4 ms·

>> SMS 2FA is far worse than other types, but still better than no 2FA. It seems like every time I read about how SMS2FA was hacked it was done by some state l

>> SMS 2FA is far worse than other types, but still better than no 2FA. It seems like every time I read about how SMS2FA was hacked it was done by some state level power that would've gotten in through some other method. I don't know if that's confirmation bias or actually true, but I think you're right, SMS is better than no 2FA. Just because the NSA etc... can easily break it doesn't mean it's useless right now. (maybe not the case in a year or two?)

mannykannot 9y ago
> It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). This is from the linked article by Cody Brown, "How to lose $8k worth of bitcoin in 15 minutes with Verizon and Coinbase.com": "Of all the things that went down in the factors that lead to this hack, Verizon Wireless is what I was massively unprepared for. After talking at length with customer service reps, I learned that the hacker did not need to give them my pin number or my social security number and was able to get approval to takeover my cell phone number with simple billing information." See also: https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor-authentication/ https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-...
- ksec 9y ago
  > It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). I think this sums up the problem. BUT SMS is likely the most convenient way for non geeks to use. And, as far as I am concern it seems only ( or especially ) Telecoms in US are vulnerable. In places like China / Hong Kong / Japan / Korea, you cant change your recovery code or what ever without your personal ID.
criddell 9y ago
Every hack I've read about is based on social engineering and is enabled by weak policies and overly helpful customer service representatives at wireless companies.
- kalleboo 9y ago
  Yes, to the point where YouTubers get their accounts hijacked so often that it's best practice among them to use a secret burner phone for 2FA

mannykannot 9y ago

> It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). This is from the linked article by Cody Brown, "How to lose $8k worth of bitcoin in 15 minutes with Verizon and Coinbase.com": "Of all the things that went down in the factors that lead to this hack, Verizon Wireless is what I was massively unprepared for. After talking at length with customer service reps, I learned that the hacker did not need to give them my pin number or my social security number and was able to get approval to takeover my cell phone number with simple billing information." See also: https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor-authentication/ https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-...

ksec 9y ago
> It seems like every time I read about how SMS2FA was hacked it was done by some state level power... It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). I think this sums up the problem. BUT SMS is likely the most convenient way for non geeks to use. And, as far as I am concern it seems only ( or especially ) Telecoms in US are vulnerable. In places like China / Hong Kong / Japan / Korea, you cant change your recovery code or what ever without your personal ID.

criddell 9y ago

Every hack I've read about is based on social engineering and is enabled by weak policies and overly helpful customer service representatives at wireless companies.

kalleboo 9y ago
Yes, to the point where YouTubers get their accounts hijacked so often that it's best practice among them to use a secret burner phone for 2FA