2 ms·

1) This doesn’t allow anyone to read anything, it only allows you to inspect phone identifiers which today are random anyhow. 2) Your security needs only to be

1) This doesn’t allow anyone to read anything, it only allows you to inspect phone identifiers which today are random anyhow. 2) Your security needs only to be as strong as your likely adversary OTP over SMS is fine for most use cases in any case this isn’t an argument against it networks with piss poor controls over SS7 which could allow you to reroute calls and texts to another number or networks that allow you to access voicemail without password if you spoof the origin number are. Yes SMS based 2FA isn’t going to be reselient against a state actor but that shouldn’t be the adversary you protect yourself against if it is you’ve already lost. In nearly all other cases it’s fine, attacks against it aren’t scalable and extremely hard to pull off outside of purely academic exercises and the benefits from the added security are considerable when compared to the use of only passwords or pre-generated auth codes.

jwr 8y ago
SMS-based 2FA is a joke not just because of SS7 attacks, but mostly because most (if not all) phones are set to display SMS messages on the lock screen. So go grab somebody's phone and enjoy access to anything that uses SMS-based 2FA, because those messages are going to be shown even if you are unable to unlock the phone. Far from "academic exercices" or "state-level actors", I'd say.
- tgsovlerkhgsel 8y ago
  Grabbing phones off people doesn't scale, and is reasonably hard to pull off since you need to first map from the online identity to the exact physical location, then actually physically get there yourself. Much easier to just social engineer the provider into giving you a replacement SIM.
  - dogma1138 8y ago
    Grabbing phones of people also means it doesn’t matter if they display messages or not if you have the SIM you don’t need their device. This isn’t any different than stealing a ubikey of someone it’s game over. Also at least in the U.K. it’s pretty hard to get a replacement SIM through social engineering you either need an ID in store or they send it to your billing address only with signed post. In either case the previous SIM would be disabled on the spot which would likely mean that the owner would notice and block it before this can be leveraged for an attack and this is also less scalable than stealing phones since it’s actually more involved in most cases.
- dogma1138 8y ago
  If you can grab a phone from someone you can execute a much simpler physical attack called rubber hose cryptanalysis :) So yes what you are describing is nonsensical you need to know the target, be able to steal their device and use it within a time frame before it would be disabled. And this is if they don’t use say an iPhone or an Android phone with biometric login which often hides the notifications. Also the biggest hole in this premise is that you wouldn’t even care if the device displays texts when locked or not since if you have the device you can take out the SIM and put it into your own phone. So based on this any TOTP or U2F token is useless since they can be stolen and used. Seriously if this is your threat model I don’t think you should leave the house since you are clearly in a lot of danger.

jwr 8y ago

SMS-based 2FA is a joke not just because of SS7 attacks, but mostly because most (if not all) phones are set to display SMS messages on the lock screen. So go grab somebody's phone and enjoy access to anything that uses SMS-based 2FA, because those messages are going to be shown even if you are unable to unlock the phone. Far from "academic exercices" or "state-level actors", I'd say.

tgsovlerkhgsel 8y ago
Grabbing phones off people doesn't scale, and is reasonably hard to pull off since you need to first map from the online identity to the exact physical location, then actually physically get there yourself. Much easier to just social engineer the provider into giving you a replacement SIM.
- dogma1138 8y ago
  Grabbing phones of people also means it doesn’t matter if they display messages or not if you have the SIM you don’t need their device. This isn’t any different than stealing a ubikey of someone it’s game over. Also at least in the U.K. it’s pretty hard to get a replacement SIM through social engineering you either need an ID in store or they send it to your billing address only with signed post. In either case the previous SIM would be disabled on the spot which would likely mean that the owner would notice and block it before this can be leveraged for an attack and this is also less scalable than stealing phones since it’s actually more involved in most cases.
dogma1138 8y ago
If you can grab a phone from someone you can execute a much simpler physical attack called rubber hose cryptanalysis :) So yes what you are describing is nonsensical you need to know the target, be able to steal their device and use it within a time frame before it would be disabled. And this is if they don’t use say an iPhone or an Android phone with biometric login which often hides the notifications. Also the biggest hole in this premise is that you wouldn’t even care if the device displays texts when locked or not since if you have the device you can take out the SIM and put it into your own phone. So based on this any TOTP or U2F token is useless since they can be stolen and used. Seriously if this is your threat model I don’t think you should leave the house since you are clearly in a lot of danger.