4 ms·
> But the data also contained sensitive text messages, such as two-factor codes and other security messages, which may have allowed anyone viewing the data to g
by threatofrain 7y ago
> But the data also contained sensitive text messages, such as two-factor codes and other security messages, which may have allowed anyone viewing the data to gain access to a person’s online accounts. Many of the messages we reviewed contained codes to access online medical services to obtain, and password reset and login codes for sites including Facebook and Google accounts.
> The data also contained usernames and passwords of TrueDialog’s customers, which if used could have been used to access and impersonate their accounts.
- retSava 7y agoHence why 2FA tokens and reset links should have a short window of validity, and why shallow information such as knowing account name, or address, or mothers maiden name, should not be used for sensitive purposes.
- faeyanpiraat 7y agoIt is considered a security best practice to use a 2fa app (like Authy), or a physical token instead of SMS. This way when the token generator is lost you at least notice it in a reasonable timeframe. For critical systems where 2fa is enabled I also do a "simulated" device loss, where I go trough all the steps at least once that I would have to do in case of a real device loss (fetching backup codes, revoking token, resetting password, adding new token). This way I do not have to constantly worry about losing critical items, because I'm prepared for the worst and I can be calm. It also helps to have all your data encrypted at rest with Bitlocker or Veracrypt (hard to enforce this rule on yourself for pendrives, but oh well..).
- teel 7y agoThanks! That (simulated device loss followed by all the steps you mentioned) is something I plan to do every now and then but so far I've never gotten around to actually doing it. Encouraged by your post think I'll finally do it (some day, hopefully sooner rather than later).
- threatofrain 7y agoThis brings up some interesting technical questions: how long is too long and what is a deep question for identity?
- a3n 7y agoYour imaginary friend's mother's maiden name.
- blowski 7y agoWhich also happens to be an extremely rare maiden name - i.e. not Smith but "Vortangula" or "Brinderbass".
- pavel_lishin 7y ago> Vortangula Brinderbass Thank you for the new D&D character name.
- theshadowknows 7y agoOne time I did a "forgot password" reset on an old email account. Apparently young me thought it was a good idea to choose the 'pick your own question' thing and the question I chose was "What?" ...to this day I still don't remember what the answer was.
- dpeck 7y agoDepending on how young, there’s a decent chance the answer was some variation of “chicken butt”
- wkearney99 7y agoI have an 11 year old. You're sooo right about the chance that's it...
- theshadowknows 7y ago
- tinus_hn 7y agoHence why SMS is not a valid part of any authentication system that should be secure.
- ga-vu 7y agoThis article massively overhypes the breach. 2FA and password resets have a very short window of validity. The database contained historical messages and did not operate in real-time.
- pmorici 7y agoHow do you know it didn’t operate in real-time? The article doesn’t contain enough information to know.
- threatofrain 7y agoIf it wasn’t real time then how would short lived auth solutions even work?
- epanchin 7y agoI understand they mean the database
- nkrisc 7y agoPerhaps, but you're also making a lot of assumptions about the security practices of companies that send you info via SMS.
- eganist 7y agoTo your point: I can count on two hands the number of companies I've encountered that iterate HOTP on use rather than on issuance. ...which means there are bound to be a few stale but still active SMS codes lingering in there from people who attempted but did not complete authentication e.g. because they entered the wrong number or didn't have access to the number they attempted to use when signing in. Services impacted are any which allow for users to authenticate with _just_ SMS HOTP and which don't expire unused codes. That number is unfortunately high enough for me to think that this is equatable to a small credential breach.