4 ms·
A leaky database spilled 2FA codes for the tech giants
- advisedwang 3y agoEqually galling to the leak itself is that XY is storing text messages long after delivering them. Inexcusable.
- everfrustrated 3y agoAll SMS providers retain full messages for spam/abuse analysis, etc. SMS is not a secure message transport and has never been advised as such.
- advisedwang 3y agoThis FOIA'd DoJ doc from 2010 seems few major carriers retain SMS contents, and only one for more than a week: https://www.aclu.org/cell-phone-location-tracking-request-response-cell-phone-company-data-retention-chart https://www.aclu.org/cell-phone-location-tracking-request-re...
- palmfacehn 3y agoHow many more reasons do we need to not use SMS as an authentication tool?
- jasfi 3y agoDon't 2FA codes have short expiry times?
- hughesjj 3y agoDoesn't matter if you have live access. It's on demand. This is why real 2fa is 'something you have' not 'something else you know) The assumption here is that sms 2fa requires something you have, but that's always been really horny for telephone numbers, since the phone company is the one that actually 'has' numbers
- JamesSwift 3y agoIn this case it turned out that “something you have” was “access to prod”
- hyperman1 3y agoThe error: A database connected straight to the internet. This description alone points to multiple organizational failures: * Nobody did security scans from the outside * Managing the firewall failed or the firewall does not exist. * They have a culture where having production systems without passwords is acceptable. Also: They don't know who has access to their production data. * Their customers rely on a third party without regular audits We probably can go on like this for a while.
- vinay_ys 3y agoOnly thing that's both safe and convenient to use is FIDO2 physical keys. For 2FA I hate it when services provide more secure options like FIDO2 keys and least secure options like SMS OTP and no way to disable them. Even worse is when some sites still do security questions.