7 ms·

This is a deep violation that makes every user of 2fa _unsafe_. A mere $250 million? This needs to be the kind of violation that endangers the company. It's not

This is a deep violation that makes every user of 2fa _unsafe_. A mere $250 million? This needs to be the kind of violation that endangers the company. It's not a mistake or honest error when 2fa phone numbers are used for advertising. This is malicious. Should be scaled to 100X the amount the company gained in advertising for the violation.

noscrewstoyous 6y ago
You shouldn’t use a phone number for 2fa to begin with, you’d be better off without 2fa if that’s the only option IMO (assuming you’re using a strong unique password). This is just more fuel on that fire.
- diabeetusman 6y ago
  2FA with SMS protects against password reuse or leaks. It's my understanding that SMS is weak against attacks targeted at particular people while being sufficiently strong for the majority of cases.
  - thephyber 6y ago
    SS7 attacks scale better. SIM cloning is a lot of effort just to compromise a single SMS number. In general, SMS is better than no 2FA, but it's weaker than OTP/OTH or a token like YubiKey or Titan.
- moscovium 6y ago
  Remember when Jack Dorsey had his SIM attacked for the 2fa?
- t-writescode 6y ago
  Wouldn’t a phone-based 2FA also give you the knowledge that someone’s trying to log in? Can the SMS message somehow not be sent to all users on the network with your phone number?
- geofft 6y ago
  Not sure I follow "You'd be better off without 2FA" (unless you're counting the use of the number for advertising) - it's weak, but it doesn't introduce additional vulnerabilities. And IIRC at the time Twitter didn't offer any other 2FA mechanisms.
  - noscrewstoyous 6y ago
    it’s a false sense of security
- VibrantClarity 6y ago
  Twitter didn't give me a choice when I made an account, it forced me to give them an email and a phone number.
amznthrwaway 6y ago
1) it doesn't make every user of 2fa unsafe. Don't be absurd.* 2) $250MM is 10% of their annual revenue. That's extremely meaningful. If you want an example of an overly light fine, this is not it. * yes, I know that you will argue, in bad faith, using some absurd definition of the word 'unsafe', but it simply isn't the case. unsafe is what happens in places (like HN) where the moderators welcome white supremacists and other people who want to exterminate a portion of the population. unsafe is not an unwanted text ad.
Silhouette 6y ago
This is a deep violation that makes every user of 2fa _unsafe_. It's certainly a violation of trust that could make people less likely to volunteer extra information for 2FA that could be used against them, even if it might also make them safer. For that alone, wilful violations ought to be treated as a serious breach under data protection laws. The number of important financial services I use that now insist on phone numbers for 2FA is getting irritating, too. Apparently in some cases it's been prompted by the changes in EU rules under PSD2, but as with almost everything else I've come across so far under PSD2, I'm not sure how much safer it will really make anyone. At least those financial services -- and my government, which is the other organisation I see doing this routinely now -- probably aren't going to use the contact information for anything other than the 2FA they claim, though.
WrtCdEvrydy 6y ago
Should be 1 million per user per text message sent out. Trust me, if our agencies had teeth, and executed a corporation for shit like this, we'd have a better technology ecosystem.
- edmundsauto 6y ago
  Similarly, if we executed every criminal who is convicted of a violent crime, we would have far fewer violent criminals.
  - WrtCdEvrydy 6y ago
    I'd argue if you take data and misuse it for profit, you should get a higher danger than a slap on the wrist.
1vuio0pswjnm7 6y ago
I don't have the citation but I recall a researcher who was studying this practice. He suggests that these requests for "factors" will continue to escalate to the point of absurdity. The sales pitch to the user is essentially "The more we know about you, the more we can protect you." However, if the user is seeking protection from others who are trying to discover her personal details, then this continual "full disclosure" to each tech company is counterproductive. This sort of nonsensical reasoning has also used by individuals portraying themselves as "whitehats" who try to profit from large leaks of personal data. Users are asked to provide personal data to the whitehat in order to confirm whether their personal data has been leaked.
vmception 6y ago
I report every social media company that only offers SMS 2FA. They obviously have enough engineers and awareness to do software based OTP, and clearly only want SMS for their phone number social graph and data brokering operation. So, LOL FTC.
m-p-3 6y ago
On another note, SMS 2FA needs to stop being a thing. Telcos and their systems can't be trusted if all it takes is someone to hijack or intercept your phone number and texts.

noscrewstoyous 6y ago

You shouldn’t use a phone number for 2fa to begin with, you’d be better off without 2fa if that’s the only option IMO (assuming you’re using a strong unique password). This is just more fuel on that fire.

diabeetusman 6y ago
2FA with SMS protects against password reuse or leaks. It's my understanding that SMS is weak against attacks targeted at particular people while being sufficiently strong for the majority of cases.
- thephyber 6y ago
  SS7 attacks scale better. SIM cloning is a lot of effort just to compromise a single SMS number. In general, SMS is better than no 2FA, but it's weaker than OTP/OTH or a token like YubiKey or Titan.
moscovium 6y ago
Remember when Jack Dorsey had his SIM attacked for the 2fa?
t-writescode 6y ago
Wouldn’t a phone-based 2FA also give you the knowledge that someone’s trying to log in? Can the SMS message somehow not be sent to all users on the network with your phone number?
geofft 6y ago
Not sure I follow "You'd be better off without 2FA" (unless you're counting the use of the number for advertising) - it's weak, but it doesn't introduce additional vulnerabilities. And IIRC at the time Twitter didn't offer any other 2FA mechanisms.
- noscrewstoyous 6y ago
  it’s a false sense of security
VibrantClarity 6y ago
Twitter didn't give me a choice when I made an account, it forced me to give them an email and a phone number.

amznthrwaway 6y ago

1) it doesn't make every user of 2fa unsafe. Don't be absurd.* 2) $250MM is 10% of their annual revenue. That's extremely meaningful. If you want an example of an overly light fine, this is not it. * yes, I know that you will argue, in bad faith, using some absurd definition of the word 'unsafe', but it simply isn't the case. unsafe is what happens in places (like HN) where the moderators welcome white supremacists and other people who want to exterminate a portion of the population. unsafe is not an unwanted text ad.

Silhouette 6y ago

This is a deep violation that makes every user of 2fa _unsafe_. It's certainly a violation of trust that could make people less likely to volunteer extra information for 2FA that could be used against them, even if it might also make them safer. For that alone, wilful violations ought to be treated as a serious breach under data protection laws. The number of important financial services I use that now insist on phone numbers for 2FA is getting irritating, too. Apparently in some cases it's been prompted by the changes in EU rules under PSD2, but as with almost everything else I've come across so far under PSD2, I'm not sure how much safer it will really make anyone. At least those financial services -- and my government, which is the other organisation I see doing this routinely now -- probably aren't going to use the contact information for anything other than the 2FA they claim, though.

WrtCdEvrydy 6y ago

Should be 1 million per user per text message sent out. Trust me, if our agencies had teeth, and executed a corporation for shit like this, we'd have a better technology ecosystem.

edmundsauto 6y ago
Similarly, if we executed every criminal who is convicted of a violent crime, we would have far fewer violent criminals.
- WrtCdEvrydy 6y ago
  I'd argue if you take data and misuse it for profit, you should get a higher danger than a slap on the wrist.

1vuio0pswjnm7 6y ago

I don't have the citation but I recall a researcher who was studying this practice. He suggests that these requests for "factors" will continue to escalate to the point of absurdity. The sales pitch to the user is essentially "The more we know about you, the more we can protect you." However, if the user is seeking protection from others who are trying to discover her personal details, then this continual "full disclosure" to each tech company is counterproductive. This sort of nonsensical reasoning has also used by individuals portraying themselves as "whitehats" who try to profit from large leaks of personal data. Users are asked to provide personal data to the whitehat in order to confirm whether their personal data has been leaked.

vmception 6y ago

I report every social media company that only offers SMS 2FA. They obviously have enough engineers and awareness to do software based OTP, and clearly only want SMS for their phone number social graph and data brokering operation. So, LOL FTC.

m-p-3 6y ago

On another note, SMS 2FA needs to stop being a thing. Telcos and their systems can't be trusted if all it takes is someone to hijack or intercept your phone number and texts.