5 ms·
Would someone kindly explain how a SMS can be intercepted during 2FA and how/why tokens otoh are safer? A friend and I were brainstorming the design of a frau
by ojosilva 8y ago
Would someone kindly explain how a SMS can be intercepted during 2FA and how/why tokens otoh are safer?
A friend and I were brainstorming the design of a fraud prevention app/startup just this week and we naively thought SMS would be the way to go. Yikes!
- css 8y agoEither some sort of ss7 exploit [0] or the attackers socially engineered the cell service provider [1]. This happened to some big YouTubers in the past [2]. [0] https://www.washingtonpost.com/news/the-switch/wp/2014/12/18/german-researchers-discover-a-flaw-that-could-let-anyone-listen-to-your-cell-calls-and-read-your-texts/?utm_term=.bb0aa36f9144 https://www.washingtonpost.com/news/the-switch/wp/2014/12/18... [1] https://www.theregister.co.uk/2017/07/10/att_falls_for_hacker_tricks/ https://www.theregister.co.uk/2017/07/10/att_falls_for_hacke... [2] https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg
- AnoniMoose 8y agoYou don't need ss7 0days. One one hand it's hilariously insecure to begin with, especially now lots of it gets trucked over the internet. On the other hand, there's a number of companies selling access and associated services for trivial amounts of money.
- tptacek 8y agoSMS ties security to phone numbers. Phone companies can trivially move numbers to different people, accounts, and SIMs. When you rely on SMS for security, you are relying on the customer support staff of giant mobile phone companies for your security. There are other more technical weaknesses with SMS, because the phone networks themselves are also insecure. But the big issue is phone companies themselves. Don't use SMS 2FA.
- chris_wot 8y agoGoogle pretty much foists it on all our employees.
- tptacek 8y agoIt does, and that is annoying, but you can and should turn it off.
- deleted 8y ago[deleted]
- Arainach 8y agoIn what way? For its employees, it uses physical keys: https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Consumer/enterprise Google accounts have supported U2F and the Google Authenticator app for quite some time. I have SMS completely eliminated as a factor on my GMail account (Yubikey primary with codes from the app as a fallback; no way to authenticate via SMS at all).
- criddell 8y agoFor Google, it's not a text message though, is it? IIRC, it's tied to your Google account and not to your phone number.
- chris_wot 8y agoThey enforce it via SMS.
- mikeash 8y agoIt should be noted that using SMS as a second authentication factor is always more secure than just using a password. As long as you understand its limitations, it makes things more secure. Where so many companies go wrong with SMS “2FA” is by treating it as an alternate authentication method, rather than as a second factor. If you can reset the account password over SMS then you’re boned.
- tptacek 8y agoIt's not more secure if you use SMS as a 2nd factor and then reuse passwords everywhere, which is a thing a lot of people do.
- SaltySolomon 8y agoYeah, because not using a second factor is less secure than using even a middling one?
- alex_anglin 8y agoI'd suggest that it is, but not as secure as alternatives others have discussed. .. which isn't to suggest either password reuse or SMS TFA is a good idea.
- nolok 8y agoI'm not sure I fully agree, in a situation where you reuse passewords everywhere, having SMS 2FA on top of it is still more secure that no 2FA at all, it makes it harder/more costly to break through. My understanding of it is if you can use anything other than SMS 2FA then use that and remove SMS, but if your choice if between no 2FA or SMS 2FA then go with SMS. Also, use it stictly as 2FA, not as identity. This is not my area of expertise so if I'm wrong I would genuinely like to understand why.
- tptacek 8y agoI don't think I'm being clear. I'm saying that in the presence of SMS 2FA, people use weaker passwords than they would otherwise. The SMS 2FA itself weakens their security: they remain vulnerable to targeted attacks and gain a vector for targeted attacks.
- freehunter 8y agoAs an example, I recently got a letter from T-Mobile (my carrier) saying they noticed an increase in number transfer fraud recently and were urging everyone to set a PIN on their account to prevent unauthorized transfers. It does happen.
- ksec 8y ago> When you rely on SMS for security, you are relying on the customer support staff of giant mobile phone companies for your security. Which only happens regularly in US? I have yet to heard as many cases in EU or Asia. Where you are require to proof yourself before any of these customer support staff can alter these information. >There are other more technical weaknesses with SMS, because the phone networks themselves are also insecure. But the big issue is phone companies themselves. I have beeb wondering if these are patchable? Or requires Hardware replacement?
- deleted 8y ago[deleted]
- Hupriene 8y agoThere is poor security around the mapping of phone numbers to physical devices.
- EwanToo 8y agoTake a look at this post for more information on one way it happens https://theantisocialengineer.com/2018/07/23/sim-swap-fraud-a-victims-perspective/ https://theantisocialengineer.com/2018/07/23/sim-swap-fraud-...
- js2 8y agoGoogle for "port out scam" for one way SMS is vulnerable.