5 ms·

Maybe implement a two-way verification, for example: In the app/website: "You will receive an SMS with two 6-digit numbers, one to certify that we sent it to y

Maybe implement a two-way verification, for example: In the app/website: "You will receive an SMS with two 6-digit numbers, one to certify that we sent it to you and another to type bellow. Our chosen number is 887-987, type the another one" In the SMS: "Two-way verification. Check if it's us with number 887-987 and confirm with number 543-621"

alexcosan 4y ago
This could work - similar to what happens in some bluetooth pairing flows. But you could still send a text message with a phishing link under the same Sender ID and fool someone into opening it. You'd really need to know that the specific sender would never a) send you a link, or b) send you anything without the "two-way verification" flow you suggested. I don't think any of those options are realistic at a certain scale.
37 4y ago
Maybe I'm missing something, but why would this work? Isn't it just 12 digits going to one phone number instead of 6? (also thinking about this is bringing me back to SYN-ACK from the old days)
- degenerate 4y ago
  The user chooses the second 6 numbers. For dumb users this won't add any security, but for smart users this ring alarm bells. I like it, at least, for now. It's better than the current situation.
remuskaos 4y ago
I think one common way to "bypass" 2FA is to have the carrier send you (the attacker) a second SIM card. If I'm not misremembering, the text message is then delivered to both cards, the original holder and the attacker. So sending two numbers would not defend against this type of 2FA bypass.
- Melatonic 4y ago
  If that happens though you are screwed no matter what they do. The above does sound like a big improvement though and is sort of like what Google does when you turn on advanced protection and it occasionally will ask you to match the number on your computer screen to the one on your phone
- dspillett 4y ago
  You are right, a duplicate SIM will stop the two-number method described from adding any protection. But it will still protect against the fake messages like the ones being discussed here, and if someone has a duplicate SIM you are buggered in a number of other ways too. Though this method, and several others that are effectively the same, only offers any protection if the user has the ware-with-all to bother verifying the other number. Unfortunately that means that in many cases it won't help at all because many would not be aware of the other number and expect to find it when the fake messages come in - unless the user knows to expect and require it the fact a fake message doesn't have it makes no difference.
  - MauranKilom 4y ago
    > ware-with-all The word you're looking for is "wherewithal", I believe.
    - jimmont 4y ago
      Werewithal (or werwithal) forthcoming dictionary definition: transformational withal, typically during a full moon, though it regularly manifests in Hacker News posts, causes not yet fully determined. The withals can be complex.
Gunax 4y ago
Unfortunately I don't think that will work because the attacker is in the middle. They can request the verification number, then forward it to the victim. It sounds like we want identity verification, which while solved for computers, is much harder for humans.
woobar 4y ago
IBM ISAM (enterprise access manager) was doing this 5+ years ago. The prompt for one time code will look like this [1]: 1234-_______, and email/sms will have two numbers 1234-554566. Don't think they explained the reason for the first part in the message though. Just highlighted it in a different color. [1] https://philipnyecom.files.wordpress.com/2017/02/otp.jpg https://philipnyecom.files.wordpress.com/2017/02/otp.jpg
rkagerer 4y ago
If you're going to do that, please make the two codes more different. e.g. Make one alphas and the other numeric, or give them different lengths, so it's stupidly obvious which one the user should type in.

alexcosan 4y ago

This could work - similar to what happens in some bluetooth pairing flows. But you could still send a text message with a phishing link under the same Sender ID and fool someone into opening it. You'd really need to know that the specific sender would never a) send you a link, or b) send you anything without the "two-way verification" flow you suggested. I don't think any of those options are realistic at a certain scale.

37 4y ago

Maybe I'm missing something, but why would this work? Isn't it just 12 digits going to one phone number instead of 6? (also thinking about this is bringing me back to SYN-ACK from the old days)

degenerate 4y ago
The user chooses the second 6 numbers. For dumb users this won't add any security, but for smart users this ring alarm bells. I like it, at least, for now. It's better than the current situation.

remuskaos 4y ago

I think one common way to "bypass" 2FA is to have the carrier send you (the attacker) a second SIM card. If I'm not misremembering, the text message is then delivered to both cards, the original holder and the attacker. So sending two numbers would not defend against this type of 2FA bypass.

Melatonic 4y ago
If that happens though you are screwed no matter what they do. The above does sound like a big improvement though and is sort of like what Google does when you turn on advanced protection and it occasionally will ask you to match the number on your computer screen to the one on your phone
dspillett 4y ago
You are right, a duplicate SIM will stop the two-number method described from adding any protection. But it will still protect against the fake messages like the ones being discussed here, and if someone has a duplicate SIM you are buggered in a number of other ways too. Though this method, and several others that are effectively the same, only offers any protection if the user has the ware-with-all to bother verifying the other number. Unfortunately that means that in many cases it won't help at all because many would not be aware of the other number and expect to find it when the fake messages come in - unless the user knows to expect and require it the fact a fake message doesn't have it makes no difference.
- MauranKilom 4y ago
  > ware-with-all The word you're looking for is "wherewithal", I believe.
  - jimmont 4y ago
    Werewithal (or werwithal) forthcoming dictionary definition: transformational withal, typically during a full moon, though it regularly manifests in Hacker News posts, causes not yet fully determined. The withals can be complex.

Gunax 4y ago

Unfortunately I don't think that will work because the attacker is in the middle. They can request the verification number, then forward it to the victim. It sounds like we want identity verification, which while solved for computers, is much harder for humans.

woobar 4y ago

IBM ISAM (enterprise access manager) was doing this 5+ years ago. The prompt for one time code will look like this [1]: 1234-_______, and email/sms will have two numbers 1234-554566. Don't think they explained the reason for the first part in the message though. Just highlighted it in a different color. [1] https://philipnyecom.files.wordpress.com/2017/02/otp.jpg https://philipnyecom.files.wordpress.com/2017/02/otp.jpg

rkagerer 4y ago

If you're going to do that, please make the two codes more different. e.g. Make one alphas and the other numeric, or give them different lengths, so it's stupidly obvious which one the user should type in.