12 ms·
> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA.
by madars 5y ago
> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception.
I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.com.totallylegit.ru and then have them enter it on real accounts.google.com. This is so because the U2F/WebAuthn security key signs a request, sent by your browser, which embeds the requesting page's domain, so a signature on attacker.com will not pass victim.com's verification checks, whereas a code from your authentication app is trivially copied.
- Scaevolus 5y agoBeating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing-- like in the post where he lost his account while asleep.
- only_as_i_fall 5y agoHow does an sms hijacking attack typically work? I know sms isn't secure, but how does one go from having a password to bypassing the sms confirmation? Is it as easy as having the number and carrier?
- cinntaile 5y agoDon't they just hijack your number with the help of the telecom company's helpdesk?
- ImuMotive 5y agoIt happened to me. Cellular carriers, in my case T-Mobile, didn't require any confirmation to port a number to a new phone/sim. Eventually some required the last 4 of your social security number to port a number, which we all know at this point are pretty much public anyway. T-Mobile now lets you set an arbitrary pin, which my parents promptly set to their DOB :facepalm: I haven't looked more into it, but as far as I know, sim swap/port attacks were hilariously simple to execute which is why I only use SMS verification when it's the only option.
- deleted 5y ago[deleted]
- Wowfunhappy 5y agoYou might want to edit out what your parents set their pin to! (You can email hn@ycombinator.com if you're past the edit window.)
- ImuMotive 5y agoLol, I had made them change it as soon as they told me.
- deleted 5y ago[deleted]
- joshuaissac 5y agoMaybe what is needed is regulation that makes the service provider liable (with no option to disclaim it) for all damages suffered by the victim if the provider gives away their phone number to an attacker.
- scrose 5y agoI accidentally ‘hijacked’ a number by typoing one number in my online request. I only found out after my wife pointed out my number was different after porting. It took a couple hours with the telco’s support agents, and practically no verification steps, to actually get my correct number back. Very sad state of affairs here.
- cinntaile 5y agoGoogle is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- pinum 5y ago“If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify that it’s you and restore your access.” I trust that it would be (potentially much) harder than normal, but it still seems to be possible.
- cinntaile 5y agoI was under the impression you were screwed in that case, thanks for pointing out that I was wrong. It's lot less secure than I thought.
- withinboredom 5y agoIIRC, Google will stop the "several day process" if you log in at any time.
- someguydave 5y agoStill sounds like a significant barrier to most phishing attacks.
- cinntaile 5y agoA little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.
- hn_throwaway_99 5y ago> Beating 2FA is almost always SMS hijacking That's most definitely not true, as someone who works in this space. Plain old phishing is much more common, where the hacker tricks a user into entering their code into a malicious website. To echo OP, this is why it's important to support non-phishable types of 2FA.
- baxtr 5y agoCould you describe the types that are non-phishable?
- fossuser 5y agoYubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.
- klodolph 5y agoYubiKey uses U2F and FIDO2/WebAuthn. The YubiKey also does a lot of other things, depending on which YubiKey you have... but if you want 2FA on random websites, those are the most likely protocols (used for GitHub and the like). The basic U2F + FIDO2/WebAuthn is the least expensive model, around US$25. These days it works seamlessly on Chrome, Firefox, and Safari.
- laggyluke 5y agoYubikey is actually pretty "phishable", at least in the OTP mode. It will happily put the token into a phishing website (or literally anywhere else) as soon as you touch it. It's also good to know that Yubikey's OTP tokens don't expire based on time, but based on a hidden counter that gets incremented with every issued token. So if you've accidentally touched your Yubikey and leaked the token publicly, you just have to log out and then log back in using your Yubikey - that action will invalidate all tokens issued before this point.
- 5y ago
- mushishi 5y agoHow is it possible that some kind of imaginative script can be enough to get SMS sim swapped? Why aren't the operators requiring a strong identification via a passport or something like that? Maybe I'm really dumb but that just boggles my mind, whether or not there exist other types of alternatives to 2FA.
- Destitute 5y agoThere's not much you can confirm over the phone, except the account PIN and sometimes security hint. But an attacker can pretend to have forgotten it and press that the matter is urgent. If the attacker knows enough about the person, they might be able to convince an agent to make the swap so the agent can: 1) Get on with their day to maybe hit a support request quota 2) Make sure this person doesn't give them a bad customer satisfaction score
- cinntaile 5y agoYou could require verifying your identity using your electronic ID if you want to simswap by calling the helpdesk.
- jdavis703 5y agoThey could require this. Most of the big operators have physical stores where they could do an ID check. There should be an advanced protection mode where SIM swaps and other sensitive operations require physical authentication.
- mushishi 5y agoYes this, please!
- loloquwowndueo 5y agoIt’s probably worth faking having lost your 2FA and asking for it to be reset. If you find out they are this careless with 2FA-protected accounts, you should probably not rely on it too much. I manage an authentication and identity provider and if someone gets locked out of 2FA and can’t prove their identity via a previously-uploaded gpg key, they get locked out for good. I never honor requests to reset the device sent by email, no matter how much they beg or offer to prove identity by sending copies of official IDs - I don’t care who they are now, I care about them being the same person that set up the account and 2FA, which can only be proven via a valid 2FA device or a GPG signature.
- ceejayoz 5y ago> It’s probably worth faking having lost your 2FA and asking for it to be reset. I'm not sure I trust that I'd be as good an attacker as a professional, and there's not a great way to replicate "hang up, call again" approaches likely to work with a big org.
- jokethrowaway 5y agoIt could be worth it to spend the 1.50$ on stripe to do identity verification with id documents for accounts of a certain size, so that they can present those documents again to regain access to their account. Re-enabling the account after a certain period of time without activity would also be a good measure (on top of the id verification).
- xwolfi 5y agoAnd then lose the documents in a big hack so that everyone with a forum access can use your passport copy. yes.
- scrollaway 5y agoThe whole point of using Stripe for it would be not to have the documents in question. Kind of like you don't hear about companies using stripe losing their customers' card numbers.
- InitialLastName 5y agoWouldn't that be obvious to the victim the moment their phone didn't work? Or will the carrier leave the old SIM activated?
- withinboredom 5y agoIIRC, in the US, sometimes just give the old sim some random phone number (to keep you paying the bill) and don't cancel the line. In the EU, I'm pretty sure they cancel the old line.
- wunderwuzzi23 5y agoOld school phishing is the most common MFA bypass. Here is a description how it works: https://github.com/wunderwuzzi23/KoiPhish https://github.com/wunderwuzzi23/KoiPhish Unless you use Yubikeys (webauthn) etc these phishing attacks just continue to work. I do consultancy in this space at times and about 95+% of folks who enter their password will also enter their MFA token.
- hackettma 5y agoFollowed the link and the read me is bit spare on details. For the less technical this still would require the phishee to manually enter credentials which then can be relayed to the attacker. Correct? The article mentions this happened while the author was asleep — any thoughts on how that would work?
- tialaramex 5y agoOne thing that can happen is you get enduring credentials from the OTP sign-in, and they last despite other credentials simultaneously existing elsewhere. I only use Facebook trapped inside Facebook Container in one Firefox on one computer. But my understanding is that it's possible to sign in to Facebook from say a phone and a laptop at the same time, so the bad guys could get you to give them working credentials one day and persist those until you're asleep before using them. If you went to Facebook's security settings "Where you're logged in" and it lists two logins, one in "Paris" while you are in New York, you might realise there's a problem and force them out. But most people likely never look at that, why would they?
- FabHK 5y agoI might be tempted to enter the TOTP, but my browser is unlikely to enter the password, and I definitely won't.
- andybak 5y agoI think the fact that password managers can spot incorrect urls better than users is useful. However I've become numbed to this warning flag by those services that seem to have endless different urls that are all legitimate. (Microsoft being a particular offender here). I can imaging some variant of outlook.microsoft.developer.really.yes.com catching me unawares one day.
- ignoramous 5y ago> ...has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") Isn't this vishing? https://youtu.be/BEHl2lAuWCk https://youtu.be/BEHl2lAuWCk
- xsmasher 5y agoNo; phishing / vishing is contacting the customer to get login details. Contacting support and getting them to circumvent security is social engineering.
- UncleMeat 5y agoAnother poster has mentioned it, but I will add weight. This is super ultra mega wrong. Phishing SMS and TOTP codes is way more common than SIM-swapping. Outrageously so. SIM-swapping does not scale. You need to call up a company each time you want to do it. Yes, it works. But you cannot sell a tool that just automates it. In comparison, there are many off-the-shelf phishing kits that fully automate SMS and TOTP 2FA theft.
- samstave 5y ago>Beating 2FA is almost always SMS hijacking How exactly does this get executed? I'm pretty technical, but I cant fathom exactly how this occurs; You hijack a cell tower, then have some system to listen to un-encrypted SMS traffic?? Plz ELI5
- ev1 5y agoIt's zero cost and zero effort to port someone's number out, or get a new SIM card issued for the existing account. I've worked with a bunch of streamers and YouTubers, and the threat model is such that people have shown up with professionally made printed fake IDs to attempt hijacking in an actual retail carrier store.
- josephcsible 5y agoIt's an attack on humans, not on technology. You trick their phone carrier's employees into thinking that you're them and that you lost your phone. Then you end up with a SIM card assigned to their phone number, so you receive all of their calls and texts instead of them.
- hulitu 5y agoThere is also the ad which runs on the same webpage and reads what you type or your clipboard.
- encryptluks2 5y agoWhat you're describing here isn't exclusive to hardware tokens and nothing preventing software from checking the domain using TOTP.
- madars 5y agoHow? TOTP does not embed the domain, as it is generated on a separate device which does not communicate with your browser, and does not know the target domain. TOTP is literally HMAC(shared-secret, time-interval) mapped to a short range (e.g. mod 10^6).
- encryptluks2 5y ago> it is generated on a separate device which does not communicate with your browser, and does not know the target domain. No, not always and many password manager solutions do integrate with your browser and know the domain for the password.
- madars 5y agoThen that's not TOTP https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238 but something different. Do you know how it is called and which products support it? I'd love to read up about it!
- encryptluks2 5y agoYes, it is TOTP: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- valid_username 5y agoBitwarden has TOTP support in paid plan. And it works with browser extension which recognises domains.
- AkshitGarg 5y ago
- theshadowknows 5y agoFor work things I often have to enter a code from one or another app that expires every few seconds. I've always wondered how exactly that works. Where might I go to find out about that? Is it as straight forward as googling "how two factor authentication works" or is there some other terminology?
- cs2733 5y agoThey're called Timed One-Time Passwords or TOTP and they're one form of 2FA
- nine_k 5y agoYou mean TOTP? Imagine a hash function that generates a number from the number of minutes since epoch hashed additionally with some seed. You have it on the server, you have it on your, say, phone. When you enroll you share a seed for the generator. Since your time is synchronized, the server knows what value(s) to expect, and the phone knows which value to generate. The real scheme is a bit more involved: https://en.m.wikipedia.org/wiki/Time-based_One-Time_Password#Algorithm https://en.m.wikipedia.org/wiki/Time-based_One-Time_Password...
- quadrifoliate 5y agoA simplified and inaccurate version: - You and I share a secret at my first login. Let's say our shared secret is "wibble". - For any subsequent successful login with my username and password, for the second factor I send you the last six digits of the SHA1-hash of ("wibble" XOR current timestamp) - You calculate the second factor yourself as well by doing the same operation (you have stored "wibble" for my username, and know the current timestamp), and verify those last six digits. If they are wrong, I am an attacker! An accurate version: https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238
- quelltext 5y agoI always wondered, doesn't that require the clocks to be synchronized? Like, what happens if I set my phone to a different time? What if the server has lost connectivity to an NTP service and its clock is a few minutes off?
- recursive 5y agoHow is that possible? Codes from authenticator apps I've seen are 6-digit decimal codes. I don't know much about how it works. But I can't see how this is immune from mitm. I pretend to $SERVICE and ask you for your authenticator code. If you fall for it, you'd give me the code, which I can use to impersonate you for the next 30 seconds.
- jeffbee 5y agoThat's why they said you should use U2F, not TOTP.
- recursive 5y agoI'm not aware of the acronyms, but I was responding to this: "a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable" That certainly seems like it's wrong, and doesn't include an acronym other than SMS. But apparently there's more depth to this space than I was aware of.
- krastanov 5y agoYou misread that statement and the excerpt you copied completely changes its meaning if you remove the surrounding. Read it as: "U2F/WebAuthn is secure because it does origin binding which is not phishable, unlike entering a TOTP or a code from your hardware token or authenticator app or SMS" Putting the original parenthetical in between the start and end of the main clause definitely makes it easy to misread. I just moved the parenthetical to the end of the sentence.
- riedel 5y agoI really wonder why typically the default policy is to convert a totp token to a longer lived token (keep browser authorized) defying the whole idea of totp. Used like this it seems like just two passwords or am I missing anything? Phishing seems really easy.
- ianburrell 5y agoU2F/WebAuthn doesn't use six digit codes. You plug in USB key, press button on top of key, and browser does exchange with key and passes result to site. The exchange between browser and key includes the domain of the site. It only works on the same site where registered the key.
- FabHK 5y agoIn this case it seems the author was asleep, so it was probably not a phishing site passing on the legitimate TOTP.
- quadrifoliate 5y ago> I wish he'd mention what kind of 2FA...U2F/WebAuthn...origin binding...SMS It shouldn't matter, because it's irrelevant to the point of the article, which is that Facebook (at least as reported) leaves a hacking victim with little or no recourse to get their account, and sometimes livelihood back. An imperfect real-world analogy of your question is like asking about what precise brand of bear mace an assault victim was or was not carrying, and whether a better one would have helped. Perhaps it would have, but that's not the point. If having hardware tokens is so important, Facebook should be making them mandatory at its scale.
- rustyminnow 5y agoI for one would appreciate knowing what brands of bear mace are ineffective and worth avoiding.
- deleted 5y ago[deleted]