3 ms·

It's not just SMS that's vulnerable. 2fa apps like Authy are also at risk from fraudulent interstitial sites that capture your user ID, password and Authy code

It's not just SMS that's vulnerable. 2fa apps like Authy are also at risk from fraudulent interstitial sites that capture your user ID, password and Authy code, authenticate with the legitimate site, and allow the fraudster to control your account. Really the only secure 2fa is a hardware token.

hn_throwaway_99 8y ago
While hardware tokens are definitely more secure, there is a large difference between the security of SMS 2FA and TOTP code-based 2FA. SMS 2FA is fundamentally insecure because the SMS system can be hacked regardless of the security consciousness of the end user. On the other hand, while TOTP code-based 2FA is certainly subject to phishing, there are 100% effective ways that an end user can prevent this (like double checking the URL). So while I do agree with you that hardware tokens are best, it's a mistake to lump SMS in with other forms of 2FA from a vulnerability perspective.
- tptacek 8y ago
  No, I don't think this is true. TOTP 2FA has the advantage that your 2FA codes can't be stolen by porting your phone to another device (an attack teenagers can pull off), and, in elaborate attack scenarios, TOTP also has the advantage that it's not susceptible to attacks on SMS itself. But both TOTP and SMS are phishable, and moving from SMS to TOTP is not a meaningful anti-phishing defense. U2F and Webauthn resist phishing using a form a mutual authentication, which is why security keys actually do resist phishing, and why Google switched to them and away from TOTP.
  - hn_throwaway_99 8y ago
    I think you misread my post. I wrote "while TOTP code-based 2FA is certainly subject to phishing..." My point being that at least with phishing attacks the end user can prevent them by paying attention. With SMS 2FA, even if the end user does everything right they are still open to getting hacked. For example, a bunch of people had their Bitcoin stolen when bad guys convinced the phone company to change number ownership.
seppin 8y ago
Using a password manager defeats this as all the main ones will verify the url asking for the creds before sending them, defeating phishing.

hn_throwaway_99 8y ago

While hardware tokens are definitely more secure, there is a large difference between the security of SMS 2FA and TOTP code-based 2FA. SMS 2FA is fundamentally insecure because the SMS system can be hacked regardless of the security consciousness of the end user. On the other hand, while TOTP code-based 2FA is certainly subject to phishing, there are 100% effective ways that an end user can prevent this (like double checking the URL). So while I do agree with you that hardware tokens are best, it's a mistake to lump SMS in with other forms of 2FA from a vulnerability perspective.

tptacek 8y ago
No, I don't think this is true. TOTP 2FA has the advantage that your 2FA codes can't be stolen by porting your phone to another device (an attack teenagers can pull off), and, in elaborate attack scenarios, TOTP also has the advantage that it's not susceptible to attacks on SMS itself. But both TOTP and SMS are phishable, and moving from SMS to TOTP is not a meaningful anti-phishing defense. U2F and Webauthn resist phishing using a form a mutual authentication, which is why security keys actually do resist phishing, and why Google switched to them and away from TOTP.
- hn_throwaway_99 8y ago
  I think you misread my post. I wrote "while TOTP code-based 2FA is certainly subject to phishing..." My point being that at least with phishing attacks the end user can prevent them by paying attention. With SMS 2FA, even if the end user does everything right they are still open to getting hacked. For example, a bunch of people had their Bitcoin stolen when bad guys convinced the phone company to change number ownership.

seppin 8y ago

Using a password manager defeats this as all the main ones will verify the url asking for the creds before sending them, defeating phishing.