10 ms·

In all seriousness folks, as someone who long ago worked for a big wireless carrier, do not use SMS-based two-factor auth for anything. Number porting is a huge

In all seriousness folks, as someone who long ago worked for a big wireless carrier, do not use SMS-based two-factor auth for anything. Number porting is a huge and easily performed attack vector, it requires very, very little information, a lot of which can be gathered from publicly available resources... or pretty easily obtained via social engineering. To make matters worse, the information doesn't even need to be entirely accurate. Once they have your number ported getting it back will take, at least, a few days; during which, they'll have unfettered access to anything that uses your mobile number to authenticate. Use a dedicated 2FA application on a device you physically control and _write down_ the backup keys somewhere physically safe.

Reedx 7y ago
Oy, does that mean Authy is vulnerable to this? https://authy.com/phones/reset/?proceed=true https://authy.com/phones/reset/?proceed=true
- odensc 7y ago
  Authy backups are encrypted with a password (at least, if you set them to), so you can't gain access with just the phone number. However I believe their "OneTouch" system (e.g. Twitch & Namecheap) is linked to phone numbers only, so that could be breached via SMS. I'd recommend using a standalone 2FA app which can be backed up to your own cloud storage. (e.g. Google Drive/Dropbox)
foobiekr 7y ago
So what’s the alternative? Especially financial institutions insist on using SMS in addition to even hardware keys. It’s crazy.
- dontbenebby 7y ago
  Or allowing one to "confirm" their accoubt via SMS if they've lost the TOTP code generating device. (Because no one would lie about that)
- dontbenebby 7y ago
  Many carriers let you set an "account password" or "account pin" - changes can't be made to the account without it (even with personal info like SSN, bday, etc) Financial institutions offer it to sometimes - my credit union requires the account password, or a visit to a branch to show ID - no amount of personal info will allow you access.
  - jjeaff 7y ago
    Any carrier will allow you to change your password or pin using other information . Otherwise, what would happen in the frequent case where users forget their pin?
    - dontbenebby 7y ago
      > Any carrier will allow you to change your password or pin using other information . If by "other information" you mean "come into a store and show a government issued photo ID" you are correct. That's a fairly high bar to clear. That's the way my carrier does it, and I assume if they violate their own procedures I could evaluate my legal options... though as a practical matter I use a VOIP # which requires a 2FA protected login to port out for vendors that force me to use SMS 2FA.
      - jjeaff 7y ago
        Which carrier is that?
- cortesoft 7y ago
  Use a different financial institution
TheChaplain 7y ago
I wish Google, Twitter et al would listen to this, but alas...
- neuralspark 7y ago
  Google offers 2FA using TOTP, and has for several years.
  - sneak 7y ago
    And U2F tokens, which are even better than TOTP as they are immune to phishing. TOTP codes can be and commonly are phished. U2F is the current state of the art for 2FA. App/Device-based 2fa (krypton, Google App’s “approve on other device”, authy’s “approve on other device”, keybase, et c) are second. TOTP is in a lot of ways more trouble than it is worth.
    - codedokode 7y ago
      Also physical tokens can be easier to use if the support for them is built into OS and doesn't require installing or configuring additional software.
- jdeibele 7y ago
  At least Google allows you to turn off SMS as a "2FA" source. You can set up Google Authenticator (or Authy) and a Yubikey as 2FA sources, then remove your phone number. Much to my surprise, I was able to do this with PayPal where I set up two Symantec VIP Access IDs and was able to remove the phone number. I wish I could do this with other accounts.
debatem1 7y ago
Not to mention the fact that the carrier can perform these attacks quite easily, as can the governments who have historically found ISPs willing partners. If you have any reason to believe that you might be the subject of a targeted attack, do not use SMS as a second factor!
ohazi 7y ago
Many services will happily send an SMS account recovery/reset link regardless of how vehemently we refuse to use SMS-based two-factor auth. An attacker can call support, give them plausibly correct information gleaned from public sources, and nicely claim to have forgotten the answers to your recovery questions ("Oh, it might have been a jumble of letters and numbers... silly me..."). There are enough incorrectly trained support people who will let this through to make the tactic effective on average. Your point is obviously correct, but everything is so hopelessly broken that it almost doesn't matter in practice.
puzzlingcaptcha 7y ago
>Number porting is a huge and easily performed attack vector, it requires very, very little information Does it need to be? Seems most of it could be avoided if the cellular service required a visit at the store with an ID card to clone a SIM card.
- PeterisP 7y ago
  ... which is how it actually works in many countries. In USA "something you know" is enough to impersonate you, elsewhere you'd actually show up with a good quality forgery of passport or gov't ID card, which would cost you more than you might steal from a random person. Since USA has this "root of trust" problem, it's also unreasonably easy to obtain fake USA IDs since you (again) can impersonate people simply with "something you know" even for the purposes of obtaining legitimate IDs. It's not so easy elsewhere (e.g. if you claim you're me and have lost all ID, they'd just check biometrics before reissuing ID). Proper checks of IDs (+ verification of lost&stolen IDs databases) can ensure that identity theft cases are very rare. The identity theft epidemic isn't general worldwide, it's mostly a regional issue specific to USA and some similar countries.

Reedx 7y ago

Oy, does that mean Authy is vulnerable to this? https://authy.com/phones/reset/?proceed=true https://authy.com/phones/reset/?proceed=true

odensc 7y ago
Authy backups are encrypted with a password (at least, if you set them to), so you can't gain access with just the phone number. However I believe their "OneTouch" system (e.g. Twitch & Namecheap) is linked to phone numbers only, so that could be breached via SMS. I'd recommend using a standalone 2FA app which can be backed up to your own cloud storage. (e.g. Google Drive/Dropbox)

foobiekr 7y ago

So what’s the alternative? Especially financial institutions insist on using SMS in addition to even hardware keys. It’s crazy.

dontbenebby 7y ago
Or allowing one to "confirm" their accoubt via SMS if they've lost the TOTP code generating device. (Because no one would lie about that)
dontbenebby 7y ago
Many carriers let you set an "account password" or "account pin" - changes can't be made to the account without it (even with personal info like SSN, bday, etc) Financial institutions offer it to sometimes - my credit union requires the account password, or a visit to a branch to show ID - no amount of personal info will allow you access.
- jjeaff 7y ago
  Any carrier will allow you to change your password or pin using other information . Otherwise, what would happen in the frequent case where users forget their pin?
  - dontbenebby 7y ago
    > Any carrier will allow you to change your password or pin using other information . If by "other information" you mean "come into a store and show a government issued photo ID" you are correct. That's a fairly high bar to clear. That's the way my carrier does it, and I assume if they violate their own procedures I could evaluate my legal options... though as a practical matter I use a VOIP # which requires a 2FA protected login to port out for vendors that force me to use SMS 2FA.
    - jjeaff 7y ago
      Which carrier is that?
cortesoft 7y ago
Use a different financial institution

TheChaplain 7y ago

I wish Google, Twitter et al would listen to this, but alas...

neuralspark 7y ago
Google offers 2FA using TOTP, and has for several years.
- sneak 7y ago
  And U2F tokens, which are even better than TOTP as they are immune to phishing. TOTP codes can be and commonly are phished. U2F is the current state of the art for 2FA. App/Device-based 2fa (krypton, Google App’s “approve on other device”, authy’s “approve on other device”, keybase, et c) are second. TOTP is in a lot of ways more trouble than it is worth.
  - codedokode 7y ago
    Also physical tokens can be easier to use if the support for them is built into OS and doesn't require installing or configuring additional software.
jdeibele 7y ago
At least Google allows you to turn off SMS as a "2FA" source. You can set up Google Authenticator (or Authy) and a Yubikey as 2FA sources, then remove your phone number. Much to my surprise, I was able to do this with PayPal where I set up two Symantec VIP Access IDs and was able to remove the phone number. I wish I could do this with other accounts.

debatem1 7y ago

Not to mention the fact that the carrier can perform these attacks quite easily, as can the governments who have historically found ISPs willing partners. If you have any reason to believe that you might be the subject of a targeted attack, do not use SMS as a second factor!

ohazi 7y ago

Many services will happily send an SMS account recovery/reset link regardless of how vehemently we refuse to use SMS-based two-factor auth. An attacker can call support, give them plausibly correct information gleaned from public sources, and nicely claim to have forgotten the answers to your recovery questions ("Oh, it might have been a jumble of letters and numbers... silly me..."). There are enough incorrectly trained support people who will let this through to make the tactic effective on average. Your point is obviously correct, but everything is so hopelessly broken that it almost doesn't matter in practice.

puzzlingcaptcha 7y ago

>Number porting is a huge and easily performed attack vector, it requires very, very little information Does it need to be? Seems most of it could be avoided if the cellular service required a visit at the store with an ID card to clone a SIM card.

PeterisP 7y ago
... which is how it actually works in many countries. In USA "something you know" is enough to impersonate you, elsewhere you'd actually show up with a good quality forgery of passport or gov't ID card, which would cost you more than you might steal from a random person. Since USA has this "root of trust" problem, it's also unreasonably easy to obtain fake USA IDs since you (again) can impersonate people simply with "something you know" even for the purposes of obtaining legitimate IDs. It's not so easy elsewhere (e.g. if you claim you're me and have lost all ID, they'd just check biometrics before reissuing ID). Proper checks of IDs (+ verification of lost&stolen IDs databases) can ensure that identity theft cases are very rare. The identity theft epidemic isn't general worldwide, it's mostly a regional issue specific to USA and some similar countries.