3 ms·
>While SS7 does seem like a problem, I think the bigger issue is using SMS for 2FA. These are banks. It took them over a decade to only finally implement SMS 2
by delfinom 6y ago
>While SS7 does seem like a problem, I think the bigger issue is using SMS for 2FA.
These are banks. It took them over a decade to only finally implement SMS 2FA.
It'll be another 2 before they implement U2F or TOTP.
Actually, shockingly, Vanguard offers U2F support which is quite the minority for financial firms :D
Meanwhile american express still makes passwords case insensitive AND trims the fucking lengths behind the scenes.
- the-dude 6y agoThese are US Banks. In the meantime, I have been banking with a 'calculator' for over 15 years which accepts my bank card, I enter the PIN and it spits out a code.
- TheRealPomax 6y agoSame, except rather than "typing in the challenge number" it has an image sensor that I point at my bank's login page after typing in my account and card number, because it generates a 50x50 RGB challenge image.
- the-dude 6y agoI have one of those too ( different bank ) and it sucks because it does not play well with F.lux.
- ericbarrett 6y agoIf you've got a keyboard, I believe you can use Alt+End to temporarily disable f.lux, rather than having to clicky-click-click through the taskbar menus. Doesn't work on a laptop, though. (Might only work on Windows as well.)
- signal11 6y ago> These are banks. It took them over a decade to only finally implement SMS 2FA. A lot of the slowness is driven by regulation and especially the slow decision-making that leads up to regulation. In the UK for example, I cannot think of a single bank that uses SMS as a 2FA channel for internet banking. Some card providers (Amex for instance) do currently provide one time codes for card purchases via SMS, in an attempt to be compliant with PSD2’s Strong Customer Authentication (SCA) rules, but I suspect this’ll change soon because the EBA has already indicated that SMS based SCA is not acceptable[1]. It’s worth remembering that ultimately, SCA or not, banks and do bear liability for fraud not due to the customer’s negligence (in the UK at least), so that’s the ultimate backstop to whatever tech they choose to deploy. [1] https://www.ensygnia.com/blog/2019/7/11/sca-otc-not-ok-says-eba https://www.ensygnia.com/blog/2019/7/11/sca-otc-not-ok-says-...
- mindslight 6y agoSlowness is not an excuse if you're going in the wrong direction. SMS "2FA" is a crutch that has allowed the banks to limp along with their antiquated security model still based around the concept of trusting people who physically show up at a branch. Banks should have never implemented SMS "2FA". If a system cannot provide a security guarantee, you don't implement it anyway and then pretend that it does.
- mschuster91 6y agoBack over ten years ago when my bank first supported 2FA via SMS, SS7 attacks were something for professionals/nation states only. These days it's commoditized, that is what changed.
- asdff 6y agoWhat about just plain old social engineering? Get a hold of someones phone, and that 2 factor authentication becomes 1 factor. This sort of thing is not that hard in a world where college students routinely leave all their crap out in the library. Duo and all the other 2 factor methods are such jokes. I worked in a hospital that used duo for everything from logging into your workstation to accessing the intranet. Many people had duo set to call their office phone 6 inches from their computer. All someone would have to do is sit down in that desk for 10 minutes, lift the handset and press '1,' and have a field day on protected patient data.
- mindslight 6y agoThis sounds akin to the handwaving of "that exploit is only hypothetical" that necessitated full disclosure. The eventual democratization of SS7-based attacks was entirely foreseeable. If I were to use plaintext http to access a bank website today, I would be reasonably confident that there would be no immediate problem. But given a year or two of this practice being normalized, the market would find ways to infiltrate consumer ISPs, the bank's upstream, hijack routing prefixes and DNS, etc. And what are text messages but a similar non-e2e protocol? The chief difficulty seems to be that telco standards are hidden away and obscured by horrible complexity, rather than being published as straightforward RFCs.
- bruckie 6y agoGoogle uses Vanguard for its retirement plans, and I suspect (but don't know for sure) that they may have leaned on Vanguard to implement U2F.