4 ms·
Nice hack. I've been using my phone for less and less over the years, out of security concerns, since it's my 2fa device and I sometimes check email with it. Af
by abecedarius 10y ago
Nice hack. I've been using my phone for less and less over the years, out of security concerns, since it's my 2fa device and I sometimes check email with it. After the Broadcom wifi thing I even stopped carrying it around. I guess it's past time to buy a dedicated 2fa device.
- ZeroManArmy 10y agoWhere would you buy one? I'd love to have one myself.
- skibble 10y agoYubiKeys are supposed to be great. I don't have one myself — been mulling it over, but not sure if I need one since I have an authenticatior app on my phone. If anyone thinks I should though I'm all ears!
- wruza 10y agoIf 2fa through SMS, then maybe any dumbphone is okay? Google 1st: https://security.stackexchange.com/questions/150153/is-a-dumbphone-mobile-more-secure-for-basic-phone-calls-than-a-smartphone https://security.stackexchange.com/questions/150153/is-a-dum...
- pmiller2 10y agoSMS itself isn't all that secure.
- JadeNB 10y ago> SMS itself isn't all that secure. But isn't the point of 2FA that it's OK to have each of the factors individually be (relatively) insecure—passwords being about as insecure as imagineable for most users—as long as no-one is likely to have access to both of them? Thus, it's OK if someone can read your texts, as long as they don't also know your passwords.
- abecedarius 10y agoHackers have stolen large amounts of cryptocurrencies from individual targets because they used SMS 2FA. (If probably more money than I've ever had counts as large.) You might not be as juicy a target, but if you're reading HN I guess you're at least mildly interesting these days, this being the cyberpunk future.
- j_s 10y agoAre you thinking about U2F or something more? Here is a helpful discussion including using the Yubikey Neo NFC with Android phones and alternatives to Yubikey: https://news.ycombinator.com/item?id=13635433 https://news.ycombinator.com/item?id=13635433
- abecedarius 10y agoThings like that, yes, thanks for the link. I've vaguely heard about these devices but not yet properly researched them.
- ColanR 10y agoWhat broadcom wifi 'thing' are you referring to? Guess I missed that piece of history.
- throwaway2048 10y agoEvery single cellphone that uses broadcom wifi (basicly all of them) has remote root via wifi. 95% will never be patched.
- militantVagrant 10y agoAt least there is 5%(Nexus and Pixel) that get patched. The baseband is wide open on 100% of cellphones with a SIM card in them, and it's never getting patched.
- Neliquat 10y agoThats ignoring that GSM and friends are still broken, so your device being rooted is stilp only half the issue.
- abecedarius 10y agohttps://news.ycombinator.com/item?id=14034092 https://news.ycombinator.com/item?id=14034092
- ColanR 10y agoAh. Thanks to you both.
- ww520 10y agoMy bank used to ship a credit card size device that does 2fa.