5 ms·

> Avoid: SMS has been at the center of a lot of two-factor hacks, most recently as a way to hijack Telegram accounts in Iran. High-security accounts are already

by Cpoll 9y ago

> Avoid: SMS has been at the center of a lot of two-factor hacks, most recently as a way to hijack Telegram accounts in Iran. High-security accounts are already moving away from it, but a frightening number of services still keep it as an option, giving anyone who compromises your carrier account an easy way in. I feel like this is badly phrased. SMS 2FA is far worse than other types, but still better than no 2FA.

blakesterz 9y ago
>> SMS 2FA is far worse than other types, but still better than no 2FA. It seems like every time I read about how SMS2FA was hacked it was done by some state level power that would've gotten in through some other method. I don't know if that's confirmation bias or actually true, but I think you're right, SMS is better than no 2FA. Just because the NSA etc... can easily break it doesn't mean it's useless right now. (maybe not the case in a year or two?)
- mannykannot 9y ago
  > It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). This is from the linked article by Cody Brown, "How to lose $8k worth of bitcoin in 15 minutes with Verizon and Coinbase.com": "Of all the things that went down in the factors that lead to this hack, Verizon Wireless is what I was massively unprepared for. After talking at length with customer service reps, I learned that the hacker did not need to give them my pin number or my social security number and was able to get approval to takeover my cell phone number with simple billing information." See also: https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor-authentication/ https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-...
  - ksec 9y ago
    > It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). I think this sums up the problem. BUT SMS is likely the most convenient way for non geeks to use. And, as far as I am concern it seems only ( or especially ) Telecoms in US are vulnerable. In places like China / Hong Kong / Japan / Korea, you cant change your recovery code or what ever without your personal ID.
- criddell 9y ago
  Every hack I've read about is based on social engineering and is enabled by weak policies and overly helpful customer service representatives at wireless companies.
  - kalleboo 9y ago
    Yes, to the point where YouTubers get their accounts hijacked so often that it's best practice among them to use a secret burner phone for 2FA
whitepoplar 9y ago
I think SMS 2FA is worse than no 2FA, given that you can often reset a password using SMS as verification. If your phone number is hijacked, you're owned completely. Without SMS 2FA, you have to reset your password via email, or resort to contacting the company directly.
- freeone3000 9y ago
  If you can reset your password with it, it's not a second factor. It's just a different factor.
  - ams6110 9y ago
    But there needs to be a scalable way to let users reset passwords. Users will forget passwords, as anyone who has ever worked tier one support can verify. Requiring a physical, government-issued ID to be presented at an office can work for some scenarios, but not for the vast majority of online services.
  - mikestew 9y ago
    Too bad this is a sub-comment that can't be voted to the top of the page. Very insightful, and a way of looking at the situation that I'm disappointed to say didn't occur to me until reading your comment.

by Cpoll 9y ago

blakesterz 9y ago

>> SMS 2FA is far worse than other types, but still better than no 2FA. It seems like every time I read about how SMS2FA was hacked it was done by some state level power that would've gotten in through some other method. I don't know if that's confirmation bias or actually true, but I think you're right, SMS is better than no 2FA. Just because the NSA etc... can easily break it doesn't mean it's useless right now. (maybe not the case in a year or two?)

mannykannot 9y ago
> It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). This is from the linked article by Cody Brown, "How to lose $8k worth of bitcoin in 15 minutes with Verizon and Coinbase.com": "Of all the things that went down in the factors that lead to this hack, Verizon Wireless is what I was massively unprepared for. After talking at length with customer service reps, I learned that the hacker did not need to give them my pin number or my social security number and was able to get approval to takeover my cell phone number with simple billing information." See also: https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor-authentication/ https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-...
- ksec 9y ago
  > It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). I think this sums up the problem. BUT SMS is likely the most convenient way for non geeks to use. And, as far as I am concern it seems only ( or especially ) Telecoms in US are vulnerable. In places like China / Hong Kong / Japan / Korea, you cant change your recovery code or what ever without your personal ID.
criddell 9y ago
Every hack I've read about is based on social engineering and is enabled by weak policies and overly helpful customer service representatives at wireless companies.
- kalleboo 9y ago
  Yes, to the point where YouTubers get their accounts hijacked so often that it's best practice among them to use a secret burner phone for 2FA

whitepoplar 9y ago

I think SMS 2FA is worse than no 2FA, given that you can often reset a password using SMS as verification. If your phone number is hijacked, you're owned completely. Without SMS 2FA, you have to reset your password via email, or resort to contacting the company directly.

freeone3000 9y ago
If you can reset your password with it, it's not a second factor. It's just a different factor.
- ams6110 9y ago
  But there needs to be a scalable way to let users reset passwords. Users will forget passwords, as anyone who has ever worked tier one support can verify. Requiring a physical, government-issued ID to be presented at an office can work for some scenarios, but not for the vast majority of online services.
- mikestew 9y ago
  Too bad this is a sub-comment that can't be voted to the top of the page. Very insightful, and a way of looking at the situation that I'm disappointed to say didn't occur to me until reading your comment.