21 ms·
Companies embracing SMS for account logins should be blamed for SIM-swap attacks
- Retr0id 3y agoCounterpoint: SMS login and account recovery is good UX, and it's the telcos that need to step up their collective game.
- neallindsay 3y agoYou know that they won't though, so why even make this argument?
- Retr0id 3y agoBy that logic, consumers and tech companies won't change either and we can bypass this whole discussion. I live in a part of the world where, on occasion, governments decide to regulate such things.
- spenvo 3y agoFrom the article: > For many years, people in the industry have invariably said something like: "Well... offering SMS-based authentication is better overall for customer security, because of its convenience (despite its shortcomings) vs other methods" (such as the far-more secure use of email for verification). To that I say: "who are YOU to deprive your customers of security?" and > Much of the ire relating to SIM-swap attacks has, understandably, been directed at carriers. Indeed, carriers do a terrible job of securing customers’ phone numbers, and may be liable for that shortcoming. But here’s the thing: carriers’ security has always been bad, it has even been legislated into being bad, and other companies have still chosen to build mission-critical systems on top of that weak link. and > Despite offering poor security, SMS offers a nearly frictionless way to sign up new customers (think of Uber's onboarding) and handle password resets, and companies felt they had to match competitors' adoption of this technique. This last bit was unfortunately overwritten in a Wordpress post update, and I added it back.
- j16sdiz 3y ago> such as the far-more secure use of email for verification Hmm.. sure? They have different threat profile. Don't think it is more secure.
- spenvo 3y agoThere is a straightforward manner to overtake your phone number (call your carrier and use social engineering). There is nothing you, the customer, can do to lock that down. (I've tried with my carrier.) With email, you can lock that down with robust 2FA (Google Authenticator/Authy/etc) and crooks have no straightforward way of defeating that. This is how it plays out year after year and why SIM-swap gangs are so prevalent.
- j45 3y agoTelcos are not responsible for using fingerprint or facial recognition as joint user+password. When it comes to good UX it’s important to clarify whose goals it’s best for: compromise security for convenience and adoption of an app? Or setting up the user to succeed more. SMS is a lazy form of 2Fa. it reminds one of the descriptions of sms being an open postcard. Theatre and pageantry have limited value where it sets users up for much worse
- pdntspa 3y agoNo, it's not, and it's fucking annoying to deal with. I am on my desktop computer, stop sending me to my phone just to log in because you don't want to support FIDO or some other form of real 2FA. There's a fingerprint reader on my laptop, face id on my phone, and a yubikey in my USB. Fucking use it
- 2OEH8eoCRo0 3y ago> There's a fingerprint reader on my laptop, face id on my phone, and a yubikey in my USB. Great! Not everyone has that! I do but if I could only implement one type of 2FA I'd probably still pick SMS.
- chrispeel 3y agoEveryone can get an app on their phone or computer that supports TOTP, such as Google Authenticator https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password
- gruez 3y agoWhat happens when they smash their phone and now you have to do account recovery? With SMS authentication you can presumably offload that to the carrier.
- supertrope 3y agoThe problem is customer support load. Also what does the company do about those without a smartphone? No smartphone no service? This is why businesses peg account authentication to phone numbers. It offloads IAM overhead to phone companies.
- pdntspa 3y agoWho cares. Spend the money on customer service people then. Companies don't need all the profits they make and investors dont need their 10000x returns when 9900x will do just fine.
- batch12 3y agoFrom the examples I've seen, the attackers essentially become the customer. They've either socially engineered the customer or done research to gain access to enough information to validate themselves as the customer. Come up with a solution and sell it. You'll make some money.
- batch12 3y agoWell that got me thinking. You could stand up a third party verification service and sell the offering to companies that don't want to be bothered with authenticating the user. Something like Okta (I know, bad example when talking infosec at the moment) for real life.
- wahnfrieden 3y agoThey won't pay for it
- batch12 3y agoWith the right legal language, I think they would.
- batch12 3y agoI just realized this does exist (kinda) in the US with identogo. Could be an easy service offering for them or a partner for another company focused on the mfa issue.
- dcow 3y agoThere are numerous ID-proofing services out there.
- lxgr 3y agoSomebody already pays for it. Once regulations ensure that it's the companies skimping on KYC themselves, most will happily outsource that task to the cheapest (compliant) provider.
- 3y ago
- johnneville 3y agowhile it works well a majority of the time, it results in an exceptionally bad UX if you lose your phone, don't have reception, or are traveling outside of your service area
- justin_oaks 3y agoI once worked in a building with terrible cell reception. I hated anything that required SMS for 2FA because I'd have to go outside to get the text message. My in-laws lived in an area with poor cell reception too. Whenever I'd go there, I couldn't use SMS either. Both of those places had good Internet service. Any time SMS was required, my UX was terrible. Hooray for anyone who supported TOTP, email, or any other form of 2FA.
- mooreds 3y agoI wrote a comment 11 days ago talking about SMS for a second factor, but it applies in general as well: https://news.ycombinator.com/item?id=39130032 https://news.ycombinator.com/item?id=39130032 Email is better, for sure, but mostly because email providers are either controlled by the user (for us nerds with a custom domain) or a large, impersonal entity (google or similar). Neither is available to change by attackers in the same way as phone number providers are. I work for an identity provider and we have a number of folks who want us to support this, almost always from a UX perspective. I think that there also needs to be some onus on the phone providers, as suggested above. With the continued push to have the phone number as a global identifier (offline and online), we need our telco providers to require more to change phone numbers.
- lxgr 3y ago> With the continued push to have the phone number as a global identifier (offline and online), we need our telco providers to require more to change phone numbers. No, we need to push back on this user-hostile trend, not stick on yet more band-aids. Phone numbers are country-specific, impossible to own in any meaningful way for private individuals (unlike e.g. domain names), and add an unnecessary point of failure.
- kelseyfrog 3y agoCounter-counterpoint, when companies implement a system with a known flaw, then they're responsible for the consequences of creating that system.
- batch12 3y agoOTP can be social engineered, hardware keys can be stolen, who determines what constitutes a flaw? Edit: also, do both pay in this case? The telcom and the service?
- tamimio 3y agoThat’s a problem with the user, not the protocol or the system, users have been and will be always the weakest point, but they are accountable for it if it happens, not the case for sim swap attacks.
- batch12 3y agoYes, true. However- to paraphrase a red team operations book I read, if the user can be tricked into into compromising your security with a click, then you can't blame the user. An organization's defensive security strategy should not hinge on a single user's decision to click or not. Edit: I am swapping users with you, sorry for the confusing reply. I'm thinking telcom employee, you user of the app that got swapped (I think, apologies if I am wrong)
- tamimio 3y agoHa! I was going to say if you solve the user vulnerability then congratulations, all systems are mostly safe! Before reading that you meant telecom employees. The reality is TOTP despite any issues, is far more secure and available than SMS, security for obvious reasons but also availability, you can have your TOTP token accessible everywhere (say in your password manager) but if you can’t receive an SMS because you lost your phone or maybe traveling, then you are in a tough position, maybe even locked out completely. I personally even back up the TOTP tokens so I can reuse them without being tied to specific platform/app (I am looking at you Authy!)
- crmd 3y agoIf having your account hijacked is is a good user experience then I have no idea what UX means.
- johnea 3y agoI completely disagree. Using a corporate account for personal identification is a major failure of public infrastructure. The US government should step up it's game. An individual's identity financial transactions should NOT be determined by holding an account at one of 4 mega-corporations. We should work towards something in this direction: https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/
- zeven7 3y agoGetting the government involved in this is the only worse idea than delegating to 4 major corporations. It should be delegated more broadly and users should have more options not less.
- johnea 3y agoIt's obvious that government is already involved with everyone's identification. This is analogous to the argument that government shouldn't be involved in "the free market", when the market is actually defined by the laws that regulate it. Let's just call this the "Texas Delusion"... Governments can be changed by democratic processes, corporate decision making is completely inaccessible to the public. Do people really think life would be better if goggle just ran everything?
- paiute 3y agoI’m so happy other people think this too!!! No one trusts the government, but usps is still offers pretty good privacy. I want mandatory acceptance of a gov issued ID, but at the same time i want to be able to use things anonymously.
- lrvick 3y agoNot everyone has (or wants) a phone or to grant control of their life to a cell phone carrier
- dkjaudyeqooe 3y agoYes having an SMS sent to a number you no longer own is great UX.
- Pufferbo 3y agoIf you don’t have your phone; if you’re abroad and don’t have SNS; if you’re in a building with no service; if you changed your phone number, they all suck. Also, another valid point is that often times it’s hard to tell what’s a legitimate SNS message and what’s phishing. Their phone numbers are always gibberish and sometimes change between requests.
- lxgr 3y agoIf you never move internationally, travel abroad, are outside cell coverage, and don't value security too highly, it sure is.
- __MatrixMan__ 3y agoAny auth mechanism that requires a trusted third party is hardly an auth mechanism at all.
- romwell 3y ago>Counterpoint: SMS login and account recovery is good UX, and it's the telcos that need to step up their collective game. Oh, yeah, fantastic UX. I've had my phone and credit cards stolen while traveling abroad (such a hard-to-imagine scenario, innit?), and was consequently locked out of all important services. Very good UX: being left without a phone and access to bank account and email and most messengers at the same time (thankfully, Skype isn't one of them). Double props to CitiBank for requiring SMS authentication to change the phone number on the account.
- treflop 3y agoI agree that SMS is a terrible multi-factor. But it caught on because asking people to install an app is a massive ask. Not to mention, people never save those recovery codes. Sure, you can use Authy and back up your codes but that’s pretty much squarely in the “for technical people” camp. So at the end of the day, SMS is the only real solution for your average normal person. Let’s get cellular carriers to make SIM swapping harder.
- jay_kyburz 3y agoMy bank made me install Symantec VIP. Yuck. To do my tax I need MyGovID. Also Yuck.
- zadokshi 3y agoHow did the bank “make” you do this? Does your country only have one bank?
- jay_kyburz 3y agoAs much as I hate the apps, I'm not prepared to refinance my house just to avoid installing them on my phone. Especially when the other banks probably have the same policies, or will soon.
- autarch 3y agoThe Symantec app is just a regular TOTP app but a bit more annoying. You can usually replace it. See https://locima.com/2019/06/01/replacing-symantec-vip-with-a-generic-totp-app/ https://locima.com/2019/06/01/replacing-symantec-vip-with-a-... for one method. I did this to get my Etrade account TOTP from Symantec into Authy.
- deleted 3y ago[deleted]
- pests 3y agoGoogle Authenticator now syncs to your google account.
- j45 3y agoSMS pins are anything but secure. Adding an Authenticator app much better.
- trevoragilbert 3y agoIt’s a tough pill to swallow the argument that one of the most widely used and beloved features (autofill codes from SMS) is against the best interests of the user.
- scintill76 3y agoThe argument is that autofill makes it so easy, that users accept it and companies are more likely to adopt SMS-based flows, right? Autofill doesn't seem inherently bad.
- jameshart 3y agoiOS Autofill of one time codes works with email and with true TOTP codes. Authenticating a user securely on their phone can be seamlessly secure without relying on SMS.
- pembrook 3y agoIt’s a much easier pill to swallow if said user has a US phone plan and ever tries traveling abroad. Good luck getting those SMS codes. And good luck getting the US carrier to not shut off your plan if you travel for longer than a few months.
- okanat 3y agoWell that's because US exceptionalism itself. More or less the rest of the world uses exactly the same tech for mobile so cellular roaming works in every country. It's the US carriers that try carrier proprietary tech to trap their customers into their networks. I never had problems with getting SMS around the world with roaming. It just works.
- hedora 3y agoI've never had problems with using SMS + wifi around the world without roaming. (I've had that problem domestically, due to having laptop internet with no wifi password, though.)
- TacticalCoder 3y agoMobile network operators should be blamed too. Now that said: in the EU (well in France at least), the biggest operators are teaming up and coming up with an interesting system called "SIM Verify" which is specifically crafted to make the life of SIM-swappers sad [1]. Basically companies relying on SMS can verify if a SIM card has been recently swapped and then act accordingly (like, for example, not allowing a password reset by SMS 30 minutes after a card has been SIM swapped). I'm not saying it's a panacea, but it's a start (and it's all compliant with the EU's GDPR). https://www.sfrpay.fr/Nos-solutions/Mobile-ID/SIM-Verify https://www.sfrpay.fr/Nos-solutions/Mobile-ID/SIM-Verify
- tiku 3y agoOr just make it harder to get a new sim card. Why is this so difficult? Only send the card to the correct address etc.
- mschuster91 3y ago> Only send the card to the correct address etc. That is pointless in the days of eSIM, and even before that it would result in a lot of trouble as a lot of countries don't require people to register a new residence at some government entity that can act as a source of truth.
- spenvo 3y agoThanks for highlighting this initiative, I'll add it to the article. And Done.
- protocolture 3y agoLets try the same logic everywhere else. Companies embracing password login should be blamed for sticky note thefts. Companies embracing email 2FA should be blamed for email account theft. I dont know if this holds up hey. We see this time and again. An entity that does not break the law, makes itself available to the law, and its customers get hit by a criminal entity that does not follow the law. Because we cant snap our fingers and demand the government make thieving criminals double or triple illegal, people reach for a largely innocent party and want to make their lives worse. Take a deep deep breath and let it go. Theres no unharmful level of punishing the innocent on behalf of the guilty. This is going to sound wild and crazy but the people swapping the sim should be blamed for the sim swapping attack. What? Blame the criminal? I know its a bold stance but its correct.
- mx_03 3y agoThats a strawman fallacy. You can control not writing your sticky note. You cant control a sim swap attack.
- spenvo 3y agoYup it's a strawman argument. And furthermore, even the rhetoric used to downplay the idea of holding companies accountable is off: The idea of "blame" (with some handwaving) carries weight in court and sways juries. And companies are getting sued for big sums over negligence regarding SIM-swaps, like here https://www.techmeme.com/190723/p15#a190723p15 https://www.techmeme.com/190723/p15#a190723p15
- Jiro 3y agoAT&T won that case: https://blockworks.co/news/att-crypto-sim-swap-lawsuit https://blockworks.co/news/att-crypto-sim-swap-lawsuit
- caconym_ 3y ago> Lets try the same logic everywhere else. The difference between SMS 2FA and the examples you mentioned is that the former is literally impossible to use securely because there is (AFAICT) no (American) consumer mobile provider that implements proper safeguards against unauthorized SIM swaps and similar. Any company implementing SMS 2FA ought to know this, and any company knowingly implementing a deeply flawed 2FA system and selling it to consumers as "more secure" ought to be held liable when it fails. And the sooner SMS 2FA dies, the sooner the same old websites that implement SMS 2FA and nothing else will be forced to implement something that's actually secure.
- deleted 3y ago[deleted]
- kome 3y agowhy email is not the standard? i'm forced to have a cellphone if i want to use the bank, basically
- Daz1 3y agoWhy are you forced to have a cellphone? You're free to visit the branch anytime you like.
- lotsofpulp 3y agoBecause phone numbers serve as an effective way to screen for bots. Also, they are unique and people don’t change them, so useful for tracking people.
- kome 3y agobut when they have to change them (i.e. moving to a new country), or they got stolen, it's pure pain. it's not a good system.
- lotsofpulp 3y agoFor sure, there should at least be an option for TOTP backup, but the powers that be know they would rather inconvenience a small percentage in exchange for the benefits.
- fsckboy 3y ago> Because phone numbers serve as an effective way to screen for bots. only because we allow telco rent-seeking on phone numbers.
- diego_sandoval 3y ago> [Customers] appreciate that [SMS reset is] more convenient than resets via email. Anecdotally, I'm annoyed every time I have to log into a Google account using phone verification, because I have to stand up from my desk and find my phone (which sometimes is in a different room) in order to receive the call/message with the code. TOTP is much more convenient in comparison. I don't have to stand up from my desk, because I store the codes in KeePassXC.
- toomuchtodo 3y agoCreate a passkey on each of your devices. https://www.google.com/account/about/passkeys/ https://www.google.com/account/about/passkeys/ https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... Sites that support Passkeys: https://passkeys.directory/ https://passkeys.directory/
- worthless-trash 3y agoA lot of companies still mess up passkeys, Allowing them only as a 1:1, using one terminates the session of another, or in some cases invalidates the previous passkey entirely. Its implementations specific I'm sure, hwoever its not as straight forward as one would hope.
- lxgr 3y agoAlso a favorite: "Your browser does not support Passkeys". It sure does, which these horrible sites could easily verify by invoking the single line of JavaScript [1] to learn as much, instead of assuming "Firefox -> must be unsupported". Absolutely infuriating. [1] https://gist.github.com/miguelmota/ad833d2e6f024a7189f8036641640658 https://gist.github.com/miguelmota/ad833d2e6f024a7189f803664...
- chrisfinazzo 3y agoExtra security is welcome, but I'm simultaneously terrified that I'll somehow get locked out of my Apple ID or main Gmail account. Everything I read about Passkeys says this scenario is 100% impossible, as it's based on biometrics and no longer using a text string that can get lost, but I'm still nervous AF. I've had to do the "reset a password that's behind 2FA" dance before and it makes me want to crawl in a hole and die - super duper scary. Somebody tell me to chill out.
- seanwilson 3y ago> What is a SIM-swap attack? It’s where a bad guy asks a carrier to port your cell-phone number to their phone. How do they get away with this in practice? Can't the carrier phone the number for the SIM or txt to attempt to confirm the owner? Or send you an email or postal letter with a code? Or make you go to the store to show ID? And if you claim to have no access to the above, send a txt/email/letter alert that you have 5 days to reply to before the switch happens? Do any carriers advertise themselves as having strong security against SIM-swap attacks as a unique selling point?
- zadokshi 3y agoExactly, it wouldn’t be hard for the mobile providers to require sms confirmation and/or written authorisation before a number is ported out. I don’t know if it’s government law or phone company laziness getting in the way of SIM security, but giving up on SIM security seems nonsensical and silly. Fix SIM porting security.
- donmcronald 3y agoThey could and it could be similar to emergency / fallback access in password managers. Send an SMS to the number (aka current SIM) before approving changes and force the person requesting the change to wait for X hours or days if there's no response to the SMS asking for authorization. That's what the providers around me do, but I think it's because one of them got sued a while back and we only have about 3 providers pretending to be 10 different companies (aka fake competition).
- ajsnigrutin 3y agoYep, I never understood that either.... you have to confirm your old number before you can transfer it to a new telco, so sim swaps are not really a thing. But it's primarily a US problem, and they have a lot of ID problems, like using their SSN as "passwords", and other stuff that would be impossible anywhere else (like illegal immigrants getting jobs at large companies and enrolling their kids in schools without anyone verifying who they are).
- hedora 3y agoStep 1: Confirm victim is out of cell range. Step 2: Sob story about how you lost your cell phone. Step 3: Fake ID / Social engineering. The five day wait would work well, though it doesn't protect against "I stole the phone and I yanked the SIM or looked at the push notification" attacks.
- joshe 3y agoThe problem is that average sms security is higher than email, but email CAN be much more secure. So for mass market accounts sms makes a good login confirmation and improves security. But if you've bothered to have somewhat secure email it sure would be nice to use that instead, and not worry about the 50,000 retail and support staff at telcos who can grab your sms account based on a convincing phone call. So, please, I beg of you login developers, offer email wherever you use sms now.
- deleted 3y ago[deleted]
- kredd 3y agoI understand it’s a naive statement, but in order to log in into your email you would end up relying on some other sort of 2FA. And we’re back to square one to relying on SMS, because UX of other authentication flows has irrecoverable flaws.
- hedora 3y agoExactly. You could use a trustworthy mail provider with a domain you own (registrar and DNS provider in two other accounts, probably), and then a second mail account for the 2FA for the other three accounts, but then what's the 2FA for the second email account?
- wetpaws 3y ago[dead]
- k8svet 3y agoAs usual, this conversation seems to be one side pointing out how god awful SMS is for security, usability, etc, and the other side going "but how else can we accommodate helpless users". (edit: sorry missed an important negation wording mistake) Like sure, if I could, I'd make SMS disappear, but really, I'd settle for just punishing those companies so lazy they can't roll out any non-SMS support.
- jsnell 3y ago"Companies should not let account recovery happen over SMS, they should just let the accounts be completely and irrevocably lost." The position of the post is just rigid absolutism that has no chance of surviving the real world, and it's not at all clear that the author actually has any expertise in the subject. It should be completely obvious that password + SMS 2FA is better than just a password. And while the industry has been trying hard to get people to move away from SMS 2FA (yes, the industry would actually like that, despite the author's conspiracy theories), it is slow going. TOTP has horrible ergonomics and doesn't permit passing side-channel information about what exactly is being authorized. Emails get caught in spam filters. Push-notification style app authentication is secure, but a lot of people will refuse to install your app unless you're like their bank. Yes, SMS isn't the best form of 2FA for a bunch of reasons. Sim-swaps honestly aren't one of those reasons. But they are the form that you can actually get people to use, and succeed in using. Ah, but what about single-factor SMS, you say (unlike the author, who doesn't seem to understand the difference). Again, consider the alternatives. If you don't allow for account recovery over SMS, what is your account recovery story? Human customer service will just be socially engineered as easily as the mobile operator was. TOTP seeds, recovery codes, etc can be irrecoverably lost. Phones with authentication apps can be stolen and fail to be bootrapped again. Email accounts or IDP accounts can be lost to hijackers, and are also frequently lost when people change jobs, graduate, etc. Security questions can be stolen and brute-forced. SMS has a unique property that makes it invaluable as a recovery factor: it's a globally accessible communications channel that can be bootstrapped from just your real-world identity even if lost. That said, allowing SMS for account recovery does carry some security risks. They can be managed or mitigated by e.g. require a cooling down period, during which the account owner is notified about the recovery attempt and can cancel it. But like everything in this space, those mitigations are also tradeoffs. Which tradeoffs are the right ones depends a lot on what the account is for, there's no one-size fits all.
- k8svet 3y agoI'm so frustrated reading these comments because I assume this is the logic used at these companies that make my life a daily pain in the ass. My email is more secure than my phone. This is shown to be evident on a monthly or bimonthly basis, despite insistence from sms proponents that it's the only feasible oh and also secure way. Bollocks. Every single time, it basically boils down to the truth - SMS auth is circumvental, recoverable, whatever you want to call it. And there's ample evidence of that being used for account takeovers. I honestly don't understand how this remains a discussion.
- qingcharles 3y agoIt also sucks if you lose your phone number. I haven't been able to log into my primary Google account for many years because while I have the username, the password and the recovery email address (and all the emails are forwarded to me), I no longer have the phone number associated with the account, so clearly I'm trying to break in.
- Pufferbo 3y agoOr if you’re just traveling. I’ve been logged out of accounts while abroad and with no access to SNS.
- mixmastamyk 3y agoOr refuse to give them a phone number. I lost access to two accounts where they now demand it. Even have the audacity to send me an email with “someone tried to log in with your username and password!” Yeah, that was me clowns. :-p
- diego_sandoval 3y agoI'm in a similar situation with LinkedIn. Out of nowhere, they locked me out of my account, then they asked for my phone number, and I had to put in a code received through SMS. But that was not enough, because then they asked for a national ID card (the gall!). Of course I did not send it. However, I kept trying to log in with the password and SMS code for a couple of days hoping that the ID requirement faded away, and now they say that I "have reached the maximum number of attempts. Please try again at a later date.". Well, duh. So, now I have a ghost LinkedIn account with my face and my data that I can't even delete. I'm seriously thinking about asking a bunch of people to mass report my account for racial hate speech or something so that at least it gets deleted.
- mixmastamyk 3y agoWell, keep in mind almost nothing is deleted any longer. Only a deleted_at column is populated in the database, which prevents it from being listed by default. But data is not deleted, and those accusations might last forever as well. This is where being an EU resident would be handy.
- markhahn 3y agowhat, no blame for the stupid mobile providers who let themselves get social-engineered?
- wslh 3y agoThere was a big issue with Payoneer's SMSs in Argentina under Movistar. I tried to rise the issue here in HN but got unnoticed. There is an insightful tweet [1] in Spanish that is translated as follows: """ Well guys, the payoneer mystery is solved. #PayoneerHacked - The attacker compromised the gatway SMS used to send the 2fa to Movistar customers (the platforms use this to sneak the cost) - The attacker saw 2fa messages passing from Payonerr to a Movistar phone number but had the problem of not knowing the email of the Payoneer user to change the password and make the transactions. - The attacker, to discover what email was behind each phone, set up a phishing site to try to take ONLY THE EMAIL from there and with the email + the phone + the 2fa that accessed the compromised SMS gateway in real time, he was able to change the password, access the account and send money since I kept reading the 2fa that arrived on the Movistar phones. - That's why the victims saw several real SMS with 2fa coming during the night that emptied their account. - Even if Payoneer customers had fallen for phishing, they would only have had one 2fa stolen, and not all that is needed to log in, add an account and transfer. This need makes it evident that the commitment to the SMS gateway existed. - The victims of this scam lost their money because the last mile of the security stack was compromised. Be careful, because Facebook, Twitter and others share the same gateways to save money on SMS. Here I leave a screenshot of the SMS that arrived during the early hours of the morning to a victim and that the victim was never able to share in any phishing and that were necessary to empty them. (whatever you read in the media... fruit, lots of salad and little sauce. here's the post) Thanks to everyone who cooperated. """ [1] https://twitter.com/julitolopez/status/1748440685743587811 https://twitter.com/julitolopez/status/1748440685743587811
- bernawil 3y agothe crazy part is that Payoneer would let you reset the account password just with the reset code sent by SMS, no need to prove ownership of the email address.
- charlie0 3y agoIt baffles me that we all services haven't defaulted to something like Google Authenticator or similar. Users should be given a choice.
- tamimio 3y agoThat’s what I have been saying for years every time I have an opportunity, last one few days ago https://news.ycombinator.com/item?id=39247480 https://news.ycombinator.com/item?id=39247480 But it won’t happen, that phone number is NEEDED to be tied to your identity for a lot of reasons, that’s why banks (where most people have their real identity) are still requiring a phone number.
- 486sx33 3y agoI absolutely hate SMS verification. Email providers want sms verification, my corporate Microsoft account wants SMS verification to login on PCs and then it also wants Microsoft Authenticator verification ! What it really wants is me to “stay logged in” all the damn time. On my Mac, outlook needs to relogin to Gmail in safari every damn time I clear safaris cache. What the god damn well hell. What if I changed my phone number? I’d lose access to almost everything… wait is that the point ? CIA ? NSA ? KYC ? Cmon ! The internet used to be fun, but now it’s just a hassle
- zaptheimpaler 3y agoBefore this new wave of SMS trash, we just had TOTP codes that 1password could auto fill for me on any device in any location. Now i need to pull out my phone constantly and pay for international roaming or setup SMS forwarding to travel even if I don't need the number. Yay security! If the argument is that phone number can always be recovered from real world identity, link the damn authenticator app to SMS instead of having to hand out your phone number to every company in the world.
- Groxx 3y agoThe problem is that your authenticator app doesn't give them access to a relatively stable, cross-site/app/etc identifier that they can sell for advertising peanuts.
- JumpCrisscross 3y agoRequire a phone number for account creation and support TOTP. Win-win.
- lcnPylGDnU4H9OF 3y agoIt’s a loss from the business’ perspective. They could support 2FA with SMS and check a box; to additionally support it with TOTP would only be additional cost -- albeit with the bonus of “doing it right”. Unfortunately, that’s an abstraction which a lot of businesses consider to be achieved when they can check the box.
- nikau 3y agoAlso average Muppet consumer can't manage it
- bugbuddy 3y agoNot true. If we make Yubi keys cheap enough (below $5) then everyone would want them. Everyone is already carrying around keys, they won’t mind 1 more key. Why can’t we make yubi keys cheaper?
- rinron 3y agoFor a lot of companies they choose sms for no other reason than it really limits spam and cuts down on fake accounts. People are conditioned to for the most part to be free with their phone number. Making it pretty much the only identifier that cant be easily and without cost or human effort changed(its not too hard and often normal to block voip numbers) Sure you can say well then also require some other form of authentication. these companies are trying to make money and go to a lot of effort to reduce even the slightest friction to new customers. Besides once they have sms and 98% are happy with that why put more work in? The real problem though is what other choice do they have? Yes you and i would put the effort in to both secure and properly manage better systems but when the vast majority would quickly forget or loose any other method. They have to make a system that is "secure" for them anyway, why implement other systems(yes i know you and i think it would be worth it for us but maybe the bean counters dont). Its completely understandable that the average person THINKS that sms is secure, everyone depends on their phones, uses it for very personal, private and sensitive business calls. even without tech companies using it for auth it would be exploited, just not as much. Unfortunately it would just take an incredible amount of cooperation, expense and growing pains to properly secure the telecom network. They are extremely interconnected legacy systems that are designed with the assumption there is no security besides trust. that being said they could improve things a whole lot more if they were able to verify their customers better on support calls or at least had higher security options you could enroll in. So they didnt put people who cared about security with the ones who cant even keep track of their own account numbers. Personally without governments coming together to implement a digital "secure" citizen identification system (also very scary) probably the best we can hope for and i think google now allows is after its verified by phone remove it as a authentication and recovery option and setup multiple hardware security keys/passkeys. ya people will still be idiots and use sms even when there are better options but at least some of us can be secure.
- cco 3y agoThis exact topic came up by chance at the lunch table today (I work at Stytch, we do auth). SMS as a primary (or frankly even as a second factor) is fraught. But as comments in this thread call out, they can be incredibly smooth UX for end users on mobile devices. And in fact, for some user bases, far and away more ubiquitous than emails. There are many populations that just don't have email to serve as a primary factor, but do have phone numbers. So it's a nuanced topic. Everyone, both users and developers, need to have eyes wide open to the danger and protect against it. And let's not forget the telecoms, they need to recognize that the phone number serves as a primary login factor and treat it more carefully. That might mean in person or stronger identification requirements on changes.
- aiisahik 3y agoUsing SMS makes PERFECT SENSE for the online service provider. The following are very similar but separate goals: 1. proof of account ownership (person attempting action has ownership of account) 2. limiting accounts created by non-legitimate users SMS is a very effective for (2) because few people are going to have access to 100 different phone numbers. Having a cell phone number also typically involves a personal process that requires things like your address, passport, SSN, etc. There are hoops to jump through for this. Companies rely on SMS because they can outsource the KYC process to cell phone companies. They are not doing this to have the most optimal or secure solution for proof of account ownership. People who continue to complain about this clearly has never had to make this type of auth decision for a company involved in regulated or financial services.
- aikinai 3y agoYour point is completely orthogonal to account takeover. You can require a phone number to create an account and not allow SMS to the number to takeover the account.
- hedora 3y agoWhy does the service provider care about account takeover, from a financial perspective? They can always reset the password on their end, given proof of identity (if the account matters).
- romwell 3y ago>Why does the service provider care about account takeover, from a financial perspective? Indeed, caring in any way about users of your product or service is merely a liability and a cost center.
- rrr_oh_man 3y agoI honestly don't want that type of overprotective caring that cares so. much. about you that it restricts you in meaningful ways.
- justina20 3y ago[dead]
- gui77aume 3y agoWould it make it better if it was the other way around? If user would send the ramdom code to the authenticating entity by SMS?
- WirelessGigabit 3y agoBank of America on iOS still ONLY supports text as a 2FA. On my desktop I can do username, password and YubiKey. But iOS is username, password and text, or Face ID and text. Disabling text means disabling disabling 2FA. Ridiculous.
- internet101010 3y agoCharles Schwab does "My voice is my password" when calling. That's going to cause a lot of problems in the near future if it hasn't already.
- spenvo 3y agoYes! Here is a bit I wrote on that a couple of years ago. This voice print ID tech is everywhere as well, used by financial companies, ISPs, and more! https://keydiscussions.com/2021/12/07/despite-the-prevalence-of-deepfake-audio-tech-banks-and-isps-rush-ahead-with-voice-print-authentication-%f0%9f%92%80/ https://keydiscussions.com/2021/12/07/despite-the-prevalence...
- giancarlostoro 3y agoWait.. what? Shouldnt we be blaming tel co companies for being insanely stupidly easy to hack instead? I mean I have seen teenagers talking about how easy it is. When its so easy even a minor can do it, you have a major problem.
- bonton89 3y agoThis is a common, but as much as I hate cell phone companies I don't think they ever asked for or advertised themselves as a secure identity verification solution and never should have been used as one. Tech companies saw cell phone companies had a juicy piece of PII they wanted and SMS was kind of easy to use and common so they did what tech companies do best: They dumped the hard part onto to some one else, then accused them of being out of touch and archaic when they failed to carry the tech companies water for them.
- giancarlostoro 3y agoSure, but this isnt brand new for tel cos either, this is also not impossible to resolve, like requiring in-person ID at a store, would be rather basic but more effective. The fact some kid from the UK can snatch your sim card in New Jersey is astounding.
- lxgr 3y agoWhat I hate most is when companies insist that my (Google Voice) number "can't be used for authentication" or, even more crass, "isn't a valid phone/mobile number". Some have even done this after initially allowing me to sign up using it, changing their policy sometime after I've signed up, and I usually only notice when I end up locked out of my account. Fortunately it's mostly been store apps or payment services that I can just avoid going forward, since they clearly don't value my business, but I'm concerned that one day, my bank will do the same and just lock me out of my account.
- thanksgiving 3y ago> Some have even done this after initially allowing me to sign up using it, changing their policy sometime after I've signed up, and I usually only notice when I end up locked out of my account. Viber did this to me. My Viber account is from 2012. I only found out when I switched phones.
- AnonC 3y agoBased on my experience with Google Voice, I think of not allowing Google Voice as a positive that could help people. I’ve written a little bit about why not to use Google Voice in this comment (on this same post) here: https://news.ycombinator.com/item?id=39270503 https://news.ycombinator.com/item?id=39270503 My experience may not apply to you, but it is still a risk, IMO, to rely on the “free” Google Voice.
- lxgr 3y agoThat's not a good reason to block Google Voice at all. Regular phone numbers also get recycled by phone providers after a few months of not paying the bills (or not topping up a prepaid account). The chance of me losing my regular prepaid number after a few months of traveling internationally is significantly higher than losing my Google Voice number. I also seriously doubt that blocking VoIP numbers is anything other than companies making their own lives marginally easier (because VoIP numbers can be used by people generating multiple trial accounts in case they're used as a (bad) "proof of personhood").
- balls187 3y agoAlso don’t get packages delivered to your house because badguys can steal them. Also don’t keep money in your wallet because badguys can pickpocket you. Also don’t use computers because badguys can steal your passwords. Turns out the problem is Carriers are dogshit and don’t protect their customers.
- xyst 3y agoWhat needs to be done to get rid of SMS as 2FA? Fed regulation? It will be slow (ie, took many years for the US to fully get rid of mag stripes as the standard), but at least it will motivate US companies (effects to possibly ripple across the pond) to get their shit together or find a new vendor. Multiple banks I use still use SMS as primary 2FA. Kind of sad.
- LouisSayers 3y agoSMS for any significant action on an account is terrible. 1) Phones can be lost or stolen 2) People move country 3) SMS attacks 4) Phone numbers get reused 5) Users must maintain a paid phone plan For the love of science, DO NOT tie accounts to phone numbers!!! -- edit -- I updated the first line to clarify that I'm not talking about one-off notifications etc.
- sibit 3y agoI don't know. I like when my ISP or power company let's me opt-into texts about outages and provides periodic updates (as long as you can reply STOP). I was on a 2 week camping trip and a nasty storm rolled through my home state. Power went out for 5 days and I wouldn't have known if it wasn't for the SMS notifications. I immediately cleared out my fridge and freezer when I got back.
- sdf4j 3y agoThat’s not the use case in discussion.
- sibit 3y ago> SMS for anything other than one-time use cases is terrible. I can agree it's unacceptable for security while also disagreeing with this statement.
- LouisSayers 3y agoI've updated the first line to clarify what I was meaning here
- LouisSayers 3y agoNotifications are fine, what I mean is more things like verifying it is your account, forgot password etc. Anything tied to material account actions shouldn't have anything to do with SMS. Flight delays or notifications of works in your area etc won't lead to account takeovers or denying access to your account - but the way many companies use SMS can potentially lead to this.
- shantanu77 3y agoIn India, the solution is simple. Carrier don't know sms to be recieved till the time sim swap is completed. Sms is by far the best option for 2fa
- ClassyJacket 3y agoAs someone who has moved countries before, I despise SMS authentication. It should not be used for anything, ever.
- NoPicklez 3y agoHow about they create a permanent site that guides people who have read the article in how to switch to app based 2FA? Doesn't have to name applications, but explain the process and common pitfalls people find themselves in when switching to app based 2FA and how to prevent them.
- NoPicklez 3y agoI do disagree with the title, telco's should be responsible for SIM swap attacks as they should have better processes to prevent people's mobile numbers from being ported. Additionally, whilst people rave about 2FA apps, not many people talk about an approach to recovering your 2FA app account if you lose your device or anything else.
- talkingtab 3y agoUnderstanding the root cause or causes of a problem is required before discussing a solution. Is the problem that people use SMS? Or rather is the problem that carriers allow bad actors to easily port a phone number? We know it is wrong for a carrier to do this. If we know that some used car dealers rip people off, is the fix to stop buying used cars? Then how do we fix the problem that carriers do not protect our phone numbers from being ported? We sue them. In most if not all states it is relatively easy to file a small claims case. For some reason most people do not consider this. Maybe someone could provide an example filing. Courts should and must provide relief to common citizens when they are aggrieved. If this is indeed a common problem it should be documented and fixed.
- alefarx 3y agoYikes, this is a woefully misguided attempt at a seemingly rational response. Chalk up Auth-n security to the courts? Yes, this is a known problem and, no, shrugging off the issue to the lawyers is not appropriate. Candidly it's downright irresponsible if not criminal.
- deleted 3y ago[deleted]
- Hobadee 3y agoSurprised nobody has mentioned NIST SP 800-63B §5.1.3.3. SMS based authentication is explicitly insecure and not allowed. https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB
- powerapple 3y agoWhy can I set a level of security to my account, how about let me choose how secure it should be? There are many accounts I don't care about, I don't even want to use password with it. I should be responsible for my account security, and I should make that decision.
- throwaway2990 3y agoAnyone who thinks companies using sms are to blame for sim-swap attacks are idiots. Allowing sim swap without any sort of verification is the issue. You cannot just sim swap in countries outside of America.
- qweqwe14 3y agoCouple of factors lead to companies "embracing" SMS: 1. A phone number is a useful piece of information to have on a customer (to sell to someone or whatever). 2. Some (most?) people are too dumb to manage passwords/TOTP and shouldn't be allowed to use a computer. As a result, everyone suffers and is forced to use broken SMS 2FA that can be SIM-swapped. 3. Companies want to stop bots and use phone numbers for that, even if it's a non-issue for bot operators in practice. A little inconvenience, sure, but it doesn't change the bigger picture in any way.
- wiether 3y agoCan someone recommend a 2FA app that can provide the users with confidence? I don't want to use Google Auth because I have absolutely no trust is this company and how unreliable they are with their products. I currently use Authy but it's free, offered by a company (Twilio) and I can't really see what their endgame is here. So they could drop the service one morning because it's not useful for their main business anymore. They already announced dropping their desktop apps. Say in another way : is there a security company somewhere selling a 2FA app and in which it's easier to put trust? Sure Bitwarden can provide TOTP, but then I still need to put MFA on my Bitwarden account itself.
- Maakuth 3y agoThere's TOTP support in Keepass2Android and KeepassXC (and surely other Keepass implementations too). These are open source and you can control how the password database is kept: cloud storage is supported as well as local file (that you can sync with Syncthing or whatnot).
- M4v3R 3y agoIf you’re at a point where you would have your users pay for a 2FA app why don’t build your own (or build TOTP functionality into some existing app)? TOTP is very easy to implement yourself, it’s literally just a handful lines of code.
- rrr_oh_man 3y agoIt's not that it's hard building it, but: Do you want to maintain it? On iOS, on Android? Through all update cycles? On all screen resolutions? Keeping up with the regular bullshit, especially coming from Apple? Random app store bans? Reviews? Support? etc.
- 8organicbits 3y agoI'm fascinated by the way Signal solves this problem. You can register a phone number, verify it over SMS, set up a registration lock PIN, and then have quite secure communications. The registration lock can be bypassed if someone tries to register the number (like when the phone number is assigned to someone else), waits for a while, and the previous owner doesn't re-register. Services that do SMS delivery of OTP may want to consider delivery over Signal or WhatsApp when available as they add this additional security. I've also thought about building an OAuth provider (like sign-in with Google) that does Signal-like phone number verification and lock PINs. This reduced some spam concerns, as it's harder to create burner phone numbers than email addresses. A centralized OAuth service would make it easier than having every web app need their own SMS phone verification integration.
- wraptile 3y agoHere in Thailand phone carriers re-use phone numbers every 2 years or so. Recently I forgot password to a local amazon (Lazada) and did a phone reset that logged me into some other persons account with credit card attached and everything. Also, pay as you go phone numbers tend to expire in 2 months without a way to reset this so you're always at risk of losing your identity confirmation. I really don't understand how phone numbers became so accepted as an identity confirmation.
- sairamkunala 3y agoMost Indian Banking services, Payment endpoints, OTT platforms have adapted phone numbers as identity. Your phone number is your identity. You can receive or send money only through your phone if the SIM is installed and validated by sending an SMS. Getting a replacement SIM card requires physical verification using Aadhar (Identity service) with One Time Password validation (Email/SMS). Once the new SIM is active, you will not receive any SMS for the first 24 hours after getting a replacement SIM card. This is to reduce the attack surface of SIM Swap attacks.
- Aissen 3y agoThere is a reason EU regulation has forbidden banks to use SMS as a second factor while mandating a second factor (see other comments about PDS2); I wish they had mandated open protocol solutions though…
- RecycledEle 3y agoI was confused when the author referred to "crooks," but the context implied he was not speaking of phone companies. What if phone companies simply responded to requests to port numbers by calling and texting the phone number and requesting permission? If permission is denied, have the police check on both sides if the argument on who should have that phone number.