4 ms·

I had this experience a couple of weeks ago at an authorised repairer. They asked for my password, and I refused, but I was curious. So I said, "I'm surprised y

I had this experience a couple of weeks ago at an authorised repairer. They asked for my password, and I refused, but I was curious. So I said, "I'm surprised you're allowed to ask" and the guy said, "We're allowed to ask, but we're not allowed to insist". A few years ago my bank would ring me up every couple of weeks and say "Hi, I am calling from your bank, we want to talk to Doctor Eval(), can you please verify your date of birth and we can get started?". They would get so pissed off when I wouldn't tell them. I was like, "how do I know you're from my bank?". (Banks seem to have stopped doing this now). For companies which should be putting security at the centre of their business, they apparently have no idea that they're normalising phishing.

Eisenstein 4y ago
> For companies which should be putting security at the centre of their business, they apparently have no idea that they're normalising phishing. Yeah, this appears to have stopped, but was somewhat common a few years ago. My standard response was 'you called me, tell me who you are and I will call back on the official line'. They couldn't object to that. It was obviously some plan to 'ensure user privacy' that once it became known to one or two people with the authority to do something about it and the knowledge to know better it was quashed. Now if only they would allow you to enable 2FA options that aren't SMS and also disable SMS. They don't understand that SMS is a terrible 2FA system isn't mitigated by 'but you can enable other things' if you cannot remove SMS as an option.
- moring 4y ago
  I didn't know that. What makes SMS a terrible 2FA? (other than the fact that you can lose your phone, but that's true for any "have" factor)
  - Eisenstein 4y ago
    "SMS-transmitted OTPs are susceptible to a variety of attacks. One is by obtaining control of a target’s cell phone number, often by calling the cellular provider or going into a retail store of the provider and impersonating the subscriber. In 2016, the chief technology officer of the US Federal Trade Commission had her number hijacked this way. In other cases, the interception is the result of compromising the mobile account because it’s protected by a password the subscriber used on a different site that was breached. Still other interceptions are the result of exploiting decade-old weaknesses in the SS7 routing protocol that carriers around the world use to ensure their networks interoperate. OTPs are also vulnerable to phishing and social engineering attacks, as long as the attackers enter the codes quickly after obtaining them." * https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev... * https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/ https://arstechnica.com/information-technology/2018/08/passw...
    - jaclaz 4y ago
      This is something I still cannot understand, in the sense that usually the procedure is the following, at least with my bank (that uses SMS OTP): On the website: 1. you input a user ID 2. you input a password or PIN 3. you press a button that sends a SMS with an OTP code to the registered cellular number 4. you input this OTP code on the site Even if someone can intercept the SMS, they wouldn't (shouldn't) have ID and PIN.
      - Firmwarrior 4y ago
        For one thing, there are a lot of security holes that let people reset passwords by getting a code via SMS For another, what's the point in having 2FA if one of the factors is completely insecure? It's just an annoyance at that point, and a good way to ... tie your account to your phone number, which just coincidentally happens to be the primary key for most advertising tracking services. What a coincidence
      - alpaca128 4y ago
        You build a fake website. The victim enters their ID and password. The fake website asks for the SMS TAN. The victim gets an SMS from the actual bank and enters the TAN. Profit. It doesn't have any security benefit for phishing like this, it's just one additional password input field.
        jaclaz 4y ago
        Sure, but in this case, like in many "phishing" schemes, there is no interception of the SMS, this same approach applies to all other authentication tokens, as it is the victim that enters the OTP on the (fake) site or communicates it to the phisher who calls impersonating a bank employee.
        Eisenstein 4y ago
        > this same approach applies to all other authentication tokens Not true. FIDO and prevents this. The key is bound to the site you authorized it on, so inputting the key while connected to a phishing site will do nothing. * https://www.yubico.com/authentication-standards/fido-u2f/ https://www.yubico.com/authentication-standards/fido-u2f/
  - deleted 4y ago
    [deleted]
  - newguynewphone 4y ago
    how easy it is to sim swap, you can go to any phone store and unless the manager at the location is competent, you can get a new line in a persons name or a new phone with an old number. Its incredibly easy and you can read a lot of them happening in krebs website
- alpaca128 4y ago
  Now if only they gave me a real 2FA option that doesn't actually decrease security. So they made a fancy app where I need to confirm PC logins with a 5 digit pin. But the same app is also their official banking app and lets me do everything with my account, all with the same 5 digit pin. I don't even need to enter the credentials necessary on the PC. This is what you get when the government tries to mandate security.
  - Eisenstein 4y ago
    > This is what you get when the government tries to mandate security. The NIST actually has great guidelines for digital identity authentication: * https://pages.nist.gov/800-63-3/sp800-63-3.html https://pages.nist.gov/800-63-3/sp800-63-3.html Don't blame the government -- they outlined an ideal way to do it on many levels of need. Blame the specific people who implemented that specific system.
Gordonjcp 4y ago
Banks in the UK used to get you to enter a PIN on your phone keypad to authorise them (different PIN from your ATM cards!). I pointed out to the call handler one day that when I entered my PIN I could still hear background noise from his open mike, and did that mean he could hear what I typed? "Yes, I hear you typing in the PIN" Oho, but that's a bit of security hole, isn't it? "It's just beeps though, I can't tell what you typed" Yeah but someone suitably skilled *could*, is my point! "Yeah but it's just beeps, like this <beep beep beep beep>" Okay and you typed 1 3 5 8. "Uhhh... oh. Yes, I did. Uh, how did you do that?" I've got an ear for it. This is absolutely not a criticism of you in any way and thanks for helping me demonstrate it, but could you get your supervisor to play this call to their manager and get back to me, once we're done with the call? "Yes, I'll do that" Awesome! Now these bank transfers... They didn't call me back, but now call handlers transfer you to a totally different service to put a PIN in.
- roflyear 4y ago
  -> /r/thathappened

Eisenstein 4y ago

> For companies which should be putting security at the centre of their business, they apparently have no idea that they're normalising phishing. Yeah, this appears to have stopped, but was somewhat common a few years ago. My standard response was 'you called me, tell me who you are and I will call back on the official line'. They couldn't object to that. It was obviously some plan to 'ensure user privacy' that once it became known to one or two people with the authority to do something about it and the knowledge to know better it was quashed. Now if only they would allow you to enable 2FA options that aren't SMS and also disable SMS. They don't understand that SMS is a terrible 2FA system isn't mitigated by 'but you can enable other things' if you cannot remove SMS as an option.

moring 4y ago
I didn't know that. What makes SMS a terrible 2FA? (other than the fact that you can lose your phone, but that's true for any "have" factor)
- Eisenstein 4y ago
  "SMS-transmitted OTPs are susceptible to a variety of attacks. One is by obtaining control of a target’s cell phone number, often by calling the cellular provider or going into a retail store of the provider and impersonating the subscriber. In 2016, the chief technology officer of the US Federal Trade Commission had her number hijacked this way. In other cases, the interception is the result of compromising the mobile account because it’s protected by a password the subscriber used on a different site that was breached. Still other interceptions are the result of exploiting decade-old weaknesses in the SS7 routing protocol that carriers around the world use to ensure their networks interoperate. OTPs are also vulnerable to phishing and social engineering attacks, as long as the attackers enter the codes quickly after obtaining them." * https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev... * https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/ https://arstechnica.com/information-technology/2018/08/passw...
  - jaclaz 4y ago
    This is something I still cannot understand, in the sense that usually the procedure is the following, at least with my bank (that uses SMS OTP): On the website: 1. you input a user ID 2. you input a password or PIN 3. you press a button that sends a SMS with an OTP code to the registered cellular number 4. you input this OTP code on the site Even if someone can intercept the SMS, they wouldn't (shouldn't) have ID and PIN.
    - Firmwarrior 4y ago
      For one thing, there are a lot of security holes that let people reset passwords by getting a code via SMS For another, what's the point in having 2FA if one of the factors is completely insecure? It's just an annoyance at that point, and a good way to ... tie your account to your phone number, which just coincidentally happens to be the primary key for most advertising tracking services. What a coincidence
    - alpaca128 4y ago
      You build a fake website. The victim enters their ID and password. The fake website asks for the SMS TAN. The victim gets an SMS from the actual bank and enters the TAN. Profit. It doesn't have any security benefit for phishing like this, it's just one additional password input field.
      - jaclaz 4y ago
        Sure, but in this case, like in many "phishing" schemes, there is no interception of the SMS, this same approach applies to all other authentication tokens, as it is the victim that enters the OTP on the (fake) site or communicates it to the phisher who calls impersonating a bank employee.
        Eisenstein 4y ago
        > this same approach applies to all other authentication tokens Not true. FIDO and prevents this. The key is bound to the site you authorized it on, so inputting the key while connected to a phishing site will do nothing. * https://www.yubico.com/authentication-standards/fido-u2f/ https://www.yubico.com/authentication-standards/fido-u2f/
- deleted 4y ago
  [deleted]
- newguynewphone 4y ago
  how easy it is to sim swap, you can go to any phone store and unless the manager at the location is competent, you can get a new line in a persons name or a new phone with an old number. Its incredibly easy and you can read a lot of them happening in krebs website
alpaca128 4y ago
Now if only they gave me a real 2FA option that doesn't actually decrease security. So they made a fancy app where I need to confirm PC logins with a 5 digit pin. But the same app is also their official banking app and lets me do everything with my account, all with the same 5 digit pin. I don't even need to enter the credentials necessary on the PC. This is what you get when the government tries to mandate security.
- Eisenstein 4y ago
  > This is what you get when the government tries to mandate security. The NIST actually has great guidelines for digital identity authentication: * https://pages.nist.gov/800-63-3/sp800-63-3.html https://pages.nist.gov/800-63-3/sp800-63-3.html Don't blame the government -- they outlined an ideal way to do it on many levels of need. Blame the specific people who implemented that specific system.

Gordonjcp 4y ago

Banks in the UK used to get you to enter a PIN on your phone keypad to authorise them (different PIN from your ATM cards!). I pointed out to the call handler one day that when I entered my PIN I could still hear background noise from his open mike, and did that mean he could hear what I typed? "Yes, I hear you typing in the PIN" Oho, but that's a bit of security hole, isn't it? "It's just beeps though, I can't tell what you typed" Yeah but someone suitably skilled *could*, is my point! "Yeah but it's just beeps, like this <beep beep beep beep>" Okay and you typed 1 3 5 8. "Uhhh... oh. Yes, I did. Uh, how did you do that?" I've got an ear for it. This is absolutely not a criticism of you in any way and thanks for helping me demonstrate it, but could you get your supervisor to play this call to their manager and get back to me, once we're done with the call? "Yes, I'll do that" Awesome! Now these bank transfers... They didn't call me back, but now call handlers transfer you to a totally different service to put a PIN in.

roflyear 4y ago
-> /r/thathappened