6 ms·

One day I logged in to my Amazon account from a different country. Mind you, I have 2FA/OTP enabled in my account, and I entered it correctly. They also made me

One day I logged in to my Amazon account from a different country. Mind you, I have 2FA/OTP enabled in my account, and I entered it correctly. They also made me click on a link they sent via email to "verify my login". A couple hours later my account was blocked due to "suspicious login(s)" (i.e. mine), and the order I placed cancelled. They had me wait 24h until I could contact someone at support that could unblock it. He told he was going to disable 2FA (?) and send me a code that I could use to change my password. The code was sent via SMS. They think that someone who has just my SIM card (or a clone, FFS) is more trustworthy than someone who has my password, 2FA token, and email address. These companies take user security as a joke, or as pure theater.

xvector 5y ago
The amount of trust that providers put in phone numbers is absolutely insane.
- cassepipe 5y ago
  Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)
  - yeetaccount4 5y ago
    I’ve always figured this was what they wanted. They probably tie it to your IMEI so they can track you everywhere online and in the real world. E: Seriously? This is a multi billion dollar industry. Oh no, Google would never do that…
  - notreallyserio 5y ago
    My phone number is probably the least valuable thing Amazon knows about me, I figure.
    - novok 5y ago
      Phone numbers are basically super cookie identifiers unless you make a new phone number for each account and use different aliases & maybe addresses for them too. They all sell into centralized information systems and create profiles about you that are very detailed, which includes banking, income and credit info. So yes, the phone number is incredibly valuable, especially a place like amazon that shows different prices to different users and who's recommendation engine drives a lot of sales. Phone 2 factor is pretty much the only kind of 2 factor most people will accept, and for most people the phone number probably has better security than most people's emails, because most people reuse passwords, while with phones you had to do a special non-password effort for them.
  - Semaphor 5y ago
    I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).
- deleted 5y ago
  [deleted]
- Avamander 5y ago
  That aspect is significantly worsened if your country has had proper electronic IDs for nearly two decades. I laugh my ass off but also shed a tear each and every time some foreign provider asks for "identification". Security questions, electrical bills and selfies, medieval garbage. But I guess I should be happy fax usage has dwindled somewhat.
  - prirun 5y ago
    Fax usage has not dwindled at all for hospital medical records; it's still the primary way of transferring records from one hospital to another if they don't have the same computer software running the hospital. It's ridiculous.
    - dvsfish 5y ago
      Is this a niche waiting to be exploited?
      - nextos 5y ago
        Yes. The public good derived from sane EHR interoperability would be enormous. Lower costs, better treatments, more informed policies... But there are lots of political barriers. NHS is trying, and pretty open to private tenders. I'm actually working on a very related field. Smaller or more atomized healthcare systems than NHS would be probably even difficult to deal with initially.
        Silhouette 5y ago
        The trouble with this issue for the NHS is that UK governments have tried to give away access to the most sensitive of records on a national scale so many times now and then rowed back in the face of predictable criticisms that the public would have to be collectively insane to allow broad access to medical records through any centralised system any time soon. It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways. But we have no constitutional way to establish adequate legally binding safeguards that some later government can't just overturn for its own convenience in the future.
- nextos 5y ago
  I agree. I change my phone number often and this is annoying. It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP. I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable. Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.
  - jounker 5y ago
    Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.
    - nextos 5y ago
      That's interesting. What 2FA system do they use exactly? AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.
      - jounker 5y ago
        It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.
      - Semaphor 5y ago
        N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?
- dheera 5y ago
  Yeah I have a pool of virtual numbers and use them for any of this bull, and rotate them in/out. No business needs to know my phone number.
Sebguer 5y ago
It's incentivized top-to-bottom. Every audit is structured around checking boxes, absolutely zero interest in actual security. Just state you have processes, that they meet the loosely written (or in some cases bizarrely specific) spec, and be able to provide some writing that explain them at least at a surface level. This is the case for just about every framework, and even though these systems are just for window dressing, the auditors are mostly incompetent. A review a few years ago showed that 20-50% (depending on which of the Big 4 you've decided to hire) of audits were done incorrectly.
- qzx_pierri 5y ago
  I recently quit my job in Information Security. We used the NIST 800-53 framework. 99% of people following security frameworks just blindly check in boxes during audits or control assessments. A security control/requirement can’t be met? No problem! Just create another piece of paperwork accepting the risk and get it signed off by the system owner (who has the most incentive to not inconvenience their project or department due to an outstanding security requirement). The things I saw that were labeled as “acceptable risk” would drive me crazy. Maybe the government hires incompetent security practitioners? Do all organizations have this type of behavior behind the scenes?
  - Sebguer 5y ago
    The entire system is about abstracting away liability, not keeping things secure. Every framework is like this. The fact that companies are paying auditors to review their own work creates a completely upside down incentive model, and turns it into effectively a rubber stamp. You have to do things horrifically wrong for an auditor to care, and it's not like they're actually going to fail you, they'll just tell you to fix it and give you a generous deadline (or, for frameworks that allow it, do what you described and have it signed off as a known risk).
  - agar 5y ago
    The flipside: I've recently been working with a company that was audited and called out for allowing too many security policy exceptions. As a result, unless you can satisfy every one of their requirements, regardless of mitigating controls, you cannot get installed. Even if you're a security product whose ultimate use case is discovering in-progress exploits. I'm not sure if that's an example of the system working or being broken. But overall, Information Security is a complicated problem.
resueman 5y ago
Wechat does this to me just to use the app. They keep making me play stupid recaptcha games and do verification codes then ultimately block me anyway. I finally gave up on using it.
hffftz 5y ago
JAlexoid 5y ago
Amazon's security is completely bonkers. I lost access to my old account and they just decided that I will never change my password there. To unblock I must provide them with proof of identity.... that includes: - notary certified copy of my passport, in English... (I'm not from an English speaking country) - proof of residence in Ireland, where I wasn't even resident, but I did receive a few packages or.... I could just call my old phone number and ask the person to just forward me a text that they send to that phone number. I mean... How over the top are the requirements, while someone with a damn leaked password database and access to my old phone number will be able to just "sail through"... My AWS/Amazon accounts don't even have any activity or data in them...
deleted 5y ago
[deleted]
grishka 5y ago
It's absolutely bonkers what stupid crap some companies would call "security", and what lengths they'd go to enforce it. - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one. - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more. - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password. - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance.
- inetknght 5y ago
  > - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one. A good password manager, such as KeePass, will generate a passphrase. That is, words. Use that instead. Even if they ask "what is your mother's maiden name" just make up a passphrase. > - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. Yes, but; > This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more. This is false. I know many people who share computers. I treat all my computers as shared even though they are not; it's safer that way. > - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password. I agree that password changes after a certain time period is stupid. However, a password manager solves the problem of forgetting your password. > - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance. 100% this
goodlinks 5y ago
To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transaction then the bad actor already had my sim card and ability to log into my account. Serious question: is there any examples of a robust way of doing customer security? Even just a proposal/document or blog post (doesn't need to have been implemented). I sort of feel no one has figured this out yet (if its even possible). Companies just need to make sure their insurers will pay out, which if there is not proven solution seems about all they can do.. tho a little humility and honesty that that is their position would go a long way.
- taxyz23 5y ago
  U2f key ? Works for me.
  - Semaphor 5y ago
    I always wonder, are there banks using U2F/Fido(2)/Webauthn or whatever it’s called now? I’m reasonably certain not in Germany, but is there one in another country?
  - goodlinks 5y ago
    Are there best practice process diagrams to support the correct usage of these with b2c services? how should the initial verifiacation happen? what happens when i loose/corrupt/break the device? should this represent me as a human or the keys to an account? - should a human hold the permissions ultimately (if so how to i override a key?)
asdff 5y ago
2FA is going to be exposed badly by some basic social engineering one day. When I worked in a hospital, 99% of the people dealing with HIPAA protected patient data were doing so on a desktop that sits in an unlocked office or in an open reception area with the duo two factor authentication set to call the landline right next to the desktop.
- deckard1 5y ago
  HIPAA is always going to be a joke. Walk around the hospital's parking lot and drop a bunch of malicious USB drives with the logo of the hospital on them. Someone is bound to pick one up and stick it in a machine on the network.

xvector 5y ago

The amount of trust that providers put in phone numbers is absolutely insane.

cassepipe 5y ago
Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)
- yeetaccount4 5y ago
  I’ve always figured this was what they wanted. They probably tie it to your IMEI so they can track you everywhere online and in the real world. E: Seriously? This is a multi billion dollar industry. Oh no, Google would never do that…
- notreallyserio 5y ago
  My phone number is probably the least valuable thing Amazon knows about me, I figure.
  - novok 5y ago
    Phone numbers are basically super cookie identifiers unless you make a new phone number for each account and use different aliases & maybe addresses for them too. They all sell into centralized information systems and create profiles about you that are very detailed, which includes banking, income and credit info. So yes, the phone number is incredibly valuable, especially a place like amazon that shows different prices to different users and who's recommendation engine drives a lot of sales. Phone 2 factor is pretty much the only kind of 2 factor most people will accept, and for most people the phone number probably has better security than most people's emails, because most people reuse passwords, while with phones you had to do a special non-password effort for them.
- Semaphor 5y ago
  I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).
deleted 5y ago
[deleted]
Avamander 5y ago
That aspect is significantly worsened if your country has had proper electronic IDs for nearly two decades. I laugh my ass off but also shed a tear each and every time some foreign provider asks for "identification". Security questions, electrical bills and selfies, medieval garbage. But I guess I should be happy fax usage has dwindled somewhat.
- prirun 5y ago
  Fax usage has not dwindled at all for hospital medical records; it's still the primary way of transferring records from one hospital to another if they don't have the same computer software running the hospital. It's ridiculous.
  - dvsfish 5y ago
    Is this a niche waiting to be exploited?
    - nextos 5y ago
      Yes. The public good derived from sane EHR interoperability would be enormous. Lower costs, better treatments, more informed policies... But there are lots of political barriers. NHS is trying, and pretty open to private tenders. I'm actually working on a very related field. Smaller or more atomized healthcare systems than NHS would be probably even difficult to deal with initially.
      - Silhouette 5y ago
        The trouble with this issue for the NHS is that UK governments have tried to give away access to the most sensitive of records on a national scale so many times now and then rowed back in the face of predictable criticisms that the public would have to be collectively insane to allow broad access to medical records through any centralised system any time soon. It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways. But we have no constitutional way to establish adequate legally binding safeguards that some later government can't just overturn for its own convenience in the future.
nextos 5y ago
I agree. I change my phone number often and this is annoying. It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP. I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable. Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.
- jounker 5y ago
  Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.
  - nextos 5y ago
    That's interesting. What 2FA system do they use exactly? AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.
    - jounker 5y ago
      It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.
    - Semaphor 5y ago
      N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?
dheera 5y ago
Yeah I have a pool of virtual numbers and use them for any of this bull, and rotate them in/out. No business needs to know my phone number.

Sebguer 5y ago

It's incentivized top-to-bottom. Every audit is structured around checking boxes, absolutely zero interest in actual security. Just state you have processes, that they meet the loosely written (or in some cases bizarrely specific) spec, and be able to provide some writing that explain them at least at a surface level. This is the case for just about every framework, and even though these systems are just for window dressing, the auditors are mostly incompetent. A review a few years ago showed that 20-50% (depending on which of the Big 4 you've decided to hire) of audits were done incorrectly.

qzx_pierri 5y ago
I recently quit my job in Information Security. We used the NIST 800-53 framework. 99% of people following security frameworks just blindly check in boxes during audits or control assessments. A security control/requirement can’t be met? No problem! Just create another piece of paperwork accepting the risk and get it signed off by the system owner (who has the most incentive to not inconvenience their project or department due to an outstanding security requirement). The things I saw that were labeled as “acceptable risk” would drive me crazy. Maybe the government hires incompetent security practitioners? Do all organizations have this type of behavior behind the scenes?
- Sebguer 5y ago
  The entire system is about abstracting away liability, not keeping things secure. Every framework is like this. The fact that companies are paying auditors to review their own work creates a completely upside down incentive model, and turns it into effectively a rubber stamp. You have to do things horrifically wrong for an auditor to care, and it's not like they're actually going to fail you, they'll just tell you to fix it and give you a generous deadline (or, for frameworks that allow it, do what you described and have it signed off as a known risk).
- agar 5y ago
  The flipside: I've recently been working with a company that was audited and called out for allowing too many security policy exceptions. As a result, unless you can satisfy every one of their requirements, regardless of mitigating controls, you cannot get installed. Even if you're a security product whose ultimate use case is discovering in-progress exploits. I'm not sure if that's an example of the system working or being broken. But overall, Information Security is a complicated problem.

resueman 5y ago

Wechat does this to me just to use the app. They keep making me play stupid recaptcha games and do verification codes then ultimately block me anyway. I finally gave up on using it.

hffftz 5y ago

JAlexoid 5y ago

Amazon's security is completely bonkers. I lost access to my old account and they just decided that I will never change my password there. To unblock I must provide them with proof of identity.... that includes: - notary certified copy of my passport, in English... (I'm not from an English speaking country) - proof of residence in Ireland, where I wasn't even resident, but I did receive a few packages or.... I could just call my old phone number and ask the person to just forward me a text that they send to that phone number. I mean... How over the top are the requirements, while someone with a damn leaked password database and access to my old phone number will be able to just "sail through"... My AWS/Amazon accounts don't even have any activity or data in them...

deleted 5y ago

[deleted]

grishka 5y ago

It's absolutely bonkers what stupid crap some companies would call "security", and what lengths they'd go to enforce it. - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one. - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more. - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password. - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance.

inetknght 5y ago
> - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one. A good password manager, such as KeePass, will generate a passphrase. That is, words. Use that instead. Even if they ask "what is your mother's maiden name" just make up a passphrase. > - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. Yes, but; > This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more. This is false. I know many people who share computers. I treat all my computers as shared even though they are not; it's safer that way. > - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password. I agree that password changes after a certain time period is stupid. However, a password manager solves the problem of forgetting your password. > - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance. 100% this

goodlinks 5y ago

To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transaction then the bad actor already had my sim card and ability to log into my account. Serious question: is there any examples of a robust way of doing customer security? Even just a proposal/document or blog post (doesn't need to have been implemented). I sort of feel no one has figured this out yet (if its even possible). Companies just need to make sure their insurers will pay out, which if there is not proven solution seems about all they can do.. tho a little humility and honesty that that is their position would go a long way.

taxyz23 5y ago
U2f key ? Works for me.
- Semaphor 5y ago
  I always wonder, are there banks using U2F/Fido(2)/Webauthn or whatever it’s called now? I’m reasonably certain not in Germany, but is there one in another country?
- goodlinks 5y ago
  Are there best practice process diagrams to support the correct usage of these with b2c services? how should the initial verifiacation happen? what happens when i loose/corrupt/break the device? should this represent me as a human or the keys to an account? - should a human hold the permissions ultimately (if so how to i override a key?)

asdff 5y ago

2FA is going to be exposed badly by some basic social engineering one day. When I worked in a hospital, 99% of the people dealing with HIPAA protected patient data were doing so on a desktop that sits in an unlocked office or in an open reception area with the duo two factor authentication set to call the landline right next to the desktop.

deckard1 5y ago
HIPAA is always going to be a joke. Walk around the hospital's parking lot and drop a bunch of malicious USB drives with the logo of the hospital on them. Someone is bound to pick one up and stick it in a machine on the network.