5 ms·

Arg. I wish this article were more substantive, since it's an important topic. But there are no details.

nikcub 9y ago
After tons of reports of Coinbase accounts being broken into they looked into it, replicated it and then reported it. SMS isn't a secure nor authenticated transport and never has been. Avoid anything that uses SMS as a transport for secrets or phone numbers as auth. It's not just SS7 vulns but also number portability. afaik Coinbase is still using SMS as an optional second factor, while iCloud still only allows SMS.
- snuxoll 9y ago
  > while iCloud still only allows SMS ? I’ve had 2FA turned on for my iCloud account for a while, any time I’ve needed to authorize a device I’ve had to approve it on my iMac or iOS device, it doesn’t use SMS.
  - nikcub 9y ago
    you can approve login requests using notifications but you need at least one backup trusted phone number on your account see step 2: https://support.apple.com/en-au/HT204915 https://support.apple.com/en-au/HT204915 "trusted phone number" is an oxymoron
- KGIII 9y ago
  Maybe it's time for SSMS? The extra S being for secure, of course. Something encrypted and requiring authentication would be good - and maybe (tangentially related) not letting just anyone transfer your phone number to a new phone contract. That should require ID and some level of additional authentication. It's like the whole thing is a house of cards. I'm half amazed that it works as well as it does and isn't exploited more often.
  - qznc 9y ago
    Better 2FA exists. We still need better identity authentication. Copied passports, phone numbers, and email all have problems. There are government initiatives (in the US it seems to be NSTIC and login.gov). This should be opened up and made international. It seems that login.gov is already an OpenID identity provider. So only marketing is left. Next to login with Facebook and Google, there should be a "login with GovID" or however it is called. It has to work automatically for any citizen in any country (whose government participates), so UX is critical. While blockchain is the hipster technology and there are people working on that (e.g. Civic), I cannot believe in adoption unless government is involved.
    - KGIII 9y ago
      I'd like to see something done in that area. Unfortunately, I'm not sure how politically feasible login.gov is. No, I know it exists and is technically possible - but we have people, a lot of them, who are very much against government tracking. We have people who think the census should be illegal and will claim it is a conspiracy when you point out it is an enumerated responsibility listed in the constitution. We have religious people who will claim it is the foretold sign of the beast and forbid use by their congregation. So, as you say, it is going to need some marketing. Those same people will often give their information to Facebook, by the way. Once it's from the government, I bet there is blowback. When it was announced, even comments on HN and Slashdot were immediately against the idea. But, yeah, you're right. It's going to need government involvement, I'm just not sure that is a realistic hope. I also don't have a better solution.
      - qznc 9y ago
        Facebook already serves as a global identity provider. However, it does not fit some use cases. For example, to buy Bitcoins on Coinbase, you have to comply with KYC/AML laws, which essential means you must send them a scan of your passport and other stuff. A Facebook login is not enough. Technically, it is not necessary that the government runs it. We could let Facebook do that, but that would be worse than government imho. Maybe a non-profit would work? Still, governments must be involved because ultimately they are the original source and enforcer of identity.
- baybal2 9y ago
  The problem with two factor authentication is that it often turns to be just a two stage authentication, or, effectively, an SMS-only authentication. I'm surprised that Googler still kept unsecure password reset on 2FA, while disabling it on regular accounts.
lucaspiller 9y ago
This piece is half an advert but it’s the best article I’ve found that plainly describes the issue: https://www.telecomdefense.com/ss7-vulnerabilities/ https://www.telecomdefense.com/ss7-vulnerabilities/ TL;DR; The system that allows our phone networks to work together was designed decades ago with minimal security.

After tons of reports of Coinbase accounts being broken into they looked into it, replicated it and then reported it. SMS isn't a secure nor authenticated transport and never has been. Avoid anything that uses SMS as a transport for secrets or phone numbers as auth. It's not just SS7 vulns but also number portability. afaik Coinbase is still using SMS as an optional second factor, while iCloud still only allows SMS.

snuxoll 9y ago
> while iCloud still only allows SMS ? I’ve had 2FA turned on for my iCloud account for a while, any time I’ve needed to authorize a device I’ve had to approve it on my iMac or iOS device, it doesn’t use SMS.
- nikcub 9y ago
  you can approve login requests using notifications but you need at least one backup trusted phone number on your account see step 2: https://support.apple.com/en-au/HT204915 https://support.apple.com/en-au/HT204915 "trusted phone number" is an oxymoron
KGIII 9y ago
Maybe it's time for SSMS? The extra S being for secure, of course. Something encrypted and requiring authentication would be good - and maybe (tangentially related) not letting just anyone transfer your phone number to a new phone contract. That should require ID and some level of additional authentication. It's like the whole thing is a house of cards. I'm half amazed that it works as well as it does and isn't exploited more often.
- qznc 9y ago
  Better 2FA exists. We still need better identity authentication. Copied passports, phone numbers, and email all have problems. There are government initiatives (in the US it seems to be NSTIC and login.gov). This should be opened up and made international. It seems that login.gov is already an OpenID identity provider. So only marketing is left. Next to login with Facebook and Google, there should be a "login with GovID" or however it is called. It has to work automatically for any citizen in any country (whose government participates), so UX is critical. While blockchain is the hipster technology and there are people working on that (e.g. Civic), I cannot believe in adoption unless government is involved.
  - KGIII 9y ago
    I'd like to see something done in that area. Unfortunately, I'm not sure how politically feasible login.gov is. No, I know it exists and is technically possible - but we have people, a lot of them, who are very much against government tracking. We have people who think the census should be illegal and will claim it is a conspiracy when you point out it is an enumerated responsibility listed in the constitution. We have religious people who will claim it is the foretold sign of the beast and forbid use by their congregation. So, as you say, it is going to need some marketing. Those same people will often give their information to Facebook, by the way. Once it's from the government, I bet there is blowback. When it was announced, even comments on HN and Slashdot were immediately against the idea. But, yeah, you're right. It's going to need government involvement, I'm just not sure that is a realistic hope. I also don't have a better solution.
    - qznc 9y ago
      Facebook already serves as a global identity provider. However, it does not fit some use cases. For example, to buy Bitcoins on Coinbase, you have to comply with KYC/AML laws, which essential means you must send them a scan of your passport and other stuff. A Facebook login is not enough. Technically, it is not necessary that the government runs it. We could let Facebook do that, but that would be worse than government imho. Maybe a non-profit would work? Still, governments must be involved because ultimately they are the original source and enforcer of identity.
baybal2 9y ago
The problem with two factor authentication is that it often turns to be just a two stage authentication, or, effectively, an SMS-only authentication. I'm surprised that Googler still kept unsecure password reset on 2FA, while disabling it on regular accounts.

lucaspiller 9y ago

This piece is half an advert but it’s the best article I’ve found that plainly describes the issue: https://www.telecomdefense.com/ss7-vulnerabilities/ https://www.telecomdefense.com/ss7-vulnerabilities/ TL;DR; The system that allows our phone networks to work together was designed decades ago with minimal security.