prevented all of this.
- amag 10y ago
  In the process of transferring a phone number now and it seems to be universally insecure. Sign a paper and you're done. A simple automated SMS from your current provider that requires a "YES" response would be a lot securer and shouldn't be hard to implement.
  - ewams 10y ago
    Don't forget number porting is recently new. The FCC started requiring carriers do it in 2003. Since the telco's were forced to do it, you think they are going to put any effort into it unless legally required to do so? They don't care.
    - Thetawaves 10y ago
      Nearly every carrier has a customer provided pin attached to the customer account that is used to verify porting requests. Stop commenting on things you know nothing about.
      - pxeboot 10y ago
        Almost all US prepaid providers use the last 4 digits of the phone number or the billing zip code as the PIN. Many landline and voip providers really do just require a signature.
        trome 10y ago
        Landline & VOIP providers rarely have a PIN or security question on file, and CLECs like Level 3 (who supplies Twilio and many others) will approve nearly any port since their customers don't keep customer service records for each number on file with them.
      - nommm-nommm 10y ago
        There has literally been hundreds of cases reported in the media in the last few years where the phone company ported a phone number either without verification or with "verification" (easily found information) and the victim had their accounts stolen. This has been a documented problem. Phone companies seem to be starting to take the issue more seriously as of the last few months due to the aforementioned bad press. Verizon just forced me to create a PIN by Jan 24th, 2017. So I didn't have a PIN until less than a month ago.
forgetsusername 10y ago
>I personally have 4 factors for my gmail account Tack this on to the list of reasons why no normal person will use bitcoin in any quantity.
inertial 10y ago
Maybe this post will convince namecheap to have an alternative 2FA (other than SMS). They've been "planning" [1] this for 3+ years. [1] https://www.namecheap.com/support/knowledgebase/article.aspx/9253/45/how-to-two-factor-authentication https://www.namecheap.com/support/knowledgebase/article.aspx...

exhilaration 10y ago

It's completely ridiculous for a service to offer 2FA with SMS and also password recovery via SMS to the same phone number Why is this ridiculous? Isn't this the same thing that Gmail offers for your own account? If you lose your password, Gmail will only send the recovery info to your friend's phone?

averagewall 10y ago
The problem happens if the password can be recovered with the same phone number as used for 2FA since then anyone who steals the phone/phone account can get both the password reset and the 2FA SMS. However, using two different numbers means a hacker has to hack two phone accounts instead of one. At least I hope that's what they have to do.

bitmapbrother 10y ago

It's even more ridiculous for a telco CSR to transfer his number to another provider without doing any sort of proper validation beforehand. A simple callback to ensure that the person calling was indeed the owner of the number would have prevented all of this.

amag 10y ago
In the process of transferring a phone number now and it seems to be universally insecure. Sign a paper and you're done. A simple automated SMS from your current provider that requires a "YES" response would be a lot securer and shouldn't be hard to implement.
- ewams 10y ago
  Don't forget number porting is recently new. The FCC started requiring carriers do it in 2003. Since the telco's were forced to do it, you think they are going to put any effort into it unless legally required to do so? They don't care.
  - Thetawaves 10y ago
    Nearly every carrier has a customer provided pin attached to the customer account that is used to verify porting requests. Stop commenting on things you know nothing about.
    - pxeboot 10y ago
      Almost all US prepaid providers use the last 4 digits of the phone number or the billing zip code as the PIN. Many landline and voip providers really do just require a signature.
      - trome 10y ago
        Landline & VOIP providers rarely have a PIN or security question on file, and CLECs like Level 3 (who supplies Twilio and many others) will approve nearly any port since their customers don't keep customer service records for each number on file with them.
    - nommm-nommm 10y ago
      There has literally been hundreds of cases reported in the media in the last few years where the phone company ported a phone number either without verification or with "verification" (easily found information) and the victim had their accounts stolen. This has been a documented problem. Phone companies seem to be starting to take the issue more seriously as of the last few months due to the aforementioned bad press. Verizon just forced me to create a PIN by Jan 24th, 2017. So I didn't have a PIN until less than a month ago.

forgetsusername 10y ago

>I personally have 4 factors for my gmail account Tack this on to the list of reasons why no normal person will use bitcoin in any quantity.

inertial 10y ago

Maybe this post will convince namecheap to have an alternative 2FA (other than SMS). They've been "planning" [1] this for 3+ years. [1] https://www.namecheap.com/support/knowledgebase/article.aspx/9253/45/how-to-two-factor-authentication https://www.namecheap.com/support/knowledgebase/article.aspx...