4 ms·

In addition to letting you read someone's location, SS7 lets you intercept their SMS messages. This is used by, for instance, criminal groups to intercept 2fa c

In addition to letting you read someone's location, SS7 lets you intercept their SMS messages. This is used by, for instance, criminal groups to intercept 2fa codes or go through SMS-based password reset flows and log into peoples' bank accounts: https://www.vice.com/en_us/article/mbzvxv/criminals-hackers-ss7-uk-banks-metro-bank https://www.vice.com/en_us/article/mbzvxv/criminals-hackers-...

vbezhenar 7y ago
Almost everyone have a smartphone. Bank app is much more secure than SMS, because HTTPS allows to encrypt information all the way from bank server to the end device. It's possible to create a much more pleasant UI with single touch rather than typing that OTP. And it's even possible to create more secure solution by requiring fingerprint. And if Apple and Google would implement some kind of universal solution, every website could utilize this technology making 2FA more secure and usable. It's kind of strange that we're still using SMS so widely. Also SMS is not that cheap, while push is free. Sure, SMS is fine as a fallback option, just like voice call is fine as a fallback option for SMS, but that's about it.
- tehlike 7y ago
  It's getting more ubiquitous with touch id. At least in the common case.
- snazz 7y ago
  Sign In with Apple and Google’s equivalent are supposed to be the solution to both passwords and 2FA.
- closeparen 7y ago
  Are there any US consumer bank accounts that can be configured for 2FA other than SMS? In the brokerage space, Robinhood accepts TOTP and Fidelity accepts Symantec VIP (proprietary TOTP-alike). But I don't know of any checking or savings accounts that can be protected this way.
  - RandomBacon 7y ago
    USAA
    - cvwright 7y ago
      Ugh, USAA's 2-factor solution is such a pain in the butt. You can get a login token from their mobile app, but it's not very easy to find. I really wish they would just support U2F or FIDO.
  - T3OU-736 7y ago
    Wells Fargo supports RSA tokens. The HW ones. TOTP or similar? Not so much, sadly. https://twofactorauth.org/ https://twofactorauth.org/ is actually quite decent at tracking that sort of stuff
  - js2 7y ago
    FYI, you can use this utility to get the Symantec TOTP code into a standard TOTP program like Authy or Google Authenticator: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
    - closeparen 7y ago
      Woah, interesting! I thought TOTP used a shared secret rather than asymmetric encryption. The only thing I had to give Fidelity was the credential ID. Is that enough to generate or verify codes? It does that require key material that only Symantec has?
      - js2 7y ago
        This blog post explains how it works: https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/ https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... But yes, the original author extracted a pair of shared secrets from the Symantec executable.
  - mikem170 7y ago
- tinus_hn 7y ago
  Using SMS only as a fallback option is useless because the authentication chain is only as strong as the weakest link. Bank apps need to be easy to reset if you lose your phone but if you can do that just by receiving an SMS, or by entering a password you can reset using SMS, the system is easily broken.
segfaultbuserr 7y ago
Also, a daily reminder that NIST has declared in 2016 that SMS is insecure and it's not acceptable to use SMS for 2FA. https://news.ycombinator.com/item?id=12163046 https://news.ycombinator.com/item?id=12163046

vbezhenar 7y ago

Almost everyone have a smartphone. Bank app is much more secure than SMS, because HTTPS allows to encrypt information all the way from bank server to the end device. It's possible to create a much more pleasant UI with single touch rather than typing that OTP. And it's even possible to create more secure solution by requiring fingerprint. And if Apple and Google would implement some kind of universal solution, every website could utilize this technology making 2FA more secure and usable. It's kind of strange that we're still using SMS so widely. Also SMS is not that cheap, while push is free. Sure, SMS is fine as a fallback option, just like voice call is fine as a fallback option for SMS, but that's about it.

tehlike 7y ago
It's getting more ubiquitous with touch id. At least in the common case.
snazz 7y ago
Sign In with Apple and Google’s equivalent are supposed to be the solution to both passwords and 2FA.
closeparen 7y ago
Are there any US consumer bank accounts that can be configured for 2FA other than SMS? In the brokerage space, Robinhood accepts TOTP and Fidelity accepts Symantec VIP (proprietary TOTP-alike). But I don't know of any checking or savings accounts that can be protected this way.
- RandomBacon 7y ago
  USAA
  - cvwright 7y ago
    Ugh, USAA's 2-factor solution is such a pain in the butt. You can get a login token from their mobile app, but it's not very easy to find. I really wish they would just support U2F or FIDO.
- T3OU-736 7y ago
  Wells Fargo supports RSA tokens. The HW ones. TOTP or similar? Not so much, sadly. https://twofactorauth.org/ https://twofactorauth.org/ is actually quite decent at tracking that sort of stuff
- js2 7y ago
  FYI, you can use this utility to get the Symantec TOTP code into a standard TOTP program like Authy or Google Authenticator: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
  - closeparen 7y ago
    Woah, interesting! I thought TOTP used a shared secret rather than asymmetric encryption. The only thing I had to give Fidelity was the credential ID. Is that enough to generate or verify codes? It does that require key material that only Symantec has?
    - js2 7y ago
      This blog post explains how it works: https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/ https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... But yes, the original author extracted a pair of shared secrets from the Symantec executable.
- mikem170 7y ago
tinus_hn 7y ago
Using SMS only as a fallback option is useless because the authentication chain is only as strong as the weakest link. Bank apps need to be easy to reset if you lose your phone but if you can do that just by receiving an SMS, or by entering a password you can reset using SMS, the system is easily broken.

segfaultbuserr 7y ago

Also, a daily reminder that NIST has declared in 2016 that SMS is insecure and it's not acceptable to use SMS for 2FA. https://news.ycombinator.com/item?id=12163046 https://news.ycombinator.com/item?id=12163046