5 ms·

Stop using SMS for 2FA. Not familiar with SMS Sender ID Verification, but after quick Google, I was unable to find any signs that it counters SMS spoofing. SM

Stop using SMS for 2FA. Not familiar with SMS Sender ID Verification, but after quick Google, I was unable to find any signs that it counters SMS spoofing. SMS as a 2FA channel is broken. There are so many vulnerabilities that it just makes no sense to use; for example: corrupt telco employees, SS7, sim card cloning, sim swap, spoofing, governments, etc. Beyond that, if you’re located or traveling internationally, it’s a nightmare to deal with. NIST has not recommended SMS based 2FA since 2016: https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...

moffkalast 4y ago
That may be so, but the alternative approach something like Google/KeePass/whatever Authenticator which has the issue of not being bound to your number (unlike SMSs) so if your phone gets destroyed you can't simply get a new phone and sim from the operator and continue as usual, you're completely fucked instead.
- vladvasiliu 4y ago
  Depending on the authenticator used, you are absolutely not fucked. It even works while waiting for your new phone / sim (had this happened to me on a Saturday night in France. Nothing's open Sundays). There's Authy that does backups and you can even run it on a computer (even Linux!). 1Password can store OTPs, too, and is also backed up. There are probably a bunch of others and I'd expect KeePass to be able to do backups. Plus, you're usually able to get the OTP seed which you can store on your own. This usually shows up as "can't scan this code?" or similar when registering. I'm now traveling overseas, and have a local SIM in my phone. I have an older iPhone, so no dual-SIM for me. If I had to receive an SMS I guess it would still be better than my older Galaxy S5 which required a reboot, but it'd still be a pain to have to switch SIMs. If I lost my Phone but still had my laptop, I'd be AOK with my current OTP setup. Except for a few sites which don't allow me to have anything else besides an SMS, but luckily they're not critical.
  - moffkalast 4y ago
    Well some do it properly I suppose, but on the other hand Google Auth has 100M users and no ways to back up. All of those people are royally screwed if anything happens.
    - ranger_danger 4y ago
      >no ways to back up not true. that QR code you scanned to add the key to your app? well, that was your key. you could have saved it somewhere else secure that does allow exporting.
      - moffkalast 4y ago
        Which all people of course do. Or is it more like 0%?
    - amichal 4y ago
      I have been one of those people. There must have been a lot of them because “export” is now an option which dumps all or selected keys and a giant non standard? QR code that can be imported into another instance. Mine are now on two devices.
  - ranger_danger 4y ago
    Ironically the only sites that force me to use SMS for 2FA are banks.
- jandrese 4y ago
  You are only in trouble if you didn't keep a copy of your private keys backed up. Unfortunately many of these apps treat the private keys like the app owns it which is where people run into trouble. Some will even back up to the app provider's cloud service which is just asking for it to be stolen.
  - moffkalast 4y ago
    > if you didn't keep a copy of your private keys backed up Most people don't. The average person doesn't even know that's a thing since like 1 in 100 services prompts you to even do that.
- kevin_thibedeau 4y ago
  They're worse than that. I had pattern lock on my phone and it stopped working one day. After a factory reset all authenticator apps lose your credentials.
- jkepler 4y ago
  On Android, if you use AndOTP, the app allows you to easily back up all your OTP secrets to an exportable file, with optional password encryption. Trivial to then import into another phone.
fasteo 4y ago
SMS has a unique advantage that no other channel has: No user onboard needed. Got a SIM ? got SMS. I send lots of 2FA SMS for a number of banks here in Europe and they - because of the costs after PSD2[1] went live - want users to use their app for getting notifications as 2FA. They have launched several communication campaigns over the last 2-3 years, but only 30% of users have migrated from SMS to in-app notifications, mostly because they won't even install their app. Then, we have uses cases where users don't have a regular relation with your business (p.e. e-sign for consumer goods financing on spot). In this case, I would say that SMS is the only channel you have to serve these users. For better or worse, I do not see SMS disappearing anytime soon. [1] https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi...
- jandrese 4y ago
  Don't have a SIM? Get fucked. There are people who don't have a cell phone because they see it as a distraction engine that will gobble up their life. Digital addictive drugs. But it's almost impossible to maintain this stance in modern life. Have you seen the trend of restaurants that no longer print menus? Instead there is a QR code that opens up their website to get the menu. Every service now wanting SMS verification adds to their problems.
  - dijonman2 4y ago
    I have asked for a paper menu in these cases and almost all restaurants have been happy to oblige. One time the restaurant let me use their ipad to see the menu. I wouldn’t count on this, but I’m trying to give a business money. Most are happy to satisfy reasonable requests.
    - reaperducer 4y ago
      I was at a food court recently where one of the restaurants didn't have a menu. Just a QR. I asked, and there's no paper version available. I asked what they do for blind people and got a blank stare. So I went to the restaurant next door. If you can't even bother to scribble a menu on a chalkboard, you're not a real business.
pilgrimfff 4y ago
Google won't even allow you to enable app-based 2FA until you've signed up for SMS-based 2FA. Unless you go back into the 2FA interface after the fact, there's no indication that app-based is even an option for Google accounts.
- ranger_danger 4y ago
  That's not 100% true... the one alternative is to first enable U2F hardware-based 2FA (which can be emulated on a PC using softu2f), then you can enable regular app-based TOTP codes.
mfbx9da4 4y ago
Can you provide reading links for SS7 and co please. I really don’t understand why it’s so insecure.

moffkalast 4y ago

That may be so, but the alternative approach something like Google/KeePass/whatever Authenticator which has the issue of not being bound to your number (unlike SMSs) so if your phone gets destroyed you can't simply get a new phone and sim from the operator and continue as usual, you're completely fucked instead.

vladvasiliu 4y ago
Depending on the authenticator used, you are absolutely not fucked. It even works while waiting for your new phone / sim (had this happened to me on a Saturday night in France. Nothing's open Sundays). There's Authy that does backups and you can even run it on a computer (even Linux!). 1Password can store OTPs, too, and is also backed up. There are probably a bunch of others and I'd expect KeePass to be able to do backups. Plus, you're usually able to get the OTP seed which you can store on your own. This usually shows up as "can't scan this code?" or similar when registering. I'm now traveling overseas, and have a local SIM in my phone. I have an older iPhone, so no dual-SIM for me. If I had to receive an SMS I guess it would still be better than my older Galaxy S5 which required a reboot, but it'd still be a pain to have to switch SIMs. If I lost my Phone but still had my laptop, I'd be AOK with my current OTP setup. Except for a few sites which don't allow me to have anything else besides an SMS, but luckily they're not critical.
- moffkalast 4y ago
  Well some do it properly I suppose, but on the other hand Google Auth has 100M users and no ways to back up. All of those people are royally screwed if anything happens.
  - ranger_danger 4y ago
    >no ways to back up not true. that QR code you scanned to add the key to your app? well, that was your key. you could have saved it somewhere else secure that does allow exporting.
    - moffkalast 4y ago
      Which all people of course do. Or is it more like 0%?
  - amichal 4y ago
    I have been one of those people. There must have been a lot of them because “export” is now an option which dumps all or selected keys and a giant non standard? QR code that can be imported into another instance. Mine are now on two devices.
- ranger_danger 4y ago
  Ironically the only sites that force me to use SMS for 2FA are banks.
jandrese 4y ago
You are only in trouble if you didn't keep a copy of your private keys backed up. Unfortunately many of these apps treat the private keys like the app owns it which is where people run into trouble. Some will even back up to the app provider's cloud service which is just asking for it to be stolen.
- moffkalast 4y ago
  > if you didn't keep a copy of your private keys backed up Most people don't. The average person doesn't even know that's a thing since like 1 in 100 services prompts you to even do that.
kevin_thibedeau 4y ago
They're worse than that. I had pattern lock on my phone and it stopped working one day. After a factory reset all authenticator apps lose your credentials.
jkepler 4y ago
On Android, if you use AndOTP, the app allows you to easily back up all your OTP secrets to an exportable file, with optional password encryption. Trivial to then import into another phone.

fasteo 4y ago

SMS has a unique advantage that no other channel has: No user onboard needed. Got a SIM ? got SMS. I send lots of 2FA SMS for a number of banks here in Europe and they - because of the costs after PSD2[1] went live - want users to use their app for getting notifications as 2FA. They have launched several communication campaigns over the last 2-3 years, but only 30% of users have migrated from SMS to in-app notifications, mostly because they won't even install their app. Then, we have uses cases where users don't have a regular relation with your business (p.e. e-sign for consumer goods financing on spot). In this case, I would say that SMS is the only channel you have to serve these users. For better or worse, I do not see SMS disappearing anytime soon. [1] https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi...

jandrese 4y ago
Don't have a SIM? Get fucked. There are people who don't have a cell phone because they see it as a distraction engine that will gobble up their life. Digital addictive drugs. But it's almost impossible to maintain this stance in modern life. Have you seen the trend of restaurants that no longer print menus? Instead there is a QR code that opens up their website to get the menu. Every service now wanting SMS verification adds to their problems.
- dijonman2 4y ago
  I have asked for a paper menu in these cases and almost all restaurants have been happy to oblige. One time the restaurant let me use their ipad to see the menu. I wouldn’t count on this, but I’m trying to give a business money. Most are happy to satisfy reasonable requests.
  - reaperducer 4y ago
    I was at a food court recently where one of the restaurants didn't have a menu. Just a QR. I asked, and there's no paper version available. I asked what they do for blind people and got a blank stare. So I went to the restaurant next door. If you can't even bother to scribble a menu on a chalkboard, you're not a real business.

pilgrimfff 4y ago

Google won't even allow you to enable app-based 2FA until you've signed up for SMS-based 2FA. Unless you go back into the 2FA interface after the fact, there's no indication that app-based is even an option for Google accounts.

ranger_danger 4y ago
That's not 100% true... the one alternative is to first enable U2F hardware-based 2FA (which can be emulated on a PC using softu2f), then you can enable regular app-based TOTP codes.

mfbx9da4 4y ago

Can you provide reading links for SS7 and co please. I really don’t understand why it’s so insecure.