7 ms·
Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social eng
by GhostVII 7y ago
Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA.
Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? I don't really see a scenario where it makes sense to have per-IP rate limiting here. I guess they are probably just using the rate limiting features which are built in to whatever framework Instagram is using for their API.
- pmarreck 7y agoI have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself
- shawabawa3 7y agoyou should be aware that Authy can by default be taken over with just your sim card. I believe with the right settings you can disable this behaviour
- zwily 7y agoYes, you have to disable “multiple devices”. You just have to remember to re-enable it if you want to install Authy on a new phone and reinstall from backup.
- claviola 7y agoI've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.
- filoleg 7y agoI've been using Google Voice for that purpose for years, and it has been perfect. The phone number that is for 2FA only, shouldn't be as easy to social engineer your typical telcom, since it is all controlled from within my Google account, and I get immediate security notifications if something fishy is up.
- oarsinsync 7y agoThat's a great plan, and it definitely reduces your risk to being exposed to SIM hijacking. Unfortunately, I suspect services that enforce poor security standards are probably not following best practices in their backend either. This means your secret number stops being secret if their database ever leaks. It's still better than using the same number as you use for everything else, but it's important to understand the caveats.
- kalleboo 7y agoThis is standard practice for public figures like YouTubers who often get griefed
- oarsinsync 7y ago> Google 2FA via Authy "Google 2FA" is TOTP, an open standard, not a Google produced solution. https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
- pmarreck 7y agoThanks for the clarification. I knew it was open-source, didn't realize it was an RFC.
- CPLX 7y ago> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong. Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.
- zrobotics 7y agoLikely this is to prevent malicious attempts to block access to an account- I can definitely imagine someone trying to block a popular account by abusing the password reset mechanism. Imagine attempting to reset a password of a popular account by spamming the p/W reset mechanism, if the limit is per-account instead of per-IP then you could fairly easily deny access to any account.
- ttsda 7y agoHow would you be denying access? The block is only by the password reset system, if you know the password you can still access your account.
- hwstack 7y agoHe didn't really explain it, but I think what was going on is the rate limiting is done per account, and the race condition was a way to circumvent that. He has to make all the requests very quickly because the first thing all the requests are doing is determining if new requests for this account should be ignored. All the requests are received around the same time, they all make this check and decide they are valid requests, then they all report that an attempt was made for that account (locking it). The rate limiting for IPs is probably global (not related to the reset endpoint).
- yardstick 7y agoI think you are dead on, yeah it’s the quick rate of large numbers of requests that avoid the per-account rate limiting. Curious how they resolved this— run all authentication requests for a given user serially and in a consolidated fashion at some point. Exclusive lock the relevant db record before checking the code and recording the failure?
- dahfizz 7y ago> Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? This could makes it very easy to perform a DOS attack against a user. You could constantly send failed attempts and make it impossible for the user to type in the real code before you invalidate it.
- ummonk 7y agoAdd a captcha then.
- rwmj 7y agoAlso for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use. Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies on the phone companies' own systems which are (predictably) insecure.
- spullara 7y agoA lot of carriers support wifi calling. You should see if yours done and turn it on.
- jen729w 7y agoI still don’t think an actual SMS would be received. SMS is old-school. That thing is going via the tower or it’s not going at all. (This is just a hunch. Happy to be told I’m wrong!)
- wiml 7y agoMy understanding is that "WiFi Calling" involves having your phone set up an IPsec tunnel (authenticated by your SIM) with your carrier, and then transferring essentially the same packets over that as would be transferred to the cell tower. I think that includes SMS traffic along with everything else. (IIRC, the 3G and LTE versions of the tunnel carry traffic at different layers of the protocol stack, but in both cases being able to handle SMS and similar non-Internet features is part of the goal. As is being able to handoff between wifi and cellular transports in the middle of a call — I have no idea how well that works in practice.)
- spullara 7y agoSMS will be received. It is just like being on the normal cell network.
- robin_reala 7y agoSome Verify providers have a provision for token based 2FA. I used the Post Office for my account with standard TOTP.
- mncolinlee 7y agoThe first type of attack that should come to mind with SMS-based 2FA is SIM cloning. Identity question answers can be purchased off the dark web from previous leaks. Also, social engineering is notoriously effective against several of the top carriers, who lack effective identity validation. Lives have been ruined.
- gjs278 7y agoI was the victim of a sim port just last night. they tried to get into my coinbase.
- ridaj 7y agoI used to work at a cell phone company. One day I needed to change my SIM card so I call up the help desk : "Hi I have a new SIM card, can you please activate it? — Sure what's your number and IMSI? — My number is ..., the IMSI is ... — OK done" And so, just like that, I took over someone else's phone number. Not on purpose, but the guy made a mistake punching in my number, didn't verify my identity, and ended up assigning someone else's phone number to my SIM card. I called the guy back after realizing that I wasn't getting calls and that the people I called thought I now had a new number. Granted it was a while ago but the experience gave me a very low opinion of SMS for 2FA.
- tripzilch 7y agoFriend of mine walked into a mobile phone store to do pretty much the same thing and he was also extremely surprised that they didn't ask for any extra info or ID. He did get the correct number, though :)