4 ms·

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and goo

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to backing it up? You cannot prove you are you and so customer support cannot help you. Google, Microsoft, and Apple are not known for helping consumers get themselves out of this catch-22. It is a mistake to ask consumers to protect, backup, and secure their digital lives themselves. Consumers don't have the time or skills to keep up with the hackers. If Apple, Google, ATT, Verizon etc. cannot provide digital security, this is an opportunity for someone else to step in. My personal suggestion is this is a ripe opportunity for someone like the US Post Office or Department of Motor Vehicles. Consumers would go to the US Post Office or DMV and purchase a Yubi key from them. The additional value they add, is they can verify the identity of the consumers who is purchasing the Yubi key and replace the key if it is lost/stolen. Similar to how they process driver licenses or passports. This service is optional and would actually cost money. I would gladly pay a monthly fee for this peace of mind.

spicybright 5y ago
Absolutely this, but the service should act like a driver's license if you want people to actually use it. Pay some $ for the key, renew it every 2 years for a fee, pay for a replacement if needed. No one wants another monthly fee, taxes should keep the infra up like any other license.
danieljacksonno 5y ago
We have something vaguely similar with "BankID" in Norway. It's a bank issued digital ID that submits a 2FA to your phone (not through SMS, but through some other system that takes over the whole screen - not sure what it is). It's usable for almost all government agencies or official stuff online here, but I haven't seen anyone use it for third party auth as it costs roughly 10 cents per login for the service using it.
- srhngpr 5y ago
  This has been rolled out and in use in British Columbia, Canada as well. We have a digital ID app for iOS and Android, which you verify your ID with first, then for government sites (e.g., health records), you login through this app instead - there are no emails, usernames, or passwords involved.
- CapsAdmin 5y ago
  From a usability standpoint it's not very good though. The experience differs from phone to phone and it kinda feels like a hack from a programmers point of view. In Norway, Sparebank1 is pushing an app to get one-time codes now. I wonder if we'll see more of these in the future? I use the Microsoft authenticator to get access to my Microsoft work account. I bet if everyone starts making their own apps for one-time codes EU will demand a single app to do all of this.
- Extigy 5y ago
  >not through SMS, but through some other system that takes over the whole screen - not sure what it is This sounds like it might be a so-called “flash” SMS. https://en.wikipedia.org/wiki/SMS#Flash_SMS https://en.wikipedia.org/wiki/SMS#Flash_SMS
baybal2 5y ago
> As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling It is 100% insecure, and been exploited for nearly a decade. 1. Anybody with access to raw SS7 network can basically click a finger, and have you traffic rerouted 2. GSM interception gear is widely available The person who invented "SMS verification" was a round idiot
jrochkind1 5y ago
> As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling Uh... what does (in)secure mean to you?
- bkdbkd 5y ago
  exactly. "its not that the lock is insecure, its just that sometimes thieves figure out how to make keys."
  - rawgabbit 5y ago
    What I mean is that if thieves can defeat the lock on my door, it doesn’t mean my door lock is worthless. I still lock my door but I don’t rely on it exclusively for protection.
unethical_ban 5y ago
I only use 2FA if the service provides me with backup codes that I can put in my password safe, which has a unique, long password that is stored and backed up in several places. If there is not a self-service recovery option for me losing my phone, I won't use it. --- FWIW I keep a copy on my desktop and on my phone (Keepass) and sync them every few weeks. I try not to add new passwords to my phone copy in order to keep things simple, but Keepass can do diffs and merges. "But if your safe is owned, then all your accounts are owned!" Yes, that's the balance I take. If someone is able to get my safe and use my bio auth on the phone OR otherwise crack it, I'm screwed.
matheusmoreira 5y ago
> Consumers would go to the US Post Office or DMV and purchase a Yubi key from them. > The additional value they add, is they can verify the identity of the consumers who is purchasing the Yubi key and replace the key if it is lost/stolen. This is exactly how digital signatures work in my country. A government institution vouches for digital certificate companies which verify and certify people's identities. It can be used to file taxes and lawsuits, for example. To most people this is just yet another layer of bureaucracy.

spicybright 5y ago

Absolutely this, but the service should act like a driver's license if you want people to actually use it. Pay some $ for the key, renew it every 2 years for a fee, pay for a replacement if needed. No one wants another monthly fee, taxes should keep the infra up like any other license.

danieljacksonno 5y ago

We have something vaguely similar with "BankID" in Norway. It's a bank issued digital ID that submits a 2FA to your phone (not through SMS, but through some other system that takes over the whole screen - not sure what it is). It's usable for almost all government agencies or official stuff online here, but I haven't seen anyone use it for third party auth as it costs roughly 10 cents per login for the service using it.

srhngpr 5y ago
This has been rolled out and in use in British Columbia, Canada as well. We have a digital ID app for iOS and Android, which you verify your ID with first, then for government sites (e.g., health records), you login through this app instead - there are no emails, usernames, or passwords involved.
CapsAdmin 5y ago
From a usability standpoint it's not very good though. The experience differs from phone to phone and it kinda feels like a hack from a programmers point of view. In Norway, Sparebank1 is pushing an app to get one-time codes now. I wonder if we'll see more of these in the future? I use the Microsoft authenticator to get access to my Microsoft work account. I bet if everyone starts making their own apps for one-time codes EU will demand a single app to do all of this.
Extigy 5y ago
>not through SMS, but through some other system that takes over the whole screen - not sure what it is This sounds like it might be a so-called “flash” SMS. https://en.wikipedia.org/wiki/SMS#Flash_SMS https://en.wikipedia.org/wiki/SMS#Flash_SMS

baybal2 5y ago

> As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling It is 100% insecure, and been exploited for nearly a decade. 1. Anybody with access to raw SS7 network can basically click a finger, and have you traffic rerouted 2. GSM interception gear is widely available The person who invented "SMS verification" was a round idiot

jrochkind1 5y ago

> As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling Uh... what does (in)secure mean to you?

bkdbkd 5y ago
exactly. "its not that the lock is insecure, its just that sometimes thieves figure out how to make keys."
- rawgabbit 5y ago
  What I mean is that if thieves can defeat the lock on my door, it doesn’t mean my door lock is worthless. I still lock my door but I don’t rely on it exclusively for protection.

unethical_ban 5y ago

I only use 2FA if the service provides me with backup codes that I can put in my password safe, which has a unique, long password that is stored and backed up in several places. If there is not a self-service recovery option for me losing my phone, I won't use it. --- FWIW I keep a copy on my desktop and on my phone (Keepass) and sync them every few weeks. I try not to add new passwords to my phone copy in order to keep things simple, but Keepass can do diffs and merges. "But if your safe is owned, then all your accounts are owned!" Yes, that's the balance I take. If someone is able to get my safe and use my bio auth on the phone OR otherwise crack it, I'm screwed.

matheusmoreira 5y ago

> Consumers would go to the US Post Office or DMV and purchase a Yubi key from them. > The additional value they add, is they can verify the identity of the consumers who is purchasing the Yubi key and replace the key if it is lost/stolen. This is exactly how digital signatures work in my country. A government institution vouches for digital certificate companies which verify and certify people's identities. It can be used to file taxes and lawsuits, for example. To most people this is just yet another layer of bureaucracy.