12 ms·

SMS 2FA is not just insecure, it's also hostile to mountain people

• apexalpha 1y ago
  The article does not support the title in my opinion. This has little to do with living in a mountain but more having an ISP that doesn’t support a lot of default telco functionality.
• Calwestjobs 2y ago
  TOTP, HOTP. SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.
  • gruez 2y ago
    >your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that. This is mostly a red herring because most of the places that require SMS TOP already have your full name/address (eg. financial institutions, healthcare providers) or are in a position to intercept communications that they can infer that information (eg. google). If apps/sites like tiktok wants my phone number for 2fa, they can fuck off, or get a burner number.
    • Calwestjobs 2y ago
      yes marketer gets your name from bank etc, you can not lie there about your name. and everywhere else, your data is connected just your number. same problem with signal messenger or facebook messenger building databases of numbers and contacts. neo4j clone from palantir.
    • globie 2y ago
      I don't understand how this post stacks up against the myriad of communications apps that not only require phone verification when creating a new profile (and maybe SMS2FA), but put great effort into blocking as many VoIP/burner/prepaid numbers as possible. "Most"? maybe "a troubling few"? Phone verification is absolutely a widely exploited data mining opportunity, I don't see how it's a red herring at all. It's one of the worst surveillance mechanisms we live with today, only partially waved away with the 2000's concept of burner numbers.
      • PaulHoule 2y ago
        To single out Meta properties, I'd point to both Instagram and WhatsApp. It was an official policy early on that you could only create a WhatsApp account if it was connected to a "real" cellular number, I think the same has been true about Instagram for a while in that every time I tried to create an account without a cellular number it didn't work. Put in a cellular number and it worked just fine.
        • reginald78 2y ago
          Last time I tried to create a throwaway account for facebook it didn't actually ask for my mobile number. Just automatically banned me for being suspicious and then demanded a video of my head with no assurance that would actually help. I generally avoid meta but it seems like most craiglist sales have moved to facebook marketplace.
  • lxgr 2y ago
    Neither TOTP nor HOTP provide "what you see is what you sign" property, unfortunately, which can be critical for bank and other transactions. "Enter this code only if you want to pay <amount> to <merchant>" is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example). Not even WebAuthN provides that property on a compromised computer; for that, you'd need something like the SPC extension [1] and a hardware authenticator with a small display. That's unfortunately why we're currently stuck with proprietary bank confirmation apps that can provide it. I really wish there was a vendor-neutral standard for it, but given how push notifications work (or rather don't work) for federated client apps, I'm not holding my breath. [1] https://www.w3.org/TR/secure-payment-confirmation/ https://www.w3.org/TR/secure-payment-confirmation/
    • vanburen 2y ago
      Yeah this is a big problem. I have been sent 2F messages via WhatsApp by some services (e.g. PayPal). This isn't great, but better then SMS and having to have a separate app for each authenticating service though. A vendor neutral service would be a lot nicer.
    • Calwestjobs 1y ago
      only system which does it securely is bitcoin cold wallet / offline computer signed transaction or as you pointed out, signing it on smartcard with keypad reader. but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline. and there is no way for attacker to MITM, and here lies the problem. companies can not blame you as easily as with currently deployed technologies... they hide breaches all the time, f... PCI
      • lxgr 1y ago
        > but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline. and there is no way for attacker to MITM There totally is! How do you know you're entering the TOTP on a legitimate website? WebAuthN prevents that, both by not letting you use a given key on the wrong website, and by including the origin in the signature generated using the key which the relying party can then check for plausibility.
• deleted 2y ago
  [deleted]
• some_random 2y ago
  This is a really good point, "cell service will always be available" is a classic incorrect assumption that needs to be shattered. I do kinda wonder what the correct way forward is, I think it's silly that ISPs don't support this type of SMS over wifi but I have no clue why. Meanwhile TOTP apps are rightly pointed out to be too numerous with unclear trade offs, I'm surprised ios and android don't have native TOTP apps (afaik). As an aside, I hate the nuance-less "SMS 2FA is insecure" line. It's the weakest 2FA form for sure, but it's still so much better than not having 2FA. Even if you support multiple options depending on your product it may very well make sense to stick with SMS as the default to reduce friction.
  • thesuitonym 2y ago
    I'm pretty sure they both do have TOTP but it's not well documented that it even exists, and it's difficult for regular users to use. In iOS it in the Passwords app (née Keychain) and in Android I think it's buried in the settings app of all places. People don't know it exists and don't know how to use it, and even if they did, unless you're already using it for password management, it's difficult to know how to find it. Instructions usually default to a single authenticator app, like Google Authenticator or Microsoft Authenticator, so people end up with multiple apps (Not to mention the garbage adware that always pops up in app store search). And half the time the instructions simply say "Your authenticator app," which doesn't help Joe Schmoe who has no clue where he saved that OTP.
    • reginald78 2y ago
      Many of the big companies seem to really want you to use their app so there's this big game of smoke and mirrors to avoid saying it is TOTP or what they're actually doing. And of course they make it as big of a pain to export your codes as they can get away with. Then they hide behind it being complicated and that is why they have to do this to help grandma, but much of complexity is due to their obfuscation.
  • hocuspocus 2y ago
    > I'm surprised ios and android don't have native TOTP apps (afaik). They do. Google's Authenticator is as close as it gets to a native Android app, and your secret keys are sync'ed in Google's cloud for a while now (it's a shame they waited so long). Apple's Keychain has supported TOTP for ages too. That said OTPs over RCS instead of SMS are a major improvement if you don't mind your phone number being used as an identifier.
• modeless 2y ago
  Google Fi can receive all SMS 2 factor messages on Wi-Fi including short codes. It doesn't even require that your phone is on, you can get them in any web browser on any device even if your phone is destroyed. One of my favorite features. You can get service starting at $20 per month. Fi used to have good service in some mountain areas too, with US Cellular. Not sure what's going on with US Cellular right now though. Some kind of half acquisition by T-Mobile.
  • Ozarkian 2y ago
    I have been living outside the United States for twelve years. I always had problems with SMS until I got Google Fi. And that's a problem because, as the article here says, many banks insist on SMS these days. There are various services that give you a virtual number. But they always suffer from one of two problems: (1) VOIP numbers are 'blacklisted' by some banks for security reasons: they want a real cell phone number (2) I simply don't get SMSs in some cases some technical reason Google Fi works everywhere. Even when there is no cell phone service: it will tunnel over WiFi. Google shuts off the data on Fi after you've been outside the USA for a month. No problem, I'm happy to pay $25 a month for a 'dataless' connection that gives me SMS and voice.
    • arccy 2y ago
      compared to prices for the rest of the world, you wouldn't want to use Fi for data anyway... just get a local or even "travel" esim and run with dual sims.
      • devoutsalsa 2y ago
        I’ve found that it’s easy to data-only eSIM package through an app store app such as Saily, but it’s harder to find a service that gives you a “real” phone number when traveling internationally. Any recommendations?
        • AnonC 2y ago
          I don’t have direct experience, but I’ve heard about or seen the following online (there may be many other MVNOs). All of them are activated with an eSIM and they have WiFi calling, which means it’s a real US phone number as any other and you can make/receive calls and send/receive SMS as long as you’re connected to the internet via WiFi or through a data connection on your second SIM on the phone. If you wish, you can buy real roaming too, but that tends to be expensive. * Tello * Red Pocket * Good to Go Mobile If you’re looking for a real local phone number in the location you’re traveling to, then eSIM providers like Airalo can handle that (Airalo has “global plans” that support voice and SMS). Getting such a connection for voice and SMS, as compared to a data SIM alone, would be expensive. So you could get a data eSIM that works locally and use that for “WiFi” calling/SMS with the providers mentioned above.
• jaoane 2y ago
  When you choose an eccentric lifestyle you should accept the loss of certain features.
  • dingnuts 2y ago
    the article is about a retired woman who lives twenty minutes from Asheville, NC. The terrain is rugged there, but it is not an "eccentric lifestyle" It is extremely typical, however, to see the most basic needs of Appalachian people ignored on the grounds of their perceived choice of lifestyle just this weekend I endured yet another incest joke.. I bet you have one of those ready too
    • dboreham 2y ago
      There's plenty of locations with houses in Montana that have no cell service too.
      • dingnuts 2y ago
        the article isn't about them. Montana by and large is a lot less dense than Asheville NC, which is a small city surrounded by normal towns. Asheville would only seem eccentric if normal is San Francisco.
        • hedora 2y ago
          There’s no cell service in many places that are 20 minutes from Silicon Valley or SF. Heck, there are places that are a 20 minute walk from Apple and Google HQ without cell service.
  • pyrale 2y ago
    > When you choose an eccentric lifestyle Many "eccentric" lifestyles are not chosen. For instance not owning a smartphone or not having access to power easily is not necessarily limited to well-off tech-savv hipsters who want to make a statement, homeless people, older people in less connected areas or people in developing countries can also be in that situation. When you make your services depend on specific access, and you give people without it no escape hatch, your service becoming successful usually means worsening access for people that have fewer means to adapt.
• tlb 2y ago
  I wonder what the companies requiring 2FA think about uncompleted 2FA bounces. Deterred fraudster? Short attention span? SMS sucks?
  • vbezhenar 2y ago
    Every second SMS authorization does not reach my phone. Just yesterday I couldn't log in to my GitHub from new computer, because my phone did not receive authentication code. I didn't have any bans because of that. I think that a lot of people experience similar problems, so it makes no sense to look for fraudsters, 99.9999% will be false negatives.
    • hocuspocus 2y ago
      There's really no reason to use SMS 2FA for GitHub though, you can literally pick anything else.
      • vbezhenar 2y ago
        Anything else could be lost. I can always get new SIM card for this number. I don't need to backup it and I can't accidentally delete it. That's the biggest reason for me to link phone number everywhere. I'd hate to lose access to my GitHub account.
        • hocuspocus 2y ago
          I don't see how I could simultaneously lose my three hardware keys (laptop, phone and Yubikey) and backup codes.
        • tlb 2y ago
          It's also not very hard for scammers to get a SIM card for your number, unless you're using a carrier that specializes in not allowing SIM swapping attacks.
          • hocuspocus 2y ago
• VoodooJuJu 2y ago
  [dead]
• Neywiny 2y ago
  Much agreement with the others that there's too much expectation. I rented a lime scooter for the first time last year. But, I messed up my VPN settings so I had no Internet. There was no way to tell the scooter I'm done. Even though it was stopped, no button to end the ride. They refunded me the extra time (which was maybe 5 of the 10 minutes) because they could see it was just stopped at a bike rack on gps. Idk what I'd do if my phone died or any other reasonably possible things when you're out and about and on a scooter.
  • TonyTrapp 2y ago
    Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.
    • lxgr 2y ago
      Are you sure that the locker has an Internet connection? Requiring Bluetooth and an Internet connection on your phone suggests that that's exactly what they removed on their side. Quite clever, if true – why pay for network connectivity if you can just piggy back on your customers'? (Nevermind those customers without a smart phone and data plan...)
      • TonyTrapp 2y ago
        > Are you sure that the locker has an Internet connection? Let's put it like this: The old ones (with a display) definitely do, because they can send email notifications. I would be very much surprised if the new ones didn't. The main reason for requiring the app isn't connectivity to the outside world, it is that they can save money on the terminal screens, which get vandalized frequently in some areas. The internet connection is probably a fraction of the cost of replacing those touch screens every few months.
    • 2y ago
• dreamcompiler 2y ago
  1. Download the Google Voice app. This phone number works for some but not all 2FA services. Not all, because some explicitly forbid GV numbers because they're afraid of fraud. GV can receive SMS messages over wifi. 2. Ask the cell phone company for a femtocell. These used to be called "AT&T Microcells" and they were cheap. I used one before cell service improved because I live in the mountains. But apparently AT&T don't make them any more and now they cost $2500. https://www.waveform.com/products/verizon-network-extender-for-enterprise-3 https://www.waveform.com/products/verizon-network-extender-f... 3. Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal; I use it because I find it easier to use my laptop keyboard to type SMS messages than to use my thumbs on my phone.
  • lxgr 2y ago
    > Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal It can't – how would it? The only entity that can forward texts is the carrier, and I doubt that that service is integrated with all US carriers to somehow get them forwarded (which is technically quite difficult for various legacy protocol reasons). Apple's satellite messaging service is the only solution I know of that can somehow hook into carriers' SMS home router (or IMS equivalent) infrastructure to intercept and out-of-band forward SMS.
    • hedora 2y ago
      Sms and signaling system 7 are incredibly insecure. It has to be so it can support scammers that call you from spoofed numbers. Anyway, it’s probably possible to make a service like that. You might need to route through a country with permissive laws.
      • lxgr 2y ago
        SS7 is very insecure, yes, but intercepting inbound SMS is still orders of magnitude more difficult than spoofing sender/caller numbers. Allowing SMS interception without the home network's consent seems like a quick way to get offboarded as a roaming partner.
• brettanomyces 2y ago
  TOTP are okay for some things but often regulation means each code/challenge needs to be tied to a specific action. TOTP codes typically last for 30s and mulitple actions can happen within 30s, so it's not possible to use TOTP in many cases. PUSH approval could be used instead but then you need to download an app for every service you use, which isn't very convenient. PASSKEYS offer a solution which will work on both web and mobile and don't require you to download an app for every service. But it's a new concept that people need to learn so how fast they will be adopted is yet to be seen.
  • lxgr 2y ago
    Beyond "just" being phishing resistant, for banking/payments, WebAuthN even has the opportunity of providing "what you see is what you sign": The Secure Payment Confirmation [1] extension to WebAuthN supports using passkeys on third-party sites (think merchant checkouts) and including signed structured messages (think "confirm payment of <amount> at <merchant> on <today>"). It wouldn't be crazy to imagine authenticators with small OLED displays to provide an end-to-end secure channel for displaying that information, similarly to how cryptocurrency hardware wallets already do it. Of course, this would require a certain popular hardware and software manufacturer with a competing payment solution to implement the extension... [1] https://www.w3.org/TR/secure-payment-confirmation/ https://www.w3.org/TR/secure-payment-confirmation/
  • devoutsalsa 2y ago
    My personal 2FA favorite is OTP + authenticator app. It behaves predictably and doesn’t have weird failure conditions. SMS 2FA tied to your mobile number sucks if it doesn’t support Google Voice, especially when traveling internationally and your SIM card isn’t in your phone. Email 2FA usually works, but I just find it annoying. App-specific push notifications mostly work, but it’s hard to debug if you don’t get the notification. For example, I recently bought a new phone and all of my apps were reinstalled when I restored from a cloud backup. For some reason app notifications didn’t work until I uninstalled & reinstalled the apps. And reinstalling the apps was a bit confusing because some of the apps were not available in the app store based on my physical location in a different country at the time.
• novia 2y ago
  The part that was interesting to me in this article was that companies could somehow detect that the lady had a cellphone when previously the 2FA thing hadn't been a problem for her. I wonder if this was just poor timing or if places like financial institutions actually get an alert.
• lxgr 2y ago
  > other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I really wish that were illegal. A phone number is a phone number. > she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through. Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised.
  • baby_souffle 2y ago
    > That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I really wish that were illegal. A phone number is a phone number. It pisses me off to no end. I use a few different banks and some are fine with google voice, others are not. One only allows customer service to send SMS tokens to google voice but not through the regular flow. In all but one case, they will happily robo call my google voice number and have a tts engine read me the same code that they didn’t want to SMS. Security policy by rng, ffs!
  • jjice 2y ago
    It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.
    • unethical_ban 2y ago
      I absolutely cannot stand that no bank I have (US) supports generic TOTP, which is more secure and easier to recover from backup if my phone is broken or stolen. It's inexcusable.
• zkms 2y ago
  "Wi-Fi calling" (LTE over IP over wifi) often allows you to get SMS messages over wifi only, on an ordinary cell plan: https://support.apple.com/en-us/108066 https://support.apple.com/en-us/108066 (Android supports it too)
  • lxgr 2y ago
    The article mentions that they've encountered problems receiving messages from short codes via that.
• declan_roberts 2y ago
  At this point it's pretty clear 2FA SMS is just a ploy to get PII customer data under the guise of security
  • bityard 2y ago
    The ONLY accounts I have that require SMS and offer no other 2FA are financial institutions. They already have more information on their customers than most other businesses I can think of. Heck, I WANT my bank to have my phone number so they can call me if there's ever a problem. I just want insecure SMS to stop being the only minor hurdle between a fraudster and my life savings. Companies do SMS because their VP of security compliance demands 2FA and because it's easy and has mature existing third-party vendor support. No tinfoil hat needed for this one.
    • reginald78 2y ago
      No, I think he's mostly right but it is a little more complicated. Most services demand a cell number verification on account creation for user tracking and identification under the guise of security for you. The SMS 2FA setup flow just helps push the user into coughing it up and helps sell the security cover story. Theoretically this helps prevent abuse, but there's no reason they have to abuse the data themselves after getting it for that. Its just that they will. They'll even lie to your face that they only use the number for security purposes and then use it for advertising anyway. https://www.eff.org/deeplinks/2019/10/twitter-uninentionally-uses-your-2fa-number-targeted-advertising https://www.eff.org/deeplinks/2019/10/twitter-uninentionally... https://techcrunch.com/2018/09/27/yes-facebook-is-using-your-2fa-phone-number-to-target-you-with-ads/ https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...
    • justin_oaks 1y ago
      This has been my experience as well. I implemented 2FA for my previous employer and we would have gladly skipped SMS 2FA if we could get away with it. It's more expensive for the company and the customer. And it sucks to implement because you have to integrate with a phone service. The whole phone system is unreliable or has unexpected problems (e.g. using specific words in a message can get your texts blocked). Problems with the SMS 2FA is a pain for customer service too.
• hkchad 2y ago
  I have garbage cell signal in my house, was only an issue for sending/receiving large pictures/video's over iMessage, apparently those don't send over WiFi for some unknown reason as well... I called Verizon and they sent me a Fem2Cell, problem solved.
  • hedora 2y ago
    Those definitely work over wifi. iMessage strongly prefers it. Maybe verizon is incompetent or malicious? What happens if you’re overseas or in a cell dead spot with wifi? The latter happens to me all the time in the city. It’s amazing how many hip “use your phone to order!” restaurants are in cell dead spots, and have set up wifi access points as a workaround.
• kawsper 2y ago
  Not only mountain people, try staying in Wales or inner parts of London, good luck receiving your 2FA code.
• vanburen 2y ago
  If cell service is available in at least one area of the property, you could have a dedicated sim for receiving SMS 2FA and use a 4G router to forward the SMS to an email, e.g. Teltonika have this functionality [1]. The 4G router also has the benefit of being able to use externally mounted antennas. Which might help in low signal areas. Not ideal, but might at least be a solution for some people. [1]: https://wiki.teltonika-networks.com/view/SMS_Forwarding_Configuration_Example#SMS_Forwarding_To_Email_configuration https://wiki.teltonika-networks.com/view/SMS_Forwarding_Conf...
  • ethersteeds 2y ago
    While that is a solution someone could use, it wouldn't work for the subject here: > she usually doesn't even have service 100 meters down the road.
    • vanburen 2y ago
      Yeah wont work for everyone, but a directional antenna mounted high up on house might have a better chance than a phone antenna.
      • brandon272 2y ago
        The idea of mounting a directional antenna "high up" on a house (or paying someone to do it) for the purposes of receiving SMS 2FA seems wild.
        • vanburen 2y ago
          You can also get antennas with suction cups. I have used this before to get 4G internet in a house with no access downstairs, by sticking the antenna on an upstairs window. An outdoor antenna would be better, but yeah more of a pain. I guess it really depends on how badly someone wants SMS.
      • seadan83 1y ago
        MOUNTAIN valleys, need to get WAY higher up than the top of the house.
• kyledrake 2y ago
  SMS 2FA is also quite expensive. In the US it's $0.0083 per SMS, which at bulk is going to add up quickly. Even before the war started, it was $0.70 to send an SMS to Russia. And then there's the premium SMS line fraud that's led to massive bills for some companies.
• hedora 2y ago
  She should switch cell phone providers. I’ve never had a problem receiving 2FA SMS from five digit numbers over WiFi, and heavily rely on it working. I know this for sure because I have an automation set to put my phone in airplane mode + wifi when I get home. (It eats battery when there’s a weak 5g signal.) SMS 2FA is terrible though.
• Joel_Mckay 2y ago
  1. 2FA over SMS is only $23 away from a compromised phone service 2. People love binding individual accounts to specific IP addresses, and large marketing firms especially like websites that use free DNS service to quietly track said users across the session 3. Much like DRM, the account auto constrains a single user to a single IP. Makes sense... unless you run a business account with a dozen people clearing a shared inbox 4. SMS inbox phone numbers are $2.75, and that requirement is bypassed if the company smartphone hardware/emulation is in use for account "recovery" 5. SIM hijacking and email server snooping is far more common than people like to admit 6. People feel safer, but it only increases the CVE difficulty level slightly above third world skill levels This is why we can't have nice things =3
• jboggan 2y ago
  I remember in 2014 going to play a Bitcoin poker game at some Google VP's house way up in the hills, Charlie Lee was there. We tried to buy-in at the beginning to a pot address but no one could get their Coinbase SMS 2FA to work because we had no reception so we ended up writing IOUs on scraps of paper.
  • deleted 2y ago
    [deleted]
• Meleagris 2y ago
  Perhaps there’s a B2C offering to be made here. An SMS proxy, forwarding 2FA codes to people without SMS. It would require a lot of trust. Similar and related discussions on this post: https://news.ycombinator.com/item?id=43976359 https://news.ycombinator.com/item?id=43976359
  • JimDabell 1y ago
    Daito does this: https://www.daito.io/2fa-via-sms/ https://www.daito.io/2fa-via-sms/
• marssaxman 2y ago
  I had this problem a couple years back, when I was living in a small coastal town where cell service was spotty. Generally I could either be in a place where I could receive text messages, or a place where I could get access to wifi, but not both at the same time. When I wanted to get into my bank website, I would drive 20 minutes up the road to the next, slightly less small town, where I could get wifi and receive SMS, then drive back when I was done. If I had stayed there longer, I might have found a better solution for my personal situation, but the experience as it was left me pretty uncomfortable with mandatory SMS 2FA as a general security tool. I'm sure there are many other people running into similar edge-cases.
• LeifCarrotson 2y ago
  She just needs a microcell/femtocell. Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 input, a little GPS antenna so the cell supports e911 location data, and it will broadcast LTE (or now 5g) cellular data. I work at a shop with metal walls located in a river valley. It's a cellular data black hole. People used to climb the hill up the driveway to make and take calls, but various people called their ATT, Verizon, and T-Mobile providers and all three shipped us femtocells. Mow the users and the contractors/customers who come to visit can't even tell that their phones have switched to data over our ISP instead of a tower, it just works - including 2FA codes and MVNOs. She may have to switch to first-party Verizon service instead of using an MVNO.
  • kmoser 2y ago
    It seems t-Mobile no longer offers such hardware: https://www.t-mobile.com/support/coverage/4g-lte-cellspot-setup-and-help https://www.t-mobile.com/support/coverage/4g-lte-cellspot-se...
    • mikestew 1y ago
      Maybe T-Mobile doesn't need to. I've used their WiFi calling for, what, going on ten years probably. Works a treat, including getting short code SMS. Ergo, I don't know the use case for femtocell for T-Mobile. That's why I was surprised to learn via TFA that WiFi isn't the solution in all cases.
      • PaulDavisThe1st 1y ago
        We moved to a T-Mobile femtocell precisely because their wifi calling was absolute shit in our experience. Dropped calls, no group SMS, no SMS/RCS images, frequently no calling service at all. The femtocell fixed all of that for us, and it has remained fixed.
      • 1y ago
• _hyn3 2y ago
  Trying removing consent to receive text messages on that number, or that it's only a land line and only phone calls are accepted. You might even try to block incoming SMS. In fact, you might also try a forward with Twilio or free Google voice number, since a lot of SMS TOTP refuse to with with those numbers :) I've even had success removing my phone number entirely from certain types of accounts, but sometimes I had to deliberately break the account (eBay) and then it tries to get you to confirm on each login which you can sometimes bypass by changing the URL or clicking the company logo. Be sure to have strong security in other ways; strong, non repeated passwords. But this is truly insane. Large banks don't even offer the option of TOTP but instead require far more insecure SMS. Maybe they'll offer RSA dongles, because they never bothered to remember when they all got completely leaked ten years ago or how they accepted $10M to completely compromise their constants. What can you say, large enterprises are behind the security eight ball, as always! It's a tale as old as time. https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/ https://www.wired.com/story/the-full-story-of-the-stunning-r... https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill...
• KennyBlanken 2y ago
  The point of SMS 2FA is not security and never has been. The point of SMS 2FA is tracking. It's to force you to give them your phone number, for their own marketing, but also selling your customer profile to companies like Palantir. This also makes the government happy, because they can scoop up your SMSs and they get a nice handy list of every service you use which makes warrants easier, but also gives them info about when you log in or do other actions on those accounts. SMS 2FA costs these companies far more than TOTP would, but they still use SMS 2FA. That tells you everything you need to know...
• miki123211 2y ago
  This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. Your carrier is already capable of redirecting your SMS messages to other carriers, that's what they do when you're abroad and roaming with a foreign operator. You could make a fake carrier that speaks the right protocols on the roaming side, but communicates with the customer over the internet (using an API or a proprietary app) instead of LTE or GSM. This would essentially work like an SS7 redirection attack, but with the full knowledge and consent of the "victim." You could alleviate the security impact here by requiring SIM card authentication, just like a normal carrier does, which could be performed through the internet and an USB reader just fine. Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. I wonder whether a gray-hat route would be possible here, especially if the company was outside US jurisdiction.
  • immibis 2y ago
    > Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't. You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.
    • miki123211 1y ago
      > congress would have to pass a law forcing them to do it Well, I'm not so sure about that. SS7 redirection attacks exist, so clearly shenanigans like these are very hard to stop for carriers. The question here is whether such "attacks" are legal if performed with the consent of the customer, but against the wishes of their carrier. One could also do some "legal optimization" here, and ally themselves with a major carrier outside the US. There are plenty of those, and all of them have access to the networks (SS7 and IPX) on which roaming happens.
      • immibis 1y ago
        "SS7 redirection attacks" means, more concretely, "hacking into some phone company that's connected to the one you want to redirect, and using that system to send false data to the one you want to redirect". It's BGP hijacking but for the phone system. If Comcast is connected to Verizon, and I want to hack your connection to Google, and you're on Verizon, one of my options is to hack Comcast and have Comcast tell Verizon that Comcast has a really fast connection to Google. It might let me intercept your traffic if circumstances are good; it's also fraudulent and illegal through and through. If caught, I will go straight to federal prison. (Of course the analogy isn't 100%. The set of things you can do by hacking one side of a SS7 link is not identical to the set of things you can do by hacking one side of a BGP link - in particular, there's no BGP roaming. But it's a similar principle.)
• deepsun 2y ago
  Sounds like discrimination of a broad group of people. Granted, it's not a designated protected group, like by national origin, but I still think they have a good chance in court.
  • hiatus 2y ago
    > but I still think they have a good chance in court. On what grounds?
    • deepsun 1y ago
      Discrimination by making banking harder for a specific group of people (living in mountains). They could accept other 2FA methods, like passkeys and OTP apps, which are more secure than SMS.
  • settsu 2y ago
    https://en.wikipedia.org/wiki/Regulatory_capture https://en.wikipedia.org/wiki/Regulatory_capture
  • ecb_penguin 2y ago
    It's absolutely not discrimination and you're harming people by making such an absurd claim. Unreliable SMS delivery is not discrimination. This is how things end up on Fox News: "Is website security now discrimination?" > I still think they have a good chance in court Can you share the law you think was violated?
    • joquarky 1y ago
      People love to eagerly advise litigation while remaining ignorant that a five-figure retainer is required to even get started on such a process. And in the end, it's still a gamble that you may lose your case.
      • deepsun 1y ago
        Yep, but in this case lawyer might try to make it a class-action lawsuit and work for a percentage. Up to the attorney, of course, if they are will to risk their time on that.
• malcolmgreaves 2y ago
  Why can’t people take the time to use grammar correctly? This post is illegible.
• K0balt 2y ago
  I travel constantly and this is a HUGE issue for me. It used to work with VOIP but now everyone wants to make sure they have maximum sellable data so they require mobile numbers. Also, clownworld security, which is totally bunk as an excuse on this.
• vzaliva 2y ago
  "it turns out messages from 5 digit shortcodes often aren't supported over wifi calling." This does not seems plausible. I live in urban area but do not have good cellural connection at home and my mobile phones are usually route calls via home Wifi. All SMS come through. It is just a low-lever transport and I doubt it cares about message size or numbers.
  • InfamousRece 2y ago
    Short code SMS goes through different providers than regular SMS, so the deliverability will differ.
• clircle 2y ago
  Where does the trend of not capitalizing the first word in a sentence in techie blog posts come from?
• moffkalast 2y ago
  Along the same lines, am I the only one who thinks it's weird that when logging in on a desktop PC the average bank requires a: - username - password - one time generated 16 digit number - SMS confirmation - email confirmation - phone call with an associate - retinal scan - DNA sample Whereas to log in on mobile all you potentially need is a 4 digit pin which a passerby could easily observe, then yank the phone from your hand?
  • johnisgood 2y ago
    And keep in mind you have everything stored on your phone, too.
• dwood_dev 2y ago
  This is a problem with her carrier or her specific account provisioning. SMS over WiFi calling works just fine, including from short codes. I'm often traveling outside of the US, and my AT&T prepaid line most definitely does not roam outside of CAN/US/MEX. I spend the bulk of my time in WiFi calling mode. I have never had any issues receiving or sending SMS over WiFi, including to short codes.
• swiftcoder 2y ago
  > you have to download an app to do it, it's not just a capability that a phone has by default Luckily this is starting to change. Apple's Passwords app does TOTP out of the box. Though I am mystified why Google Authenticator doesn't come pre-installed in Android.
  • GuinansEyebrows 2y ago
    TIL! Thanks, I had no idea Passwords did this until now.
  • chedabob 2y ago
    For the longest time Authenticator was almost abandoned by Google, so it's not surprising the team responsible for the bundled Android apps swerved it. It didn't need bells and whistles and constant security updates, but it took 13 years for it to get cloud-sync support so you could backup your codes.
  • aequitas 2y ago
    Doesn't this kind of defeat the purpose of MFA in that you now have both factors within the same application?
    • swiftcoder 1y ago
      SMS 2fac isn't any better in this regard, since you typically receive the SMS on the same device that stores your passwords.
    • SchemaLoad 1y ago
      You don't actually need MFA. This whole thing came about because people reuse passwords between websites and websites have their databases hacked all the time so the same password can be used to log in on other sites. 2FA codes solve that because you can't reuse them between websites so one website getting hacked doesn't expose all of them.
      • pabs3 1y ago
• fersarr 2y ago
  Sms 2fa is also really annoying for travellers that don't use roaming
• charcircuit 2y ago
  Why does SMS need a cell tower booster but the internet router doesn't need a cell tower booster? SMS will be much less bandwidth so it should be easier to receive than a whole web page.
• nelblu 2y ago
  Some of the comments pointed out that this is hostile behaviour for people roaming as well, and I completely agree. Here is my solution for this : When I am roaming internationally, I leave my SIM card in a spare android at home plugged into a charger. Android has an app that forwards SMS to API : https://f-droid.org/packages/tech.bogomolov.incomingsmsgateway/ https://f-droid.org/packages/tech.bogomolov.incomingsmsgatew.... Every time I receive a SMS I forward it to this API. The API in turn emails me the whole message. I have been using this setup for a few years now without any issues. Even when I am not roaming, I still have this setup on my primary phone. So when I am on my computer and need a SMS OTP I don't need to go find my phone, I receive it in email :-). (Note : This doesn't work with MMS but I don't need them anyway)
  • barbazoo 2y ago
    Looks like this might stop working soon unless this process works without logging into the phone: https://mashable.com/article/android-smartphones-automatically-restart-after-3-days https://mashable.com/article/android-smartphones-automatical...
  • pauldino 1y ago
    I did something similar where I left an old Android phone at home and logged in to what I think used to be messages.android.com (now google.com) from a laptop praying the session wouldn't get lost before I got back from my trip. :) Lately though, SMS works over WiFi calling and usually if I need a real SMS where Google Voice won't cut it, it can wait for WiFi...
  • apexalpha 1y ago
    I’m sorry how is this related to roaming? I roam all the time in Europe and have roamed a lot outside of it, I have never had any trouble receiving any SMS?
    • nelblu 1y ago
      Technically you are right, the SIM card isn't roaming, but I am physically roaming outside of my home network (internationally). Some phone plans in my home network do not support international roaming, or if they support then it is ridiculously expensive that it doesn't make any sense to take the phone roaming.
• Peacefulz 2y ago
  Hey! I'm interested in that local AVL signal group. I've lived here for 6 years and I haven't met any friends because I'm a recluse with children. If you'd be willing to share, I would be greatly appreciative. :D
• jedbrooke 1y ago
  I remember running in to this problem in university too where one of the basement lab rooms didn't have cell service, but we had to log in to the school computers with our university accounts that had mandatory 2fa also was surprised to learn from the article that some carriers don’t support the 2fa 5 digit numbers over wifi calling/sms. when I travelled abroad recently that was such a life saver since my carrier supports it
• deleted 1y ago
  [deleted]
• neilv 1y ago
  Not only SMS 2FA, but in the past maybe couple years, many sites have been making their logins worse in many ways. For example, I'm actually liking Walmart.com more than Amazon in some ways lately, but logging into Walmart.com takes minutes while I wait for the 2FA after I already password authenticate. So Amazon wins all the casual browsing and impulse sales, and by the time I do log in to Walmart.com, it's only because I know I want to order something from there specifically, and it's already feeling tedious. Some off-the-cuff suggestions, since the worsening authentication experience really bugs me: 1. Present the email/username and password fields simultaneously, so the browsers like Firefox can fill out both fields. (A lot of site have started showing only the email/username to start, and also making that rely on non-login form field filling. And only after you type in your admin/email, because you don't form autofill in general, does it present 2. After user opts to authenticate with a password rather than SMS/email code, let them in, unless you're something like a bank or a medical provider. (Don't then make them do the SMS/email code anyway.) 3. If your mega online store handles HIPAA-sensitive data for some small percentage of visits, and you need 2FA for that, maybe only do the 2FA to upgrade the authentication confidence for session. (Or maybe the more sensitive data is on a different backend anyway, so as not to encumber all the developers implementing Wheaties logistics, with all the additional protections that are needed for medical records, nor to add additional weak links leading to leaks.) 4. When SMS/email 2FA is really necessary, send it immediately and reliably, and make it copy&pasteable. (Sometimes I wait minutes, and other times it doesn't come through at all. And I've even gotten email ones where competent-user text-selection picks up whitespace somehow, or even a weird unprintable Unicode character, which breaks the code entry when pasted.) 5. Those buttons to authenticate a variety of other sites are needlessly leaking information, and creating additional ways to compromise the account. (That's what you do if you want to reduce friction to first visits to your site, for which people aren't interested enough to create a password to use -- but not for logins from recurring customers.) 6. Don't prompt for "remember this browser?", and don't otherwise rely on the persistent tracking data deposited on the user's browser, across explicit authentication sessions, such as to decide whether to 2FA. For one reason, those persistent data mechanisms are overwhelmingly for shady abuse by the adtech/surveillance industry in shady ways, and are frequently cleared by privacy-conscious users. Any why is a bank, for example, complicating the UI, to ask ordinary users whether to lower their authentication security on this device, and expecting much sense out of that at all. Keep it simpler, more secure, and more responsible or respectable. 7. If you must support 2FA, make TOTP an option. And not TOTP-incompatible codes that requires installing your app, or that depends on some oddball third-party proprietary authenticator app/fob that seemed like a good idea at the time but is not a reason not to support TOTP. (You can still grandparent in the legacy proprietary 2FA, for those long-time users who've been using it, and be clever about not complicating the UI for those those dwindling users, nor for the increasing users using the more current open standard.)
• kaikai 1y ago
  Oh, this happens to me. I didn’t even realize that’s why I wasn’t receiving some sms codes, because sometimes it works and sometimes it doesn’t. I live in a rural area and have spectrum for both wifi and mobile (just like the woman in the article). I have some cell service, but depending on how strong it is in any given day am usually relying on wifi for calling and sms. SMS codes have been hit or miss, and this explains it well.
• andoando 1y ago
  Can we just go back to having passwords please. I hate this state of authentication on the web.
  • tialaramex 1y ago
    Passwords are terrible. They're Human Memorable Shared Secrets, it's "What if somebody who doesn't know the first thing about cryptography tried to invent secure authentication?" and should have died out last century yet here we are. We have known for decades how to do better than that. The fact that at least twice a month (often much more) I read an HN comment saying passwords are great is like discovering most of your friends don't know about germ theory still. I feel so fucking tired. With a Shared Secret system the person authenticating you can give away the fucking secret and we already know we live in a society where they will blame you and act as though there's nothing they should have done better - that's what "Identity theft" is - blaming other people for the fact you didn't do your job properly. When you use Human Memorable secrets the humans try to remember them, which means they're usually very low quality, dog's name, favourite band, that sort of thing. Worse, since humans can't remember many things they usually choose only a few and re-use them, so now they're not only a Shared Secret they're also Reused which is even worse. So then we end up with a whole pile of kludges to try to use "passwords" which aren't really memorable, losing most of the benefits yet still retaining most of the disadvantages. This is an awful situation to be in, it's taken a considerable amount of laziness and incompetence to achieve it.
    • andoando 1y ago
      I dont care so much about passwords as I care about how annoying the current implementations are. Passwords do have some benefits. They dont require a phone, it being charged, and fetching it 5 times to go through a couple services. They can be used from any machine. Yes theyre not as secure, but as user Id prefer to be able to choose for myself whether I want to opt in for additional security. For most sites I dont even give a shit if my account gets hacked, and I have to go through a ton of annoyance everyday for no reason
    • andoando 1y ago
• vaadu 1y ago
  How hard would it be for them(company) to use the Signal app for 2FA?
• BlueTemplar 1y ago
  Great points. > and TOTP, the obvious alternative solution, is still pretty sorry. you have to download an app to do it, it's not just a capability that a phone has by default. and then when trying to find an app to use for it, you're presented with a multitude of high-stakes choices, and often pretty technical explanations if you start internet searching about which app to use. A reminder that mandatory iOS App Store / Android Play Store / (Xiaomi store ???) is even less acceptable than SMS 2FA unless maybe you're a USA(/Chinese) citizen living in USA(/China).
• lisper 1y ago
  It's not just people who live in the mountains that have this problem. People who do a lot of international travel see it too. There is absolutely no reliable way to predict the circumstances under which I will be able to receive an SMS.
• DennisP 1y ago
  I've read a fair number of cases where sim-swapping led to account hacks when the providers got talked into resetting passwords. It happened to a friend of mine. So I would say SMS 2FA is more hostile to people who are able to use it.
• dfawcus 1y ago
  Isn't SMS 2FA immune to SIM swapping attacks when the SIM is an unregistered PAYG one? i.e. there is no way to contact the carrier and get the number reassigned to a new SIM unless one first registers the SIM, and hence binds the number to a known identity.
• stackskipton 1y ago
  Something somewhere is always hostile to particular group. That's just facts of life. You do your best to minimize but can never eliminate it. As someone who has dealt with 2FA support, all the methods suck. SMS 2FA is least secure but has broadest support with quickest recovery method. TOTP Applications (Google Auth, Authy, iOS Passwords) is more secure but people switch phones, lose phones and so forth and recovery is always a nightmare. Yubikey and like have cost problem and you still have recovery problem. A clear solution in my mind is having the Federal Government run some form of centralized hardware based system where hardware could be replaced by government office after verifying identity. Government does this already for DoD CaC cards. However, in the United States, Privacy Advocates would lose their minds, and funding would constantly be under attack. So yea, I get SMS 2FA is hostile to mountain people but 2FA is hostile to login services and executive yachts.
  • nine_k 1y ago
    > Privacy Advocates would lose their minds Privacy of authentication may be a valid concern (e.g. during voting), but I don't see how it applies here. If what I want is to confirm to the bank that I am who I am, with all the details about me that I have told the bank already anyway, I very clearly and openly forfeit my privacy. I explicitly ask to be precisely identified.
    • pavon 1y ago
      For banks an other cases that (1) need to know you true identity, and (2) provide no expectation of privacy regarding sharing the existence of accounts with the government, a government run authentication would be fine from a privacy point of view. The issue is that every site has moved to using 2FA, and most of them have no legitimate need to know your true identity. So using a government ID based solution would unnecessarily conflate authentication and identification and would be a real privacy concern.
      • nine_k 1y ago
        Can you offer an example of a situation when the second factor authentifies without identification? Assume a service S wants a confirmation that user U is indeed legitimate. The centralized auth service A could receive from S a bunch of data S knows about U, like name, address, phone, SSN, whatever S needs to know about U. Then A should respond whether the fields match the data which A knows about U, without revealing to S any additional data that A may know about U. The problem if a centralized service is that it's a SPOF, and the juiciest target for compromising. I still think that TOTP and personal crypto tokens like yubikey are the most resilient, and technically the easiest, solution to that.
• gusfoo 1y ago
  Nice article, although I despise the "lowercase only" affectation that so many of us techies pass through. Capitalising the first letter in a sentence is a courtesy to the reader, not a stylistic choice you should impose to make yourself feel special.
• KerbalNo15 1y ago
  Voip.ms is fairly inexpensive (a couple dollars per month) and if you get an SMS-capable line you can set it up to forward incoming SMS to email. Edit: I have not tested it with short codes
• rc_mob 1y ago
  Wish I could upvote this 20 more times. Very true thank you for this.
• joe_the_user 1y ago
  i did some digging, and it turns out messages from 5 digit shortcodes often aren't supported over wifi calling. sometimes they are, but in her case they're clearly not. This seems like a rather specific problem that isn't related to mountain people as such but services blocking "shortcodes" apparently for a variety of reasons. It is true that text and call reliability is becoming a real problem generally where you have these authentication issues. I myself in the mountains and have dealt with reliability issues. Here's a discussion of this specific problem with T-mobile: https://www.reddit.com/r/tmobile/comments/ardcnc/aargh_finally_solved_tmobile_blocking_of_sms/ https://www.reddit.com/r/tmobile/comments/ardcnc/aargh_final...
• paxys 1y ago
  I exclusively use wifi calling because my home doesn't have cellular coverage, and have never once had issues getting SMS codes delivered. Seems like a provider issue on her end.
• NoPicklez 1y ago
  This is a niche article, where it reads as though the SMS 2FA messages started coming through right as the lady purchased a cell service. Well the lady would have needed to have activated 2FA first and walked away from the house to even enable it. Then goes on to say that TOPT is also too difficult, firstly because you have to download an app to do it, yet she supposedly knows how to use her phone. There will always be edge cases where something doesn't work perfectly the way it does for everyone else. The solution here seems to be help her choose a TOPT app, print out those backup codes and be done with it.
• b8 1y ago
  Newer phones offer free satellite texting, so that should solve their problem.
• kazinator 1y ago
  Mountain people and anyone who goes abroad, where they use a different SIM card. People who perpetrate SMS 2FA are pure scum.
• burnt-resistor 1y ago
  TOTP might not be perfect, but they don't need networking. There's absolutely no reason a third-party or the server needs to maintain a source of secrets on demand needing to be sent over a network when the user can maintain an offline-capable 2FA generator themselves. I'm not sold yet on non-portable, proprietary passkeys.
• iddan 1y ago
  In Israel some providers started to offer code in WhatsApp (for example credit card companies). This ensures that if you don’t have access to your phone number (for example: abroad) you won’t be locked out of your phone while implementing the same security mechanism
• gloosx 1y ago
  SMS 2FA was only invented so govt. can access all of your accounts without having to know your password. Check your service password reset flow – is it a phone number input? It was 1FA all along.
• raxxorraxor 1y ago
  Meh. SMS basically has the same problems as capability URLs for password resets. Sure, Mail is usually TLS encrypted these days, but they are still not regarded as secret. That said, I still would prefer both over another shitty authenticator app that really gets on my nerves. Additionally, I would like an option toggle with "Yes, I do have a safe and uncompromised password", where I can get rid of this crap. Some 2FA systems do work if they don't ask more than once a month, but they are the exception.
• gazarubbleparty 1y ago
  [flagged]
• nicwolff 1y ago
  > and TOTP, the obvious alternative solution, is still pretty sorry. you have to download an app to do it, it's not just a capability that a phone has by default iOS Passwords can serve as your TOTP authenticator app. https://support.apple.com/guide/iphone/automatically-fill-in-verification-codes-ipha6173c19f/ios https://support.apple.com/guide/iphone/automatically-fill-in...