5 ms·

This reads a bit like an alarmist scare. The only real complaint the author has, despite linking it several times, is that SMS is hackable. This is true to some

This reads a bit like an alarmist scare. The only real complaint the author has, despite linking it several times, is that SMS is hackable. This is true to some extent, as SIM cloning isn't a straight forward hack and is largely based on social engineering. Still it doesn't really matter for two reasons. First, common attackers are opportunistic and they are unlikely to know your phone number. Even if they did, it would take skill and effort to clone your SIM. For this to happen you need to be targeted as an individual and that's a different scenario from random PayPal attacks. Second, PayPal aren't stupid, and they have to be aware of SIM cloning. They also have data that we don't. Looking at their data and the probability of an attacker carrying out SIM cloning, they must have decided the cost of probable cases is acceptable if and when these attacks take place. Or that it's fairly rare to actually happen. Besides, this option isn't available to all users, so there might be more going on than we realize. I understand the author is upset that they can't set a single TFA channel to be used exclusively. But I think the real gripe here is that the author feels loss of control rather than a massive security issue.

b112 4y ago
Second, PayPal aren't stupid I presume you have loads of verifiable data, to prove this? Or is this a logical fallacy? EG, appeal to authority? Corps of all sizes do very, very stupid things.
- xdfgh1112 4y ago
  Is there a term for the opposite - presuming you're smarter than a huge team of full time employees with specialist knowledge and access to data you don't have?
  - b112 4y ago
    The way you are thinking, is a logical fallacy. Right or wrong, is not determined by the source.
    - wizzwizz4 4y ago
      Argument screens off authority, but you do actually have to have a better argument than the authority figure. Saying "I have an argument, and the experts aren't on Hacker News so we don't know what theirs is" doesn't make it a logical fallacy to disagree with you. And just because an argument's a logical fallacy, that doesn't make it incorrect. https://existentialcomics.com/comic/9 https://existentialcomics.com/comic/9
      - pbhjpbhj 4y ago
        >just because an argument's a logical fallacy, that doesn't make it incorrect. // An argument that uses fallacious reasoning is an incorrect argument, but pointing out a fallacy doesn't negate a conclusion (that would be the fallacy fallacy). So, we can't tell if the conclusion is wrong when someone uses a fallacy. I'm guessing your link laid it out clearly.
        wizzwizz4 4y ago
        My link did – but I'm making a stronger claim. (A tangential claim, mind.) Just because an argument pattern-matches to a named logical fallacy, that doesn't make it incorrect. Take the conjunction fallacy. Ultimately, it comes down to the representativeness heuristic. However, the representativeness heuristic matches how we use language: to use Wikipedia's example, "Linda is a bank teller active in the feminist movement" is more correct than "Linda is a bank teller" if Linda is active in the feminist movement, but not a bank teller. The mistake in such a situation is interpreting it as though the speaker is using classical logic, when they're actually using a fuzzy logic more akin to Bayesian inference. People focus too much on logical fallacies, and not enough on how the average human actually uses language. Precise language is useful, but that doesn't make "heuristic language" wrong, or fallacious. An argument that's a logical fallacy can still be heuristically correct.
    - xdfgh1112 4y ago
      Yes if we're talking about pure logic, but we aren't.
  - pbhjpbhj 4y ago
    In their defence, sometimes organisations are stupid where individuals are not. Many people might realise that cloning is an unaccounted for aspect of a 2FA, but the manager in charge, say, thinks cloning is not a realistic possibility and so doesn't allow it to be taken into account. Or, the manager does think it needs addressing but they get a bonus if the system is completed earlier and they know it will take longer to address the issue, so they argue it's not a realistic attack ...
superjan 4y ago
> most new iPhones and Android phones by default will display the actual contents of your messages on the lock screen So stealing a phone and knowing an email address could be enough. New iphones require face id by default, but there loads of cheaper android models that don’t. That is a low bar.
- heisenbit 4y ago
  Depending on your phone settings the message content will be displayed on your lock screen without the need to go through face id. Apple and Google should agree on a standard code sms format and prevent such sensitive information getting displayed on the lock screen.
  - dzhiurgis 4y ago
    Apple should default not displaying anything on lock screen. There’s a setting that most don’t know about.
    - sgerenser 4y ago
      Ever since the first FaceId iPhone (iPhone X) the default for messages is to only show message previews when unlocked. I’m pretty sure non FaceID phones defaulted to not showing previews at all.
  - yencabulator 4y ago
    > Apple and Google should agree on a standard code sms format and prevent such sensitive information getting displayed on the lock screen. W3C tried: https://github.com/wicg/sms-one-time-codes https://github.com/wicg/sms-one-time-codes
    - edualm 4y ago
      So that’s what it is! SMS 2FA from Apple actually implements that standard from what I can see.
fancyfredbot 4y ago
So basically, since you need to be targeted as an individual rather than at random, and that's rare, then we should be okay with an insecure /banking/ website? I can't get my head around that point of view. This creates a financial incentive for people to scour the internet for people's phone numbers, clone their SIM and steal their PayPal account and so you can be fairly sure people will do that.
rippercushions 4y ago
> PayPal aren't stupid As discussed very recently, many HNers would contest that assertion. https://news.ycombinator.com/item https://news.ycombinator.com/item ?id=33463535
jurschreuder 4y ago
PayPal probably has data that it will get more users if it's convenient to log in and some people get hacked. I don't know if every user of PayPal would agree with this strategy, even though it makes PayPal the most money.
- slv77 4y ago
  People lose their second factors which are intentionally difficult to clone. Phones get replaced, keys get lost. OTP is a more secure fallback method then calling customer support. I can’t think of another universally available fallback method.
- hakfoo 4y ago
  s/PayPal/the entire bloody financial industry/g They've decided it's pretty much always better to close the barn doors after the cows leave. Card fraud problems? Just promise people 'zero liability' rather than some sort of security paradigm stronger than "we told everyone they're not allowed to store the CVV." Everything identity-theft related? Why bother actually engineering some sort of secure 21st-century authentication systems when you can just pay for a few months of credit monitoring after the inevitable data breach and class action suit. I wonder if it would be possible to create a more proactive liability framework. Maybe stockholders would be a party with standing-- if you're still doing $known_stupid_thing years after alternatives have been documented, you're failing your fiduciary duty to investors, just waiting for an avoidable damage to the stock price to happen.

b112 4y ago

Second, PayPal aren't stupid I presume you have loads of verifiable data, to prove this? Or is this a logical fallacy? EG, appeal to authority? Corps of all sizes do very, very stupid things.

xdfgh1112 4y ago
Is there a term for the opposite - presuming you're smarter than a huge team of full time employees with specialist knowledge and access to data you don't have?
- b112 4y ago
  The way you are thinking, is a logical fallacy. Right or wrong, is not determined by the source.
  - wizzwizz4 4y ago
    Argument screens off authority, but you do actually have to have a better argument than the authority figure. Saying "I have an argument, and the experts aren't on Hacker News so we don't know what theirs is" doesn't make it a logical fallacy to disagree with you. And just because an argument's a logical fallacy, that doesn't make it incorrect. https://existentialcomics.com/comic/9 https://existentialcomics.com/comic/9
    - pbhjpbhj 4y ago
      >just because an argument's a logical fallacy, that doesn't make it incorrect. // An argument that uses fallacious reasoning is an incorrect argument, but pointing out a fallacy doesn't negate a conclusion (that would be the fallacy fallacy). So, we can't tell if the conclusion is wrong when someone uses a fallacy. I'm guessing your link laid it out clearly.
      - wizzwizz4 4y ago
        My link did – but I'm making a stronger claim. (A tangential claim, mind.) Just because an argument pattern-matches to a named logical fallacy, that doesn't make it incorrect. Take the conjunction fallacy. Ultimately, it comes down to the representativeness heuristic. However, the representativeness heuristic matches how we use language: to use Wikipedia's example, "Linda is a bank teller active in the feminist movement" is more correct than "Linda is a bank teller" if Linda is active in the feminist movement, but not a bank teller. The mistake in such a situation is interpreting it as though the speaker is using classical logic, when they're actually using a fuzzy logic more akin to Bayesian inference. People focus too much on logical fallacies, and not enough on how the average human actually uses language. Precise language is useful, but that doesn't make "heuristic language" wrong, or fallacious. An argument that's a logical fallacy can still be heuristically correct.
  - xdfgh1112 4y ago
    Yes if we're talking about pure logic, but we aren't.
- pbhjpbhj 4y ago
  In their defence, sometimes organisations are stupid where individuals are not. Many people might realise that cloning is an unaccounted for aspect of a 2FA, but the manager in charge, say, thinks cloning is not a realistic possibility and so doesn't allow it to be taken into account. Or, the manager does think it needs addressing but they get a bonus if the system is completed earlier and they know it will take longer to address the issue, so they argue it's not a realistic attack ...

superjan 4y ago

> most new iPhones and Android phones by default will display the actual contents of your messages on the lock screen So stealing a phone and knowing an email address could be enough. New iphones require face id by default, but there loads of cheaper android models that don’t. That is a low bar.

heisenbit 4y ago
Depending on your phone settings the message content will be displayed on your lock screen without the need to go through face id. Apple and Google should agree on a standard code sms format and prevent such sensitive information getting displayed on the lock screen.
- dzhiurgis 4y ago
  Apple should default not displaying anything on lock screen. There’s a setting that most don’t know about.
  - sgerenser 4y ago
    Ever since the first FaceId iPhone (iPhone X) the default for messages is to only show message previews when unlocked. I’m pretty sure non FaceID phones defaulted to not showing previews at all.
- yencabulator 4y ago
  > Apple and Google should agree on a standard code sms format and prevent such sensitive information getting displayed on the lock screen. W3C tried: https://github.com/wicg/sms-one-time-codes https://github.com/wicg/sms-one-time-codes
  - edualm 4y ago
    So that’s what it is! SMS 2FA from Apple actually implements that standard from what I can see.

fancyfredbot 4y ago

So basically, since you need to be targeted as an individual rather than at random, and that's rare, then we should be okay with an insecure /banking/ website? I can't get my head around that point of view. This creates a financial incentive for people to scour the internet for people's phone numbers, clone their SIM and steal their PayPal account and so you can be fairly sure people will do that.

rippercushions 4y ago

> PayPal aren't stupid As discussed very recently, many HNers would contest that assertion. https://news.ycombinator.com/item https://news.ycombinator.com/item ?id=33463535

jurschreuder 4y ago

PayPal probably has data that it will get more users if it's convenient to log in and some people get hacked. I don't know if every user of PayPal would agree with this strategy, even though it makes PayPal the most money.

slv77 4y ago
People lose their second factors which are intentionally difficult to clone. Phones get replaced, keys get lost. OTP is a more secure fallback method then calling customer support. I can’t think of another universally available fallback method.
hakfoo 4y ago
s/PayPal/the entire bloody financial industry/g They've decided it's pretty much always better to close the barn doors after the cows leave. Card fraud problems? Just promise people 'zero liability' rather than some sort of security paradigm stronger than "we told everyone they're not allowed to store the CVV." Everything identity-theft related? Why bother actually engineering some sort of secure 21st-century authentication systems when you can just pay for a few months of credit monitoring after the inevitable data breach and class action suit. I wonder if it would be possible to create a more proactive liability framework. Maybe stockholders would be a party with standing-- if you're still doing $known_stupid_thing years after alternatives have been documented, you're failing your fiduciary duty to investors, just waiting for an avoidable damage to the stock price to happen.