5 ms·

After tons of reports of Coinbase accounts being broken into they looked into it, replicated it and then reported it. SMS isn't a secure nor authenticated tran

by nikcub 9y ago

After tons of reports of Coinbase accounts being broken into they looked into it, replicated it and then reported it. SMS isn't a secure nor authenticated transport and never has been. Avoid anything that uses SMS as a transport for secrets or phone numbers as auth. It's not just SS7 vulns but also number portability. afaik Coinbase is still using SMS as an optional second factor, while iCloud still only allows SMS.

snuxoll 9y ago
> while iCloud still only allows SMS ? I’ve had 2FA turned on for my iCloud account for a while, any time I’ve needed to authorize a device I’ve had to approve it on my iMac or iOS device, it doesn’t use SMS.
- nikcub 9y ago
  you can approve login requests using notifications but you need at least one backup trusted phone number on your account see step 2: https://support.apple.com/en-au/HT204915 https://support.apple.com/en-au/HT204915 "trusted phone number" is an oxymoron
KGIII 9y ago
Maybe it's time for SSMS? The extra S being for secure, of course. Something encrypted and requiring authentication would be good - and maybe (tangentially related) not letting just anyone transfer your phone number to a new phone contract. That should require ID and some level of additional authentication. It's like the whole thing is a house of cards. I'm half amazed that it works as well as it does and isn't exploited more often.
- qznc 9y ago
  Better 2FA exists. We still need better identity authentication. Copied passports, phone numbers, and email all have problems. There are government initiatives (in the US it seems to be NSTIC and login.gov). This should be opened up and made international. It seems that login.gov is already an OpenID identity provider. So only marketing is left. Next to login with Facebook and Google, there should be a "login with GovID" or however it is called. It has to work automatically for any citizen in any country (whose government participates), so UX is critical. While blockchain is the hipster technology and there are people working on that (e.g. Civic), I cannot believe in adoption unless government is involved.
  - KGIII 9y ago
    I'd like to see something done in that area. Unfortunately, I'm not sure how politically feasible login.gov is. No, I know it exists and is technically possible - but we have people, a lot of them, who are very much against government tracking. We have people who think the census should be illegal and will claim it is a conspiracy when you point out it is an enumerated responsibility listed in the constitution. We have religious people who will claim it is the foretold sign of the beast and forbid use by their congregation. So, as you say, it is going to need some marketing. Those same people will often give their information to Facebook, by the way. Once it's from the government, I bet there is blowback. When it was announced, even comments on HN and Slashdot were immediately against the idea. But, yeah, you're right. It's going to need government involvement, I'm just not sure that is a realistic hope. I also don't have a better solution.
    - qznc 9y ago
      Facebook already serves as a global identity provider. However, it does not fit some use cases. For example, to buy Bitcoins on Coinbase, you have to comply with KYC/AML laws, which essential means you must send them a scan of your passport and other stuff. A Facebook login is not enough. Technically, it is not necessary that the government runs it. We could let Facebook do that, but that would be worse than government imho. Maybe a non-profit would work? Still, governments must be involved because ultimately they are the original source and enforcer of identity.
      - KGIII 9y ago
        I wonder if some sort of global NGO would work? Maybe an offshoot of the UN? At least initially, it will get lots of blowback in the US - if it is a requirement to get services. So, maybe they can incentivize it? Total adoption may take quite a while, perhaps even a full generation, though maybe more. We could start by making it optional and using it to expedite some services. We could also start initiating it at birth, to go along with the SSN. Maybe we could even make the SSN card a plastic card with a magnetic strip and a chip in it, for the NFR functionality, as well as making inexpensive USB devices for online authentication? I'm not an authority on this, or anything. I'm just speculating as to how it might work and how it might be possible to get it adopted. There will still be people against it, thinking it is something like trying to force a single world government, but it should be okay so long as it isn't a strict requirement to access services. Of course, accessing those services might be more difficult and that'd give incentive to use it. It'd have to be no-direct cost, and replaceable if lost or stolen. Maybe allow a free replacement every two years, or similar. Then, maybe a few bucks to replace it otherwise. There should probably be a hardship clause. The card could have many other uses, as well. Maybe people could opt to use the same card for banking, for library loans, for welfare benefits, and things like that? It seems doable, tech-wise. Politically, it's much more difficult. Even the new(ish) enhanced ID requirements went over poorly. My State fought that for years by using the excuse that it was an unfunded law. Yup, Maine fought against the enhanced ID that lets us cross the border into Canada without a passport. The excuse was funding, but it was really about not wanting to be told we needed a federal ID. It's a potentially tough nut to crack.
baybal2 9y ago
The problem with two factor authentication is that it often turns to be just a two stage authentication, or, effectively, an SMS-only authentication. I'm surprised that Googler still kept unsecure password reset on 2FA, while disabling it on regular accounts.

by nikcub 9y ago

snuxoll 9y ago

> while iCloud still only allows SMS ? I’ve had 2FA turned on for my iCloud account for a while, any time I’ve needed to authorize a device I’ve had to approve it on my iMac or iOS device, it doesn’t use SMS.

nikcub 9y ago
you can approve login requests using notifications but you need at least one backup trusted phone number on your account see step 2: https://support.apple.com/en-au/HT204915 https://support.apple.com/en-au/HT204915 "trusted phone number" is an oxymoron

KGIII 9y ago

Maybe it's time for SSMS? The extra S being for secure, of course. Something encrypted and requiring authentication would be good - and maybe (tangentially related) not letting just anyone transfer your phone number to a new phone contract. That should require ID and some level of additional authentication. It's like the whole thing is a house of cards. I'm half amazed that it works as well as it does and isn't exploited more often.

qznc 9y ago
Better 2FA exists. We still need better identity authentication. Copied passports, phone numbers, and email all have problems. There are government initiatives (in the US it seems to be NSTIC and login.gov). This should be opened up and made international. It seems that login.gov is already an OpenID identity provider. So only marketing is left. Next to login with Facebook and Google, there should be a "login with GovID" or however it is called. It has to work automatically for any citizen in any country (whose government participates), so UX is critical. While blockchain is the hipster technology and there are people working on that (e.g. Civic), I cannot believe in adoption unless government is involved.
- KGIII 9y ago
  I'd like to see something done in that area. Unfortunately, I'm not sure how politically feasible login.gov is. No, I know it exists and is technically possible - but we have people, a lot of them, who are very much against government tracking. We have people who think the census should be illegal and will claim it is a conspiracy when you point out it is an enumerated responsibility listed in the constitution. We have religious people who will claim it is the foretold sign of the beast and forbid use by their congregation. So, as you say, it is going to need some marketing. Those same people will often give their information to Facebook, by the way. Once it's from the government, I bet there is blowback. When it was announced, even comments on HN and Slashdot were immediately against the idea. But, yeah, you're right. It's going to need government involvement, I'm just not sure that is a realistic hope. I also don't have a better solution.
  - qznc 9y ago
    Facebook already serves as a global identity provider. However, it does not fit some use cases. For example, to buy Bitcoins on Coinbase, you have to comply with KYC/AML laws, which essential means you must send them a scan of your passport and other stuff. A Facebook login is not enough. Technically, it is not necessary that the government runs it. We could let Facebook do that, but that would be worse than government imho. Maybe a non-profit would work? Still, governments must be involved because ultimately they are the original source and enforcer of identity.
    - KGIII 9y ago
      I wonder if some sort of global NGO would work? Maybe an offshoot of the UN? At least initially, it will get lots of blowback in the US - if it is a requirement to get services. So, maybe they can incentivize it? Total adoption may take quite a while, perhaps even a full generation, though maybe more. We could start by making it optional and using it to expedite some services. We could also start initiating it at birth, to go along with the SSN. Maybe we could even make the SSN card a plastic card with a magnetic strip and a chip in it, for the NFR functionality, as well as making inexpensive USB devices for online authentication? I'm not an authority on this, or anything. I'm just speculating as to how it might work and how it might be possible to get it adopted. There will still be people against it, thinking it is something like trying to force a single world government, but it should be okay so long as it isn't a strict requirement to access services. Of course, accessing those services might be more difficult and that'd give incentive to use it. It'd have to be no-direct cost, and replaceable if lost or stolen. Maybe allow a free replacement every two years, or similar. Then, maybe a few bucks to replace it otherwise. There should probably be a hardship clause. The card could have many other uses, as well. Maybe people could opt to use the same card for banking, for library loans, for welfare benefits, and things like that? It seems doable, tech-wise. Politically, it's much more difficult. Even the new(ish) enhanced ID requirements went over poorly. My State fought that for years by using the excuse that it was an unfunded law. Yup, Maine fought against the enhanced ID that lets us cross the border into Canada without a passport. The excuse was funding, but it was really about not wanting to be told we needed a federal ID. It's a potentially tough nut to crack.

baybal2 9y ago

The problem with two factor authentication is that it often turns to be just a two stage authentication, or, effectively, an SMS-only authentication. I'm surprised that Googler still kept unsecure password reset on 2FA, while disabling it on regular accounts.