16 ms·

Second factor SMS: Worse than its reputation

347 points by F30 2y ago

ablob 2y ago
Any push-based service would be vulnerable to this, wouldn't it? The medium doesn't matter if somewhere in the chain someone stores the message (in public).
didntcheck 2y ago
And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!
- jdiez17 2y ago
  Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.
  - hedora 2y ago
    "Less secure" depends on your threat model. I'm much less worried a hypothetical attack where I accidentally give sudo access to a malicious app than I am about the well-established ongoing attacks where Google violates the entire population's privacy, or the regular stream of malware that makes it into the official app store.
    - jampekka 2y ago
      Not that long ago it was considered a problem to have a rootkit on your machine [1]. Nowadays it's getting hard to acquire a device that hasn't been rootkitted at the factory. [1] https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo...
  - hiatus 2y ago
    > Hot take: rooted phones are inherently less secure. My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?
    - kalleboo 2y ago
      When I access my bank from my computer, I need to authenticate using a secure token, where my options are an RSA-style dedicated device or a secure (non-rooted) smartphone.
    - throwaway290 2y ago
      > What threat The threat to majority. Very very few people own a computer than a phone. And those people are much more tech savvy.
    - twelve40 2y ago
      great question! probably historical reasons: * computers have always been "rootable", so the banks can't do anything about that * phones work with "apps", which are viewed as more dangerous than websites. So they came up with the concept of app curation (monitoring large appstores for lookalikes and viruses), and by rooting/sideloading you are violating that model. * Repackaging a legit app into a malicious lookalike is relatively easy on Android, but harder to distribute if you combat rooting/sideloading. * if your phone is rooted the bank may be concerned that you could be more susceptible to installing dangerous things, including apps that intercept your 2fa. You can argue whether these points held up over time (or whether they make things more secure), but that seems to be why they do it. It costs them relatively little to try to combat rooting but potentially liable for losses if people get phished/hacked so...
  - jampekka 2y ago
    Hotter take: if you don't have root, you've been pwned.
  - lucianbr 2y ago
    There's always a root account, the only issue is who has access to it. So... phones where a corporation has root are more secure that phones where the owner has root, you say? Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you? Again, you're just a few words from "Freedom is slavery".
    - jdiez17 2y ago
      > So... phones where a corporation has root are more secure that phones where the owner has root, you say? You're putting words in my mouth that I explicitly rejected when I said "that does not include GrapheneOS". Just to prevent the follow up "well actually GrapheneOS is an organization": they don't have any kind of root access to GrapheneOS phones. The only thing they can do is push system updates, which you can (1) reject and (2) verify if they are the same updates being pushed to all users, to avoid targeted attacks. > Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you? Yes, secure for the user. Sure, power users that very carefully review any system mods they install with root powers would have the same level of security as with a non-rooted phone. But most people won't read the source code of root apps/extensions they install. It's easier to tempt mobile phone users to install "cosmetic improvement/customization whatevers" that happen to require elevated privileges, than desktop Linux users. It's well known that many Android apps bundle near-malware that slurps all data possible, and will ask for root privileges if that is detected. The fact is that mobile phones tend to contain more sensitive data than desktop computers (and are thus significantly more secure by default than Linux/Windows computers). Contacts, private messages, photos, etc. It's a more valuable target, so more effort is put in developing malware for phones.
    - deleted 2y ago
      [deleted]
- crazygringo 2y ago
  That is a security win. On a rooted phone, you've made it possible for other apps to spy on and steal your banking information. Bank apps not running on phones where security has been compromised seems entirely reasonable.
  - S201 2y ago
    > Bank apps not running on phones where security has been compromised seems entirely reasonable. I have root access on my laptop and I log in to my bank's website just fine. Making apps not run on rooted phones is just perpetuating the cycle of forcing users to comply with the restrictions placed upon them by Apple and Google. Root access != less secure. It means control over the device you paid for and own.
    - lmz 2y ago
      I don't think the root permission ban is for the website. In most cases it's about how your phone + the bank's app has become the new hardware token / key generator. Before smartphones I could log on to the bank's website but any transaction will have to be authenticated using a hardware token (presumed secure). That's moved into an app now.
    - solardev 2y ago
      ...and you're probably less safe as a result. In the 90s and early 2000s, running as root (admin) was the Windows default for home computers, and that's why we had such a malware and spyware problem then. It wasn't until UAC limited user and app permissions on purpose and Windows Defender became standard that it began to get better. Root access for you means you have control, sure. But it often does mean you're less safe too, depending on your OS's security model and what other apps can run as you. That's why limited sudo and other "root ish, but only in small doses" models were made. And that's assuming you know what you're doing. For Jane Grandma, root of any sort means power she'll never need and a footgun to lose her life savings with. It's a good thing mobile phones protect ordinary users from themselves. Most people don't need root access any more than they need the ability to reprogram the ECU on their car. Besides, on a rooted phone, I thought there were already ways to fool an app into thinking it's not rooted...? Or did they change that?
- diego_sandoval 2y ago
  At least you have an alternative. In my country, almost all banks force the use of app 2FA without SMS as an alternative. If I don't want to buy and carry an extra phone around, I'm limited to using the one bank that doesn't require it.
tamimio 2y ago
The rule of thumb is that you should always avoid any services that still rely on SMS or phone numbers as an ID or 2FA. They simply don’t care about your privacy or security, even if they advertise it. A prime example is Signal. Unfortunately, for some other services, like banks or government agencies, you don’t have any option. You can only minimize the impact by using a unique password and username and keeping them updated.
TacticalCoder 2y ago
Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing "https://online.banking.com https://online.banking.com" (just an example) to "https://online.banklng.com https://online.banklng.com" and asked ChatGPT 4o again. He said it was a phishing attempt. So, basically, you can, today, already have a screenshot automatically analyzed and have a model tell you if it's seemingly legit or not.
- shreddit 2y ago
  So what you are telling me is that windows “recall” feature could actually protect people from phishing attacks…
- mattigames 2y ago
  Did you just call chatGPT "he"? Oh that may get you in quite a lot of hot water this days!
- compootr 2y ago
  that's called a hallucination. AI models are simply guessing what to say with differing sizes of word banks At it's best, it may even "recognize" the top 90% of sites. Often, it's not a bulletproof solution, and shouldn't be trusted to generate either false positive/negative My best operational security advice is not to click shit in your inbox and navigate directly to the hostname you trust to do sensitive actions
- beepbooptheory 2y ago
  Did you ask it with the modified page in the same context?
- swatcoder 2y ago
  I know everybody's doing it because they don't know better, but it's a terrible idea to make the inductive leap from one successful sample to some abstract sense of what a ML model is suited for. Especially for anything important. As a sibling comment noted, performance will almost certainly be sensitive to temperature (randomness), exact prompt phrasing, exact sequence of messages in a dialog, and the training-data frequency of both the site being analyzed and the phishing approach used. One could conceivably train a specialized ML model, perhaps with an LLM component, to detect sophsticated phishing attempts and I would assume this has even been done. But using a relying on generic "helpful chatbot" to do that reliably and sufficiently is a really bad idea. That's not what it's for, not what's good at, and not something its vendor promises for it to remain good at even if it happens to be today.
refurb 2y ago
In Singapore, the banks have moved away from SMS entirely, even for notifications. Now they have to come through the app. But for login you basically register a single phone, download a certificate to it and that becomes your second factor. If you login via web or another phone, you need to approve the login from that phone. Of course if you lose the phone (or it's damaged) you need to go to the bank to fix it, but that seems like a reasonable approach.
efitz 2y ago
Several financial institutions I work with require 2FA with SMS, and do not offer an option for HOTP/TOTP. FML.
unstatusthequo 2y ago
I like that IdentifyMobile's website[0] isn't even protected with a valid HTTPS cert. Falls back to HTTP. Oh and it's WordPress. And last updated 2015. Guess that's all telling. Nice that so many important companies used this crappy provider for such things. [0] http://www.identifymobile.com/ http://www.identifymobile.com/
simoncunningham 2y ago
Certain financial institutions in some regions mandate telephone-network based 2FA for their customers accounts, and in the event of an account compromise attempt to pin the onus of liability on the customer. Maddening they wont give customers better options if they want to secure themselves.
seoulmetro 2y ago
That's because SMS verification isn't 2FA. It's faux 2FA. You don't possess your phone app or your phone number... it can be cloned and intercepted. A key you hold on your person is 2FA.
deleted 2y ago
[deleted]
F30 2y ago
"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."
- slow_typist 2y ago
  Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).
  - lmz 2y ago
    > most of them should be able to build their own service. Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.
    - stavros 2y ago
      No, the hard part is having to secure all these little random services that I've now built. Why would I not just pay for someone whose job it was to worry about this instead?
    - PinguTS 2y ago
      So you say, that for Google, Amazon, Facebook, Microsoft, which are among those costumers, it is too hard to negotiate with the various teclos?
      - lmz 2y ago
        Not in the US at least for those companies, but the world is a big place and this other comment https://news.ycombinator.com/item?id=40935323 https://news.ycombinator.com/item?id=40935323 mentioned places like Gambia and Burkina Faso... It just makes sense to outsource local delivery to companies that are better connected locally.
kkfx 2y ago
The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope a day or another people will understand and IMPOSE an end to such crappy unsafe practice.
- worksonmine 2y ago
  Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.
  - buccal 2y ago
    NFC/RFID in many mobile devices allows for interfacing smart cards very similarly to wired connection.
    - commandersaki 2y ago
      Yeah but it's a tradeoff in usability, that's an accessory that needs to be provisioned and carried around.
      - kkfx 2y ago
        How many have a smartphone with a cover able to hold cards? How many have wallet in their pockets? Where the trade off in usability? Having a sole pin and a card to access various services instead of passwords and copypasting OTP or something similar with crappy and dysfunctional apps.
        commandersaki 2y ago
        > How many have a smartphone with a cover able to hold cards? I use a wallet that holds cards, but not common or popular, and are you seriously suggesting that we insert this thing into our phones, which would probably mean you'd have to dislodge from the case, wallet or not, and align the card into the slot. Not to mention how much space it'd consume in a smart phone. You & maybe a very tiny cohort want this, the general public don't, especially for the marginal security benefit. Anyways as others say, the modern equivalent is NFC, but again getting everyone to buy and carry an accessory is asking too much. Modern smartphones already have modern security and in recent years have been exposing their security coprocessor chip to the OS.
throw0101d 2y ago
If the choice between no 2FA and SMS, which is better?
- ossobuco 2y ago
  As the linked post says itself, "2FA-SMS is Better Than Nothing"
  - hun3 2y ago
    But it's also the most cost expensive (from provider side) among 1FA and 2FA-OTP
    - pilif 2y ago
      I think conversion rate and support cost associated with 2FA-OTP are worse enough for SMS to still be worth it, especially as a phone number also gives you a good marketing ability and a reasonably unique identifier for a user. If not, everybody would be using OTP already.
      - reginald78 2y ago
        That is what everyone dances around in these discussions. It doesn't matter if it is a good second factor because it is an excellent user tracking identifier and that is what they were really after. Twitter and facebook both lied about only using these numbers for security and then almost immediately put them to use for advertising purposes. We only know about it because they were big enough to sue, I'm sure every crappy site that gets the number sells it. As a bonus, it also allows them to dump a lot of the infrastructure and support problems onto some one other than themselves. The biggest problem with SMS-2FA in my opinion is a lot of places are setup so it isn't even a second factor. I can often reset my password just through email so it just seems like throwing a threadbare blanket marked security over the top of a user tracking scam.
  - upofadown 2y ago
    I would argue that a 1FA unguessable password used once is just as good. Certainly better than the case where the provider offers account resets using just SMS thus having effectively 1FA SMS.
sleepyhead 2y ago
Apparently the messages on the S3 bucket were updated every five minutes: https://www.zeit.de/digital/datenschutz/2024-07/it-sicherheit-datenschutz-passwoerter-zwei-faktor-authentifizierung-sicherheitsluecke https://www.zeit.de/digital/datenschutz/2024-07/it-sicherhei... The CCC definition of this being only 2FA-SMS is incorrect though. It was not only Twilio Verify (2FA API) that was affected, it was all SMS sent through this vendor.
- PinguTS 2y ago
  Where do you have the Twillio Verify reference from? It is nowhere mentioned.
  - sleepyhead 2y ago
    It is not but CCC is indicating that this provider was only used for 2FA. Sorry I was getting a bit ahead of myself here, this was earlier exposed as a breach of Twilio's vendor (IdentifyMobile). In the case of Twilio they offer an API for 2FA, Twilio Verify. I wanted to clarify that this breach was not only for 2FA, Verify API in the case of Twilio, but for all SMS sent through IdentifyMobile.
averageRoyalty 2y ago
Hardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.
- TonyTrapp 2y ago
  It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.
  - averageRoyalty 2y ago
    Okay, but the transport layer (SMS) is independent of the issue here. Email, push, even carrier pidgeon OTPs would suffer the same issue. Also, storing secrets is day to day life in a lot of scenarios.
  - commandersaki 2y ago
    I don't see why SMS would need to write to a store, public or not. One can implement SMS-2FA using TOTP for example, it's just that the TOTP secret is not shared with the recipient.
    - TonyTrapp 2y ago
      Yes, it is not a technical necessity to store these messages. But there is the option to do it (and some people are evidently doing it). The point is that for one-time-passwords, it's not even an option, not matter how hard you try. You simply cannot make this class of mistake. Unless you try really really hard to fuck up and, say, for some very weird reason, exfiltrate the one-time passwords generated on the user's device every few seconds.
      - warkdarrior 2y ago
        How does the bank verify the OTP generated on the user's device?
deleted 2y ago
[deleted]
skilled 2y ago
Twilio said the data was accessible between May 10 and May 15, 2024[0]. I mean, even if we disregard the auth codes thing, which according to CCC were being generated on a static timer, if someone did get access to this bucket - they would have gotten away with a juicy list of phone numbers and names from some of the top companies, at the very least. I'm not sure how hard it would be for an S3 scanner to guess "idmdatastore", so it is difficult to say if anyone else got in. Even if not, a live database storing live data without encryption or anything is crazy. I feel like IdentifyMobile will feel the wrath of this no matter what. [0]: https://stackdiary.com/twilio-issues-an-alert-about-a-security-incident-with-a-3rd-party-carrier/ https://stackdiary.com/twilio-issues-an-alert-about-a-securi...
dools 2y ago
A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the addition of a new "pay anyone" payee, and with that her money was gone[0]. I have accounts with 2 banks, one uses SMS 2fa and the other uses an app which generates a token. I had thought that the app was by default a better choice because of the inherent lack of security in SMS as a protcol BUT in the above attack the bank that sends the SMS would have been better because they send a different message when you're doing a transfer to a new payee than when you're logging in. So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. I haven't seen any bank with that level of 2fa yet, has anyone else? I guess perhaps passkeys make this obsolete anyway since it establishes a local physical connection to a piece of hardware. [0] Ron Howard voice: "she eventually got it back"
- recursive 2y ago
  If the business model of your search engine is based on ads, your (search user) relationship with them is fundamentally adversarial. Ad blockers will get you some temporary respite, but it doesn't change the nature. This is an observation from a happy kagi subscriber that doesn't use an ad block.
- ikekkdcjkfke 2y ago
  ADS ARE THE PRIMARY WAY ELDERS GET DEFRAUDED
- solardev 2y ago
  FYI, passkeys do not require anything in hardware. You can connect them to software only password managers like 1Password or Bitwarden. Where they are nice though is that they are also tied to a specific origin (domain), so a phishing site can't ask for the real passkey. But I've never seen a passkey be a primary source of authentication, so they can always fool the user to falling back to some weaker auth (email reset or 2fa).
0xbadcafebee 2y ago
I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's password managers built into browsers in addition to the 3rd party ones. There are personal, family, and enterprise options. They could be installed as a system service to isolate them from userland attacks. They support advanced functionality like SSH keys, git signing and biometrics. If you're a stickler about having a completely independent factor from your desktop/phone/etc, password managers could be used with different profiles on different devices, and allow several easy ways to pass an auth token between devices (via sound, picture, bluetooth, network, etc), ensuring an independent device authenticates the login to avoid malware attacking the password manager. We already have the tools to do something way more secure than SMS, and it's already on most of our devices/browsers. We just have to make it the preferred factor.
- amluto 2y ago
  > I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. A password manager is, in essentially every respect except interoperability, inferior to WebAuthn. Let’s not make an inferior solution mandatory when we already have a superior solution.
  - deleted 2y ago
    [deleted]
  - jampekka 2y ago
    > Let’s not make an inferior solution mandatory when we already have a superior solution. With a slight caveat that it doesn't work. At least not on Linux without some proprietary junk dongles or their emulators.
    - mixmastamyk 2y ago
deleted 2y ago
[deleted]
LorenDB 2y ago
I think we should just ban companies from implementing SMS 2FA. https://lorendb.dev/posts/lets-ban-sms-2fa/ https://lorendb.dev/posts/lets-ban-sms-2fa/
- JohnMakin 2y ago
  This causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.
  - Tepix 2y ago
    But did you RTFA? SMS aggregators can also be hacked or can leak SMSs by accident.
    - JohnMakin 2y ago
      This would still be a targeted attack if exploited, and arguably much more difficult than sim swapping. And yes, I did RTFA, and my point still stands.
  - mixmastamyk 2y ago
    Ban would need to be combined with a requirement for something else.
elric 2y ago
I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.
- calfuris 2y ago
  I've seen it forced on non-public-facing systems where the company already has everyone's phone number, so that can't be the only reason.
- rafram 2y ago
  That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!
  - lolinder 2y ago
    > the new SSNs - unique identifiers that never change and connect you across services And just like SSNs both the "unique" and the "never change" are only true of the spherical cow version of the system. Phone numbers are actually substantially worse at being unique and unchanging, what with people in families sharing a phone or trading phone numbers, people forgetting to transfer the number when switching carriers, people intentionally switching numbers in an attempt to end spam calls... The number of ways to break the assumed invariants is actually quite high. See Falsehoods Programmers Believe About Phone Numbers [0]. [0] https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md https://github.com/google/libphonenumber/blob/master/FALSEHO...
  - dylan604 2y ago
    since COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device. I know I'm not the first person to be unable to port a number, so calling a phone number something that never changes is a bit skewed
Hobadee 2y ago
NIST has explicitly said you shouldn't use SMS 2FA for a while now: NIST SP 800-63B §5.1.3.3. https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB
- brandon272 2y ago
  The perspectives and interests of NIST and the things that a service provider has has to worry about with respect to their customer/user experience are not necessarily aligned. Customer: "What do you mean two factor app? I thought the code was supposed to come to my phone?" Support: "It did, but we no longer support SMS two factor authentication." Customer: "But I had no problems when the code came to my phone." Support: "Yes, but NIST recommends that we don't use SMS 2FA" Customer: "What's NIST? I'm finding this very frustrating, I need to get into my account."
  - Hello71 2y ago
    it would be most convenient to have no 2FA. hell, skip the password too, then nobody will forget theirs. security is tradeoffs, but NIST says "if you take security seriously, you should not use SMS 2FA".
  - LordKeren 2y ago
    It’s all a gradual improvement over time though, as both companies are able to adopt better practices and customers become accustomed to it. Many, many more people are using TOPT than a decade ago.
  - akira2501 2y ago
    > Customer: "But I had no problems when the code came to my phone." "Unfortunately, many of our other customers, and customers of other financial institutions were not correctly protected by the code alone.. and were still getting scammed or confused.. and losing _all_ their money." > Customer: "[...] I'm finding this very frustrating, I need to get into my account." "That is understandable, but we take the security of your account and your personal information very seriously, and this requires us to make changes to maintain that security in the face of new threats and actors as they evolve."
omh 2y ago
The article conflates two issues that have different security implications. The "1-click login" links are a concern and just having access to the SMS would be enough to take over things like WhatsApp. But 2FA codes seem notably less worrying. They are the second factor and require an attacker to have the password too. For these cases I'm much more relaxed about the use of SMS and the risks of interception.
- pphysch 2y ago
  > They are the second factor and require an attacker to have the password too. For every leaked database of SMS messages there are 1000 leaked databases of account credentials
  - omh 2y ago
    Good point. But what's the threat model here? I didn't think of 2FA as being protection against password reuse. People should still avoid reusing passwords and change them if they know of a breach. Are there really attackers who are picking up breach databases and then sim-swapping to get the 2FA as well?
  - samspot 2y ago
    I think 999 of those databases are the same data set. I lost a password ten years ago from a blog breach and I get almost a monthly notification about it showing up again and again.
bigmattystyles 2y ago
It always feel useless when you get the second factor on the very device you are logging in from. I know it's not because you still have to physically have the device but instinctively, I always think true 2FA should involve different devices.
cpcallen 2y ago
In the UK it seems that almost all online banking transactions are now verified by SMS. As far as I can tell this is required by law, and replaced the previous, bank card + card reader + pin verification system, which was not only more secure but also did not depend on having a working mobile phone with signal. I hope that this will in due course be recognised as a terrible mistake and rectified. Unfortunately my hope is only faint.
- switch007 2y ago
  First line is not true at all. SMS is an option, but many support app based 2fa Agree about the card reader being useful for offline. But I never remembered the thing and was often stuck when travelling
- xnorswap 2y ago
  Which bank? I'm with LLoyds and transactions are verified via the app, not SMS.
  - howerj 2y ago
    Same with Natwest / Virgin. I do not think I have ever verified anything with SMS banking wise, sometimes you get alerts via SMS though.
    - funmi 2y ago
      Same with HSBC (globally actually, not just in the UK).
DanielHB 2y ago
Sweden solved this problem years ago with BankID https://en.wikipedia.org/wiki/BankID https://en.wikipedia.org/wiki/BankID It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great. It is incredible there is no system like this for every country, heck it is incredible that there isn't a system like this for the whole EU.
- mixmastamyk 2y ago
  Is it true that it doesn’t support Linux as the wiki implies? I guess the card form could be used instead.
  - DanielHB 2y ago
    It is pretty complicated for the average person to install custom certificates on their OS. I didn't even knew that BankID supported it, pretty much every one uses the app.
- jampekka 2y ago
  EU is introducing Digital Wallet for this. I hope it will nicer to use than the Finnish version of BankID. Also would be nicer to be less dependent of banks or other private rent-seeking institutions. Not having too high hopes though. https://ec.europa.eu/digital-building-blocks/sites/display/EUDIGITALIDENTITYWALLET/EU+Digital+Identity+Wallet+Home https://ec.europa.eu/digital-building-blocks/sites/display/E...
RajBhai 2y ago
How about the login service send the code encrypted in the SMS such that it can only be decrypted on the phone of the actual user? Still vulnerable to phishing attempts, but better than relying on deficiencies of SMS technology .
weinzierl 2y ago
Can someone explain to me how SIM swapping actually works? All the articles and videos I found are like: 1. Attacker calls phone companies support hotline or alternatively his confidante there 2. ** MAGIC ** 3. Atacker has access to SMS messages sent to victims number I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview. And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address.
- toast0 2y ago
  If you have a never registered, not expired SIM for a carrier, the carrier can register it to an account given the IMSI. You can also do this with eSIM without needing a physical SIM. So, step 1, convince the carrier representative. Step 2, give the the IMSI. Step 3, put the sim in your phone and receive SMS. If you do step 1 in a physical store, the representative will probably give you a new sim from their stack even.
  - weinzierl 2y ago
    Thanks, this is the hint I needed.
- zinekeller 2y ago
  Except for state-level attacks (in which case you're screwed anyways), in some countries the process tends to be lax (on-the-spot issuance of replacement SIM without robust identity verification or allowing SIM replacement to any arbitary address without verification). This also does not consider insider attacks, where people in the company... can just re-issue any SIM for any number they please (and therefore there are people who are willing to issue illicit SIMs in exchange for money).
- mnw21cam 2y ago
  > And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address. That's basically SIM-swapping. The only step you haven't described is getting the new SIM sent somewhere else, which probably isn't too hard a thing to achieve given sufficient corruption. Ultimately, the phone company uses its information to work out where to send an SMS, and that information is an entry in a database - SMS to number X is routed to SIM card ID Y. If an inside job can change that database entry for a while, that's enough to attack SMS-2FA.
rsync 2y ago
Random thought I’ve been having as we keep bringing this topic up these past few weeks… How interesting or uninteresting would bi-modal 2FA be ? That is: you receive a code by text and you enter the code by email… I haven’t spent any time to work out whether this significantly changes the attack surface but… At first glance it does seem like you would need to own two different account types… … So I guess a first question would be: does this exist anywhere? Has anyone ever seen this or done this?
- hypercube33 2y ago
  How do you secure email then? This obviously won't work for login to that.
- warkdarrior 2y ago
  Bi-modal 2FA is already here: you receive a code by text and you enter the code in your web browser (or a proprietary app like a banking app). Moving from web browser to email for entering the 2FA code means that you (the user) have to make sure to send email to the correct address, not one provided by the attacker.
thepasswordis 2y ago
I’ve recently become pretty disillusion with 2FA in general. Google has recently started enforcing their own “click yes on already authorize mobile device” 2FA, which is very frustrating. I have hardware 2FA keys that I keep in a safe. I deliberately do not keep them on me, and using them to re-auth is mentally an “event”. This is not the case with my cell phone, which my kids play with, gets left on my dresser while the cleaners work, etc. Really pushing me to run my own services again, but that obviously comes with its own challenges.
- warkdarrior 2y ago
  Google lets you choose which authenticators to use (SMS, push to mobile, TOTP, etc). It sounds like you should disable push to mobile for your accounts.
  - thepasswordis 2y ago
    You cannot disable this anymore. You can add a hardware key, but cannot disable the mobile confirmation thing.
uconnectlol 2y ago
Wow SMS 2FA forced bullshit that suddenly got astroturfed right on the day of the Snoweden revelations is actually indeed bullshit. When will they have opt out of this or is this just the end of the web? 20 years ago I did not need or want anything more than a password (obviously cryptographic key auth would be better but not if it's brought to you by X.509). And of course all the HNers who eat this shit up and defend it like little dogs are suddenly on the other side. Email verification is fucking dumb too, and of course now every email forces phone SMS shit.

347 points by F30 2y ago

Any push-based service would be vulnerable to this, wouldn't it? The medium doesn't matter if somewhere in the chain someone stores the message (in public).

didntcheck 2y ago

And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!

jdiez17 2y ago
Hot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.
- hedora 2y ago
  "Less secure" depends on your threat model. I'm much less worried a hypothetical attack where I accidentally give sudo access to a malicious app than I am about the well-established ongoing attacks where Google violates the entire population's privacy, or the regular stream of malware that makes it into the official app store.
  - jampekka 2y ago
    Not that long ago it was considered a problem to have a rootkit on your machine [1]. Nowadays it's getting hard to acquire a device that hasn't been rootkitted at the factory. [1] https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo...
- hiatus 2y ago
  > Hot take: rooted phones are inherently less secure. My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?
  - kalleboo 2y ago
    When I access my bank from my computer, I need to authenticate using a secure token, where my options are an RSA-style dedicated device or a secure (non-rooted) smartphone.
  - throwaway290 2y ago
    > What threat The threat to majority. Very very few people own a computer than a phone. And those people are much more tech savvy.
  - twelve40 2y ago
    great question! probably historical reasons: * computers have always been "rootable", so the banks can't do anything about that * phones work with "apps", which are viewed as more dangerous than websites. So they came up with the concept of app curation (monitoring large appstores for lookalikes and viruses), and by rooting/sideloading you are violating that model. * Repackaging a legit app into a malicious lookalike is relatively easy on Android, but harder to distribute if you combat rooting/sideloading. * if your phone is rooted the bank may be concerned that you could be more susceptible to installing dangerous things, including apps that intercept your 2fa. You can argue whether these points held up over time (or whether they make things more secure), but that seems to be why they do it. It costs them relatively little to try to combat rooting but potentially liable for losses if people get phished/hacked so...
- jampekka 2y ago
  Hotter take: if you don't have root, you've been pwned.
- lucianbr 2y ago
  There's always a root account, the only issue is who has access to it. So... phones where a corporation has root are more secure that phones where the owner has root, you say? Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you? Again, you're just a few words from "Freedom is slavery".
  - jdiez17 2y ago
    > So... phones where a corporation has root are more secure that phones where the owner has root, you say? You're putting words in my mouth that I explicitly rejected when I said "that does not include GrapheneOS". Just to prevent the follow up "well actually GrapheneOS is an organization": they don't have any kind of root access to GrapheneOS phones. The only thing they can do is push system updates, which you can (1) reject and (2) verify if they are the same updates being pushed to all users, to avoid targeted attacks. > Secure for whom? For the user? Seems obviously wrong. It's more secure for someone else to have power over you? Yes, secure for the user. Sure, power users that very carefully review any system mods they install with root powers would have the same level of security as with a non-rooted phone. But most people won't read the source code of root apps/extensions they install. It's easier to tempt mobile phone users to install "cosmetic improvement/customization whatevers" that happen to require elevated privileges, than desktop Linux users. It's well known that many Android apps bundle near-malware that slurps all data possible, and will ask for root privileges if that is detected. The fact is that mobile phones tend to contain more sensitive data than desktop computers (and are thus significantly more secure by default than Linux/Windows computers). Contacts, private messages, photos, etc. It's a more valuable target, so more effort is put in developing malware for phones.
  - deleted 2y ago
    [deleted]
crazygringo 2y ago
That is a security win. On a rooted phone, you've made it possible for other apps to spy on and steal your banking information. Bank apps not running on phones where security has been compromised seems entirely reasonable.
- S201 2y ago
  > Bank apps not running on phones where security has been compromised seems entirely reasonable. I have root access on my laptop and I log in to my bank's website just fine. Making apps not run on rooted phones is just perpetuating the cycle of forcing users to comply with the restrictions placed upon them by Apple and Google. Root access != less secure. It means control over the device you paid for and own.
  - lmz 2y ago
    I don't think the root permission ban is for the website. In most cases it's about how your phone + the bank's app has become the new hardware token / key generator. Before smartphones I could log on to the bank's website but any transaction will have to be authenticated using a hardware token (presumed secure). That's moved into an app now.
  - solardev 2y ago
    ...and you're probably less safe as a result. In the 90s and early 2000s, running as root (admin) was the Windows default for home computers, and that's why we had such a malware and spyware problem then. It wasn't until UAC limited user and app permissions on purpose and Windows Defender became standard that it began to get better. Root access for you means you have control, sure. But it often does mean you're less safe too, depending on your OS's security model and what other apps can run as you. That's why limited sudo and other "root ish, but only in small doses" models were made. And that's assuming you know what you're doing. For Jane Grandma, root of any sort means power she'll never need and a footgun to lose her life savings with. It's a good thing mobile phones protect ordinary users from themselves. Most people don't need root access any more than they need the ability to reprogram the ECU on their car. Besides, on a rooted phone, I thought there were already ways to fool an app into thinking it's not rooted...? Or did they change that?
diego_sandoval 2y ago
At least you have an alternative. In my country, almost all banks force the use of app 2FA without SMS as an alternative. If I don't want to buy and carry an extra phone around, I'm limited to using the one bank that doesn't require it.

tamimio 2y ago

The rule of thumb is that you should always avoid any services that still rely on SMS or phone numbers as an ID or 2FA. They simply don’t care about your privacy or security, even if they advertise it. A prime example is Signal. Unfortunately, for some other services, like banks or government agencies, you don’t have any option. You can only minimize the impact by using a unique password and username and keeping them updated.

TacticalCoder 2y ago

Out of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing "https://online.banking.com https://online.banking.com" (just an example) to "https://online.banklng.com https://online.banklng.com" and asked ChatGPT 4o again. He said it was a phishing attempt. So, basically, you can, today, already have a screenshot automatically analyzed and have a model tell you if it's seemingly legit or not.

shreddit 2y ago
So what you are telling me is that windows “recall” feature could actually protect people from phishing attacks…
mattigames 2y ago
Did you just call chatGPT "he"? Oh that may get you in quite a lot of hot water this days!
compootr 2y ago
that's called a hallucination. AI models are simply guessing what to say with differing sizes of word banks At it's best, it may even "recognize" the top 90% of sites. Often, it's not a bulletproof solution, and shouldn't be trusted to generate either false positive/negative My best operational security advice is not to click shit in your inbox and navigate directly to the hostname you trust to do sensitive actions
beepbooptheory 2y ago
Did you ask it with the modified page in the same context?
swatcoder 2y ago
I know everybody's doing it because they don't know better, but it's a terrible idea to make the inductive leap from one successful sample to some abstract sense of what a ML model is suited for. Especially for anything important. As a sibling comment noted, performance will almost certainly be sensitive to temperature (randomness), exact prompt phrasing, exact sequence of messages in a dialog, and the training-data frequency of both the site being analyzed and the phishing approach used. One could conceivably train a specialized ML model, perhaps with an LLM component, to detect sophsticated phishing attempts and I would assume this has even been done. But using a relying on generic "helpful chatbot" to do that reliably and sufficiently is a really bad idea. That's not what it's for, not what's good at, and not something its vendor promises for it to remain good at even if it happens to be today.

refurb 2y ago

In Singapore, the banks have moved away from SMS entirely, even for notifications. Now they have to come through the app. But for login you basically register a single phone, download a certificate to it and that becomes your second factor. If you login via web or another phone, you need to approve the login from that phone. Of course if you lose the phone (or it's damaged) you need to go to the bank to fix it, but that seems like a reasonable approach.

efitz 2y ago

Several financial institutions I work with require 2FA with SMS, and do not offer an option for HOTP/TOTP. FML.

unstatusthequo 2y ago

I like that IdentifyMobile's website[0] isn't even protected with a valid HTTPS cert. Falls back to HTTP. Oh and it's WordPress. And last updated 2015. Guess that's all telling. Nice that so many important companies used this crappy provider for such things. [0] http://www.identifymobile.com/ http://www.identifymobile.com/

simoncunningham 2y ago

Certain financial institutions in some regions mandate telephone-network based 2FA for their customers accounts, and in the event of an account compromise attempt to pin the onus of liability on the customer. Maddening they wont give customers better options if they want to secure themselves.

seoulmetro 2y ago

That's because SMS verification isn't 2FA. It's faux 2FA. You don't possess your phone app or your phone number... it can be cloned and intercepted. A key you hold on your person is 2FA.

deleted 2y ago

[deleted]

F30 2y ago

"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."

slow_typist 2y ago
Look at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).
- lmz 2y ago
  > most of them should be able to build their own service. Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.
  - stavros 2y ago
    No, the hard part is having to secure all these little random services that I've now built. Why would I not just pay for someone whose job it was to worry about this instead?
  - PinguTS 2y ago
    So you say, that for Google, Amazon, Facebook, Microsoft, which are among those costumers, it is too hard to negotiate with the various teclos?
    - lmz 2y ago
      Not in the US at least for those companies, but the world is a big place and this other comment https://news.ycombinator.com/item?id=40935323 https://news.ycombinator.com/item?id=40935323 mentioned places like Gambia and Burkina Faso... It just makes sense to outsource local delivery to companies that are better connected locally.

kkfx 2y ago

The modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope a day or another people will understand and IMPOSE an end to such crappy unsafe practice.

worksonmine 2y ago
Many people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.
- buccal 2y ago
  NFC/RFID in many mobile devices allows for interfacing smart cards very similarly to wired connection.
  - commandersaki 2y ago
    Yeah but it's a tradeoff in usability, that's an accessory that needs to be provisioned and carried around.
    - kkfx 2y ago
      How many have a smartphone with a cover able to hold cards? How many have wallet in their pockets? Where the trade off in usability? Having a sole pin and a card to access various services instead of passwords and copypasting OTP or something similar with crappy and dysfunctional apps.
      - commandersaki 2y ago
        > How many have a smartphone with a cover able to hold cards? I use a wallet that holds cards, but not common or popular, and are you seriously suggesting that we insert this thing into our phones, which would probably mean you'd have to dislodge from the case, wallet or not, and align the card into the slot. Not to mention how much space it'd consume in a smart phone. You & maybe a very tiny cohort want this, the general public don't, especially for the marginal security benefit. Anyways as others say, the modern equivalent is NFC, but again getting everyone to buy and carry an accessory is asking too much. Modern smartphones already have modern security and in recent years have been exposing their security coprocessor chip to the OS.

throw0101d 2y ago

If the choice between no 2FA and SMS, which is better?

ossobuco 2y ago
As the linked post says itself, "2FA-SMS is Better Than Nothing"
- hun3 2y ago
  But it's also the most cost expensive (from provider side) among 1FA and 2FA-OTP
  - pilif 2y ago
    I think conversion rate and support cost associated with 2FA-OTP are worse enough for SMS to still be worth it, especially as a phone number also gives you a good marketing ability and a reasonably unique identifier for a user. If not, everybody would be using OTP already.
    - reginald78 2y ago
      That is what everyone dances around in these discussions. It doesn't matter if it is a good second factor because it is an excellent user tracking identifier and that is what they were really after. Twitter and facebook both lied about only using these numbers for security and then almost immediately put them to use for advertising purposes. We only know about it because they were big enough to sue, I'm sure every crappy site that gets the number sells it. As a bonus, it also allows them to dump a lot of the infrastructure and support problems onto some one other than themselves. The biggest problem with SMS-2FA in my opinion is a lot of places are setup so it isn't even a second factor. I can often reset my password just through email so it just seems like throwing a threadbare blanket marked security over the top of a user tracking scam.
- upofadown 2y ago
  I would argue that a 1FA unguessable password used once is just as good. Certainly better than the case where the provider offers account resets using just SMS thus having effectively 1FA SMS.

sleepyhead 2y ago

Apparently the messages on the S3 bucket were updated every five minutes: https://www.zeit.de/digital/datenschutz/2024-07/it-sicherheit-datenschutz-passwoerter-zwei-faktor-authentifizierung-sicherheitsluecke https://www.zeit.de/digital/datenschutz/2024-07/it-sicherhei... The CCC definition of this being only 2FA-SMS is incorrect though. It was not only Twilio Verify (2FA API) that was affected, it was all SMS sent through this vendor.

PinguTS 2y ago
Where do you have the Twillio Verify reference from? It is nowhere mentioned.
- sleepyhead 2y ago
  It is not but CCC is indicating that this provider was only used for 2FA. Sorry I was getting a bit ahead of myself here, this was earlier exposed as a breach of Twilio's vendor (IdentifyMobile). In the case of Twilio they offer an API for 2FA, Twilio Verify. I wanted to clarify that this breach was not only for 2FA, Verify API in the case of Twilio, but for all SMS sent through IdentifyMobile.

averageRoyalty 2y ago

Hardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.

TonyTrapp 2y ago
It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.
- averageRoyalty 2y ago
  Okay, but the transport layer (SMS) is independent of the issue here. Email, push, even carrier pidgeon OTPs would suffer the same issue. Also, storing secrets is day to day life in a lot of scenarios.
- commandersaki 2y ago
  I don't see why SMS would need to write to a store, public or not. One can implement SMS-2FA using TOTP for example, it's just that the TOTP secret is not shared with the recipient.
  - TonyTrapp 2y ago
    Yes, it is not a technical necessity to store these messages. But there is the option to do it (and some people are evidently doing it). The point is that for one-time-passwords, it's not even an option, not matter how hard you try. You simply cannot make this class of mistake. Unless you try really really hard to fuck up and, say, for some very weird reason, exfiltrate the one-time passwords generated on the user's device every few seconds.
    - warkdarrior 2y ago
      How does the bank verify the OTP generated on the user's device?

deleted 2y ago

[deleted]

skilled 2y ago

Twilio said the data was accessible between May 10 and May 15, 2024[0]. I mean, even if we disregard the auth codes thing, which according to CCC were being generated on a static timer, if someone did get access to this bucket - they would have gotten away with a juicy list of phone numbers and names from some of the top companies, at the very least. I'm not sure how hard it would be for an S3 scanner to guess "idmdatastore", so it is difficult to say if anyone else got in. Even if not, a live database storing live data without encryption or anything is crazy. I feel like IdentifyMobile will feel the wrath of this no matter what. [0]: https://stackdiary.com/twilio-issues-an-alert-about-a-security-incident-with-a-3rd-party-carrier/ https://stackdiary.com/twilio-issues-an-alert-about-a-securi...

dools 2y ago

A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the addition of a new "pay anyone" payee, and with that her money was gone[0]. I have accounts with 2 banks, one uses SMS 2fa and the other uses an app which generates a token. I had thought that the app was by default a better choice because of the inherent lack of security in SMS as a protcol BUT in the above attack the bank that sends the SMS would have been better because they send a different message when you're doing a transfer to a new payee than when you're logging in. So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. I haven't seen any bank with that level of 2fa yet, has anyone else? I guess perhaps passkeys make this obsolete anyway since it establishes a local physical connection to a piece of hardware. [0] Ron Howard voice: "she eventually got it back"

recursive 2y ago
If the business model of your search engine is based on ads, your (search user) relationship with them is fundamentally adversarial. Ad blockers will get you some temporary respite, but it doesn't change the nature. This is an observation from a happy kagi subscriber that doesn't use an ad block.
ikekkdcjkfke 2y ago
ADS ARE THE PRIMARY WAY ELDERS GET DEFRAUDED
solardev 2y ago
FYI, passkeys do not require anything in hardware. You can connect them to software only password managers like 1Password or Bitwarden. Where they are nice though is that they are also tied to a specific origin (domain), so a phishing site can't ask for the real passkey. But I've never seen a passkey be a primary source of authentication, so they can always fool the user to falling back to some weaker auth (email reset or 2fa).

0xbadcafebee 2y ago

I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's password managers built into browsers in addition to the 3rd party ones. There are personal, family, and enterprise options. They could be installed as a system service to isolate them from userland attacks. They support advanced functionality like SSH keys, git signing and biometrics. If you're a stickler about having a completely independent factor from your desktop/phone/etc, password managers could be used with different profiles on different devices, and allow several easy ways to pass an auth token between devices (via sound, picture, bluetooth, network, etc), ensuring an independent device authenticates the login to avoid malware attacking the password manager. We already have the tools to do something way more secure than SMS, and it's already on most of our devices/browsers. We just have to make it the preferred factor.

amluto 2y ago
> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. A password manager is, in essentially every respect except interoperability, inferior to WebAuthn. Let’s not make an inferior solution mandatory when we already have a superior solution.
- deleted 2y ago
  [deleted]
- jampekka 2y ago
  > Let’s not make an inferior solution mandatory when we already have a superior solution. With a slight caveat that it doesn't work. At least not on Linux without some proprietary junk dongles or their emulators.
  - mixmastamyk 2y ago

deleted 2y ago

[deleted]

LorenDB 2y ago

I think we should just ban companies from implementing SMS 2FA. https://lorendb.dev/posts/lets-ban-sms-2fa/ https://lorendb.dev/posts/lets-ban-sms-2fa/

JohnMakin 2y ago
This causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.
- Tepix 2y ago
  But did you RTFA? SMS aggregators can also be hacked or can leak SMSs by accident.
  - JohnMakin 2y ago
    This would still be a targeted attack if exploited, and arguably much more difficult than sim swapping. And yes, I did RTFA, and my point still stands.
- mixmastamyk 2y ago
  Ban would need to be combined with a requirement for something else.

elric 2y ago

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

calfuris 2y ago
I've seen it forced on non-public-facing systems where the company already has everyone's phone number, so that can't be the only reason.
rafram 2y ago
That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!
- lolinder 2y ago
  > the new SSNs - unique identifiers that never change and connect you across services And just like SSNs both the "unique" and the "never change" are only true of the spherical cow version of the system. Phone numbers are actually substantially worse at being unique and unchanging, what with people in families sharing a phone or trading phone numbers, people forgetting to transfer the number when switching carriers, people intentionally switching numbers in an attempt to end spam calls... The number of ways to break the assumed invariants is actually quite high. See Falsehoods Programmers Believe About Phone Numbers [0]. [0] https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md https://github.com/google/libphonenumber/blob/master/FALSEHO...
- dylan604 2y ago
  since COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device. I know I'm not the first person to be unable to port a number, so calling a phone number something that never changes is a bit skewed

Hobadee 2y ago

NIST has explicitly said you shouldn't use SMS 2FA for a while now: NIST SP 800-63B §5.1.3.3. https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB

brandon272 2y ago
The perspectives and interests of NIST and the things that a service provider has has to worry about with respect to their customer/user experience are not necessarily aligned. Customer: "What do you mean two factor app? I thought the code was supposed to come to my phone?" Support: "It did, but we no longer support SMS two factor authentication." Customer: "But I had no problems when the code came to my phone." Support: "Yes, but NIST recommends that we don't use SMS 2FA" Customer: "What's NIST? I'm finding this very frustrating, I need to get into my account."
- Hello71 2y ago
  it would be most convenient to have no 2FA. hell, skip the password too, then nobody will forget theirs. security is tradeoffs, but NIST says "if you take security seriously, you should not use SMS 2FA".
- LordKeren 2y ago
  It’s all a gradual improvement over time though, as both companies are able to adopt better practices and customers become accustomed to it. Many, many more people are using TOPT than a decade ago.
- akira2501 2y ago
  > Customer: "But I had no problems when the code came to my phone." "Unfortunately, many of our other customers, and customers of other financial institutions were not correctly protected by the code alone.. and were still getting scammed or confused.. and losing _all_ their money." > Customer: "[...] I'm finding this very frustrating, I need to get into my account." "That is understandable, but we take the security of your account and your personal information very seriously, and this requires us to make changes to maintain that security in the face of new threats and actors as they evolve."

omh 2y ago

The article conflates two issues that have different security implications. The "1-click login" links are a concern and just having access to the SMS would be enough to take over things like WhatsApp. But 2FA codes seem notably less worrying. They are the second factor and require an attacker to have the password too. For these cases I'm much more relaxed about the use of SMS and the risks of interception.

pphysch 2y ago
> They are the second factor and require an attacker to have the password too. For every leaked database of SMS messages there are 1000 leaked databases of account credentials
- omh 2y ago
  Good point. But what's the threat model here? I didn't think of 2FA as being protection against password reuse. People should still avoid reusing passwords and change them if they know of a breach. Are there really attackers who are picking up breach databases and then sim-swapping to get the 2FA as well?
- samspot 2y ago
  I think 999 of those databases are the same data set. I lost a password ten years ago from a blog breach and I get almost a monthly notification about it showing up again and again.

bigmattystyles 2y ago

It always feel useless when you get the second factor on the very device you are logging in from. I know it's not because you still have to physically have the device but instinctively, I always think true 2FA should involve different devices.

cpcallen 2y ago

In the UK it seems that almost all online banking transactions are now verified by SMS. As far as I can tell this is required by law, and replaced the previous, bank card + card reader + pin verification system, which was not only more secure but also did not depend on having a working mobile phone with signal. I hope that this will in due course be recognised as a terrible mistake and rectified. Unfortunately my hope is only faint.

switch007 2y ago
First line is not true at all. SMS is an option, but many support app based 2fa Agree about the card reader being useful for offline. But I never remembered the thing and was often stuck when travelling
xnorswap 2y ago
Which bank? I'm with LLoyds and transactions are verified via the app, not SMS.
- howerj 2y ago
  Same with Natwest / Virgin. I do not think I have ever verified anything with SMS banking wise, sometimes you get alerts via SMS though.
  - funmi 2y ago
    Same with HSBC (globally actually, not just in the UK).

DanielHB 2y ago

Sweden solved this problem years ago with BankID https://en.wikipedia.org/wiki/BankID https://en.wikipedia.org/wiki/BankID It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great. It is incredible there is no system like this for every country, heck it is incredible that there isn't a system like this for the whole EU.

mixmastamyk 2y ago
Is it true that it doesn’t support Linux as the wiki implies? I guess the card form could be used instead.
- DanielHB 2y ago
  It is pretty complicated for the average person to install custom certificates on their OS. I didn't even knew that BankID supported it, pretty much every one uses the app.
jampekka 2y ago
EU is introducing Digital Wallet for this. I hope it will nicer to use than the Finnish version of BankID. Also would be nicer to be less dependent of banks or other private rent-seeking institutions. Not having too high hopes though. https://ec.europa.eu/digital-building-blocks/sites/display/EUDIGITALIDENTITYWALLET/EU+Digital+Identity+Wallet+Home https://ec.europa.eu/digital-building-blocks/sites/display/E...

RajBhai 2y ago

How about the login service send the code encrypted in the SMS such that it can only be decrypted on the phone of the actual user? Still vulnerable to phishing attempts, but better than relying on deficiencies of SMS technology .

weinzierl 2y ago

Can someone explain to me how SIM swapping actually works? All the articles and videos I found are like: 1. Attacker calls phone companies support hotline or alternatively his confidante there 2. ** MAGIC ** 3. Atacker has access to SMS messages sent to victims number I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview. And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address.

toast0 2y ago
If you have a never registered, not expired SIM for a carrier, the carrier can register it to an account given the IMSI. You can also do this with eSIM without needing a physical SIM. So, step 1, convince the carrier representative. Step 2, give the the IMSI. Step 3, put the sim in your phone and receive SMS. If you do step 1 in a physical store, the representative will probably give you a new sim from their stack even.
- weinzierl 2y ago
  Thanks, this is the hint I needed.
zinekeller 2y ago
Except for state-level attacks (in which case you're screwed anyways), in some countries the process tends to be lax (on-the-spot issuance of replacement SIM without robust identity verification or allowing SIM replacement to any arbitary address without verification). This also does not consider insider attacks, where people in the company... can just re-issue any SIM for any number they please (and therefore there are people who are willing to issue illicit SIMs in exchange for money).
mnw21cam 2y ago
> And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address. That's basically SIM-swapping. The only step you haven't described is getting the new SIM sent somewhere else, which probably isn't too hard a thing to achieve given sufficient corruption. Ultimately, the phone company uses its information to work out where to send an SMS, and that information is an entry in a database - SMS to number X is routed to SIM card ID Y. If an inside job can change that database entry for a while, that's enough to attack SMS-2FA.

rsync 2y ago

Random thought I’ve been having as we keep bringing this topic up these past few weeks… How interesting or uninteresting would bi-modal 2FA be ? That is: you receive a code by text and you enter the code by email… I haven’t spent any time to work out whether this significantly changes the attack surface but… At first glance it does seem like you would need to own two different account types… … So I guess a first question would be: does this exist anywhere? Has anyone ever seen this or done this?

hypercube33 2y ago
How do you secure email then? This obviously won't work for login to that.
warkdarrior 2y ago
Bi-modal 2FA is already here: you receive a code by text and you enter the code in your web browser (or a proprietary app like a banking app). Moving from web browser to email for entering the 2FA code means that you (the user) have to make sure to send email to the correct address, not one provided by the attacker.

thepasswordis 2y ago

I’ve recently become pretty disillusion with 2FA in general. Google has recently started enforcing their own “click yes on already authorize mobile device” 2FA, which is very frustrating. I have hardware 2FA keys that I keep in a safe. I deliberately do not keep them on me, and using them to re-auth is mentally an “event”. This is not the case with my cell phone, which my kids play with, gets left on my dresser while the cleaners work, etc. Really pushing me to run my own services again, but that obviously comes with its own challenges.

warkdarrior 2y ago
Google lets you choose which authenticators to use (SMS, push to mobile, TOTP, etc). It sounds like you should disable push to mobile for your accounts.
- thepasswordis 2y ago
  You cannot disable this anymore. You can add a hardware key, but cannot disable the mobile confirmation thing.

uconnectlol 2y ago

Wow SMS 2FA forced bullshit that suddenly got astroturfed right on the day of the Snoweden revelations is actually indeed bullshit. When will they have opt out of this or is this just the end of the web? 20 years ago I did not need or want anything more than a password (obviously cryptographic key auth would be better but not if it's brought to you by X.509). And of course all the HNers who eat this shit up and defend it like little dogs are suddenly on the other side. Email verification is fucking dumb too, and of course now every email forces phone SMS shit.