4 ms·

You're not wrong, but it's real problem, both technically and socially, without much in the way of a good solution. Android and iOS provide significant security

You're not wrong, but it's real problem, both technically and socially, without much in the way of a good solution. Android and iOS provide significant security by virtue of the chain of trust running starting with Google or Apple down through their software and hardware (Google is a bit special here, I'll admit). This makes it easy for businesses like banks to work with those ecosystems and provide a secure experience without inventing much themselves. What's the alternative? SMS 2FA is abysmal. Maybe they could provide you a configurable webhook, but now they don't control the experience, and that's part of their requirements. Not to mention I wouldn't trust a bank to implement webhooks correctly. The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Whether it's for chain of security, microprocessors, springs in our toasters, it's not possible to keep everything open and interchangeable while maintaining our current way of life. I'd love that, but it's not realistic, as far as I can tell.

shkkmo 4y ago
> What's the alternative? SMS 2FA is abysmal. There are cross platform MFA solutions that could be supported. Your guess is as good as mine as to why banks don't support them.
Wowfunhappy 4y ago
> SMS 2FA is abysmal Is there actually anything wrong with SMS 2FA, other than SIM swapping? SIM swapping isn't a problem with SMS so much as the phone carriers, who really need to put stricter processes in place for verifying account transfers. IMO, they deserve most of the culpability.
- Thlom 4y ago
  In Scandinavia we have BankID which kind of uses SMS, but not quite. When I try to authenticate it sends a message to my phone and then I have to type in my 4-8 digit pin code on my phone. Apparently they have put a tiny application on the sim card, so sim swapping isn't an issue. Whenever I get a new sim card I have to authenticate the sim card using my hardware token and password.
  - Ekaros 4y ago
    Finland I got sometimes SMS in flow. For bank login it is account and password, then one time code. Then when making transaction getting SMS with which one time code to enter. And then when paying with confirmation same thing but just with SMS code. I don't really see point of SMS in flow, but hey I can somewhat live with it.
- justsomehnguy 4y ago
  Have only a small amount of money on you regular account for the everyday means, with all the money on another account whatever. Lose your wallet with cards, lose your phone (or just a phone with Apple/GooglePay). Get a replacement SIM, be locked out of receiving any SMS for 24h[0]. Now be somewhere where is no local branches of your bank.[1] Or even better - be abroad. Or just be in a taxi at 9PM when no one works and the bank locks you out - just like when it happened to me. Gladly I found an ATM where I could withdraw from a secondary account. [0] Actual practice of cellular operators in my country. Safety [1] Even better with the virtual banks without any.
  - Wowfunhappy 4y ago
    Isn’t this a problem with _any_ type of 2FA? I agree insofar as, this is exactly why I strongly believe that 2FA should always be optional. But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?
    - justsomehnguy 4y ago
      > Isn’t this a problem with _any_ type of 2FA? Not quite because if you lose your YubiKey - you just lost your YubiKey, you still have the ability to call the bank (and my bank knows my number, so they greet me by the name) and at least do something, in the situation I've got in the previous comment I could lift the lock out with the code word, only if I could recall it then. But the phone is not only your 2FA item, it is also your "virtual identity" now for too many services, banks included. And with the tendency of banks to shoehorn you to their phone apps this starts to get ridiculous, if you lose your phone you are now: lost your banking app (2FA with push) lost the ability to 2FA with SMS as a backup lost the ability to install the app on the new phone (oh hi $username, it is really you despite you just gave your $username@gmail.com and password? We sent you an SMS to confirm it is really you, FOR YOUR SAFETY) lost the ability to login to your bank account on someone's else phone (same shit with SMS to your phone number) Bonus points: if you lost your ID or doesn't have it on you - you can't restore the SIM with your number. Or even buy a new one in many cases. > But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS? Pfft. I was forcefully shoehorned to mandatory SMS 2FA by my bank. I've opted out of this some years ago and it did work... till I was 600km from my home, I needed to buy the train tickets, I tried to logon to the bank webapp to move the required amount to the primary account only to discover what they enabled 2FA without asking. And the phone where my SIM (known by the bank)[0] was installed was literally on it's last 10% of charge in the airplane mode. It could literally shutdown just from the act of disabling the airplane mode so I could receive the SMS. So if the problem is not with SMS 2FA. The problem is what nowadays "SMS 2FA", at least for the banking apps[1], is way, way more than just SMS alone. [0] I'm not sure if they monitor IMEI of the device, but I wouldn't be surprised, considering they receive the notification of the changed IMSI. [1] Not sure how these practices are widespread world wide.
- trasz 4y ago
  Phone carriers deserve culpability because unrelated companies use them for purposes they are not supposed to be used for?
  - Wowfunhappy 4y ago
    They deserve culpability for letting someone else receive my private text messages. It doesn’t matter whether those messages contain one-time passcodes, intimate conversations, or critical business data—they were intended for me and no one else.
AshamedCaptain 4y ago
Before the "standardization" on SMS first and later on Google/Apple systems, there were a number of methods, since banks did try to do R&D to cut out on fraud: * One-time-pads (yes, I had a bank that would give me a card with 50 codes you were supposed to use once, then go back to the branch for more. Didn't last long, though, and was replaced with:) * Reusable codes: bank gives you a card with 50 codes. Bank randomly asks you for code number X. X may eventually repeat over time. (Bank also tells you your specific card serial number so that you can identify them). * Credit cards housing an actual e-Ink display that would give TOTP codes. https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-credit-cards https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-cre... * Actual FIDO devices.
- aenis 4y ago
  My bank issues a fido device: a card scanner with a built in camera that reads qr codes. Excellent tool, but for a few years now the bank is actively discouraging its use, touting the benefits of apps instead. It costs them around 60 euro to issue the device, and, sadly, thats incentive enough to advocate less secure solutions. When they take it away from me, I am out of options as this is the last bank in my country that issues them to individuals :-/
  - teekert 4y ago
    Rabobank? Yes it’s nice but I always find it a pain haha. 60€ wow, when they were first send around they very easily gave me 2 extra to put at work etc. What about N26, I don’t remember needing the app and I can log into a website. Not sure though…
cm2187 4y ago
Not really a technical challenge. You could force an equivalent of POSIX, maybe based on WASM, that smartphone makers would be forced to support if they want to sell in your region, and forced to support side loading those apps, as no government should be subject to the caprices of the various app stores. At this point smartphones have a fairly mature feature set to expose to the app. That would also help with the anti-competitive app store practices.
rsync 4y ago
"What's the alternative? SMS 2FA is abysmal." It seems to be forgotten that email 2FA exists. I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ? There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.
- daveoc64 4y ago
  The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails). Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.
  - wlecometo 4y ago
    if someone gets access to your phone they can do way more damage, but this is accepted.
- jamal-kumar 4y ago
  It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale
mateo1 4y ago
One thing that can and must be fixed instantly is to legislate that these businesses can not deny their services to anyone, just like systemic banks and the post office.
polskibus 4y ago
Why is SMS 2FA abysmal?
- formerkrogemp 4y ago
  Can't your number be spoofed?
amelius 4y ago
> The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Come on, we have open webbrowsers, which are 100x more difficult to implement than a chain of trust. Surely, somebody could come up with a reliable alternative.

shkkmo 4y ago

> What's the alternative? SMS 2FA is abysmal. There are cross platform MFA solutions that could be supported. Your guess is as good as mine as to why banks don't support them.

Wowfunhappy 4y ago

> SMS 2FA is abysmal Is there actually anything wrong with SMS 2FA, other than SIM swapping? SIM swapping isn't a problem with SMS so much as the phone carriers, who really need to put stricter processes in place for verifying account transfers. IMO, they deserve most of the culpability.

Thlom 4y ago
In Scandinavia we have BankID which kind of uses SMS, but not quite. When I try to authenticate it sends a message to my phone and then I have to type in my 4-8 digit pin code on my phone. Apparently they have put a tiny application on the sim card, so sim swapping isn't an issue. Whenever I get a new sim card I have to authenticate the sim card using my hardware token and password.
- Ekaros 4y ago
  Finland I got sometimes SMS in flow. For bank login it is account and password, then one time code. Then when making transaction getting SMS with which one time code to enter. And then when paying with confirmation same thing but just with SMS code. I don't really see point of SMS in flow, but hey I can somewhat live with it.
justsomehnguy 4y ago
Have only a small amount of money on you regular account for the everyday means, with all the money on another account whatever. Lose your wallet with cards, lose your phone (or just a phone with Apple/GooglePay). Get a replacement SIM, be locked out of receiving any SMS for 24h[0]. Now be somewhere where is no local branches of your bank.[1] Or even better - be abroad. Or just be in a taxi at 9PM when no one works and the bank locks you out - just like when it happened to me. Gladly I found an ATM where I could withdraw from a secondary account. [0] Actual practice of cellular operators in my country. Safety [1] Even better with the virtual banks without any.
- Wowfunhappy 4y ago
  Isn’t this a problem with _any_ type of 2FA? I agree insofar as, this is exactly why I strongly believe that 2FA should always be optional. But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?
  - justsomehnguy 4y ago
    > Isn’t this a problem with _any_ type of 2FA? Not quite because if you lose your YubiKey - you just lost your YubiKey, you still have the ability to call the bank (and my bank knows my number, so they greet me by the name) and at least do something, in the situation I've got in the previous comment I could lift the lock out with the code word, only if I could recall it then. But the phone is not only your 2FA item, it is also your "virtual identity" now for too many services, banks included. And with the tendency of banks to shoehorn you to their phone apps this starts to get ridiculous, if you lose your phone you are now: lost your banking app (2FA with push) lost the ability to 2FA with SMS as a backup lost the ability to install the app on the new phone (oh hi $username, it is really you despite you just gave your $username@gmail.com and password? We sent you an SMS to confirm it is really you, FOR YOUR SAFETY) lost the ability to login to your bank account on someone's else phone (same shit with SMS to your phone number) Bonus points: if you lost your ID or doesn't have it on you - you can't restore the SIM with your number. Or even buy a new one in many cases. > But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS? Pfft. I was forcefully shoehorned to mandatory SMS 2FA by my bank. I've opted out of this some years ago and it did work... till I was 600km from my home, I needed to buy the train tickets, I tried to logon to the bank webapp to move the required amount to the primary account only to discover what they enabled 2FA without asking. And the phone where my SIM (known by the bank)[0] was installed was literally on it's last 10% of charge in the airplane mode. It could literally shutdown just from the act of disabling the airplane mode so I could receive the SMS. So if the problem is not with SMS 2FA. The problem is what nowadays "SMS 2FA", at least for the banking apps[1], is way, way more than just SMS alone. [0] I'm not sure if they monitor IMEI of the device, but I wouldn't be surprised, considering they receive the notification of the changed IMSI. [1] Not sure how these practices are widespread world wide.
trasz 4y ago
Phone carriers deserve culpability because unrelated companies use them for purposes they are not supposed to be used for?
- Wowfunhappy 4y ago
  They deserve culpability for letting someone else receive my private text messages. It doesn’t matter whether those messages contain one-time passcodes, intimate conversations, or critical business data—they were intended for me and no one else.

AshamedCaptain 4y ago

Before the "standardization" on SMS first and later on Google/Apple systems, there were a number of methods, since banks did try to do R&D to cut out on fraud: * One-time-pads (yes, I had a bank that would give me a card with 50 codes you were supposed to use once, then go back to the branch for more. Didn't last long, though, and was replaced with:) * Reusable codes: bank gives you a card with 50 codes. Bank randomly asks you for code number X. X may eventually repeat over time. (Bank also tells you your specific card serial number so that you can identify them). * Credit cards housing an actual e-Ink display that would give TOTP codes. https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-credit-cards https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-cre... * Actual FIDO devices.

aenis 4y ago
My bank issues a fido device: a card scanner with a built in camera that reads qr codes. Excellent tool, but for a few years now the bank is actively discouraging its use, touting the benefits of apps instead. It costs them around 60 euro to issue the device, and, sadly, thats incentive enough to advocate less secure solutions. When they take it away from me, I am out of options as this is the last bank in my country that issues them to individuals :-/
- teekert 4y ago
  Rabobank? Yes it’s nice but I always find it a pain haha. 60€ wow, when they were first send around they very easily gave me 2 extra to put at work etc. What about N26, I don’t remember needing the app and I can log into a website. Not sure though…

cm2187 4y ago

Not really a technical challenge. You could force an equivalent of POSIX, maybe based on WASM, that smartphone makers would be forced to support if they want to sell in your region, and forced to support side loading those apps, as no government should be subject to the caprices of the various app stores. At this point smartphones have a fairly mature feature set to expose to the app. That would also help with the anti-competitive app store practices.

rsync 4y ago

"What's the alternative? SMS 2FA is abysmal." It seems to be forgotten that email 2FA exists. I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ? There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.

daveoc64 4y ago
The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails). Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.
- wlecometo 4y ago
  if someone gets access to your phone they can do way more damage, but this is accepted.
jamal-kumar 4y ago
It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale

mateo1 4y ago

One thing that can and must be fixed instantly is to legislate that these businesses can not deny their services to anyone, just like systemic banks and the post office.

polskibus 4y ago

Why is SMS 2FA abysmal?

formerkrogemp 4y ago
Can't your number be spoofed?

amelius 4y ago

> The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Come on, we have open webbrowsers, which are 100x more difficult to implement than a chain of trust. Surely, somebody could come up with a reliable alternative.