5 ms·

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a

by hw 9y ago

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

pacala 9y ago
Doesn’t 2fa mean password + phone? How is getting the phone sufficient?
- shakna 9y ago
  You can often reset the password if you can intercept the chosen token generator, like SMS.
jackhack 9y ago
In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear. It's disgusting how twisted these criminal activities have become.
- sitkack 9y ago
  I remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them. Every alternative way in is a larger attack area.
- aaron_m04 9y ago
  How does the phone number get identified? You would think that'd be confidential.
- gowld 9y ago
  You mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.
  - packet_nerd 9y ago
    I got a Yubikey a few weeks ago and thought I'd switch to an online bank that offered Yibikey login... I spent hours looking and couldn't find any. Not even one. Couldn't even find any offering Google Authenticator. I saw that a few of the biggest banks will ship you an RSA token/similar device if you ask, but not quite what I had in mind.
aksss 9y ago
I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.
- aidenn0 9y ago
  SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"
  - gruez 9y ago
    use a burner sim like: https://www.twilio.com/wireless/pricing https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]
    - my_first_acct 9y ago
      The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA. Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2] As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally. [1] https://support.twilio.com/hc/en-us/articles/223181668-Can-Twilio-numbers-receive-SMS-from-a-short-code- https://support.twilio.com/hc/en-us/articles/223181668-Can-T... [2] https://news.ycombinator.com/item?id=16773171 https://news.ycombinator.com/item?id=16773171
Thlom 9y ago
In Norway we have "BankID" which is a 2FA solution for authentication and digital signature. It started as a normal 2FA solution with a hardware token combined with username (social security number) and password. A few years ago they introduced a mobile solution where you don't get a SMS or get prompted by an app, but rather it's some kind of functionality on the SIM card. Very convenient and works on all banks, most finance institutions and everywhere else you need to sign things.
- fnordsensei 9y ago
  Lately there have been attacks on BankID in Sweden. They call you up and pretend to be from your bank, then ask you to open your BankID app and verify your identity so that they can share some very important information with you. You open your app, and ID yourself, thereby logging them into your bank account on their end.
eksemplar 9y ago
Depends on your country doesn’t it? Where I live you need to identify yourself with your national 2factor ID if you want to do anything phone related. Both for security reasons, but also because of big brother tracking us. But the side effect of this is that you can’t highjack a phone number unless you highjack the cell tower between it and the network.

by hw 9y ago

pacala 9y ago

Doesn’t 2fa mean password + phone? How is getting the phone sufficient?

shakna 9y ago
You can often reset the password if you can intercept the chosen token generator, like SMS.

jackhack 9y ago

In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear. It's disgusting how twisted these criminal activities have become.

sitkack 9y ago
I remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them. Every alternative way in is a larger attack area.
aaron_m04 9y ago
How does the phone number get identified? You would think that'd be confidential.
gowld 9y ago
You mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.
- packet_nerd 9y ago
  I got a Yubikey a few weeks ago and thought I'd switch to an online bank that offered Yibikey login... I spent hours looking and couldn't find any. Not even one. Couldn't even find any offering Google Authenticator. I saw that a few of the biggest banks will ship you an RSA token/similar device if you ask, but not quite what I had in mind.

aksss 9y ago

I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.

aidenn0 9y ago
SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"
- gruez 9y ago
  use a burner sim like: https://www.twilio.com/wireless/pricing https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]
  - my_first_acct 9y ago
    The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA. Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2] As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally. [1] https://support.twilio.com/hc/en-us/articles/223181668-Can-Twilio-numbers-receive-SMS-from-a-short-code- https://support.twilio.com/hc/en-us/articles/223181668-Can-T... [2] https://news.ycombinator.com/item?id=16773171 https://news.ycombinator.com/item?id=16773171

Thlom 9y ago

In Norway we have "BankID" which is a 2FA solution for authentication and digital signature. It started as a normal 2FA solution with a hardware token combined with username (social security number) and password. A few years ago they introduced a mobile solution where you don't get a SMS or get prompted by an app, but rather it's some kind of functionality on the SIM card. Very convenient and works on all banks, most finance institutions and everywhere else you need to sign things.

fnordsensei 9y ago
Lately there have been attacks on BankID in Sweden. They call you up and pretend to be from your bank, then ask you to open your BankID app and verify your identity so that they can share some very important information with you. You open your app, and ID yourself, thereby logging them into your bank account on their end.

eksemplar 9y ago

Depends on your country doesn’t it? Where I live you need to identify yourself with your national 2factor ID if you want to do anything phone related. Both for security reasons, but also because of big brother tracking us. But the side effect of this is that you can’t highjack a phone number unless you highjack the cell tower between it and the network.