3 ms·

TOTP, HOTP. SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone num

TOTP, HOTP. SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.

gruez 1y ago
>your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that. This is mostly a red herring because most of the places that require SMS TOP already have your full name/address (eg. financial institutions, healthcare providers) or are in a position to intercept communications that they can infer that information (eg. google). If apps/sites like tiktok wants my phone number for 2fa, they can fuck off, or get a burner number.
- Calwestjobs 1y ago
  yes marketer gets your name from bank etc, you can not lie there about your name. and everywhere else, your data is connected just your number. same problem with signal messenger or facebook messenger building databases of numbers and contacts. neo4j clone from palantir.
- globie 1y ago
  I don't understand how this post stacks up against the myriad of communications apps that not only require phone verification when creating a new profile (and maybe SMS2FA), but put great effort into blocking as many VoIP/burner/prepaid numbers as possible. "Most"? maybe "a troubling few"? Phone verification is absolutely a widely exploited data mining opportunity, I don't see how it's a red herring at all. It's one of the worst surveillance mechanisms we live with today, only partially waved away with the 2000's concept of burner numbers.
  - PaulHoule 1y ago
    To single out Meta properties, I'd point to both Instagram and WhatsApp. It was an official policy early on that you could only create a WhatsApp account if it was connected to a "real" cellular number, I think the same has been true about Instagram for a while in that every time I tried to create an account without a cellular number it didn't work. Put in a cellular number and it worked just fine.
    - reginald78 1y ago
      Last time I tried to create a throwaway account for facebook it didn't actually ask for my mobile number. Just automatically banned me for being suspicious and then demanded a video of my head with no assurance that would actually help. I generally avoid meta but it seems like most craiglist sales have moved to facebook marketplace.
lxgr 1y ago
Neither TOTP nor HOTP provide "what you see is what you sign" property, unfortunately, which can be critical for bank and other transactions. "Enter this code only if you want to pay <amount> to <merchant>" is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example). Not even WebAuthN provides that property on a compromised computer; for that, you'd need something like the SPC extension [1] and a hardware authenticator with a small display. That's unfortunately why we're currently stuck with proprietary bank confirmation apps that can provide it. I really wish there was a vendor-neutral standard for it, but given how push notifications work (or rather don't work) for federated client apps, I'm not holding my breath. [1] https://www.w3.org/TR/secure-payment-confirmation/ https://www.w3.org/TR/secure-payment-confirmation/
- vanburen 1y ago
  Yeah this is a big problem. I have been sent 2F messages via WhatsApp by some services (e.g. PayPal). This isn't great, but better then SMS and having to have a separate app for each authenticating service though. A vendor neutral service would be a lot nicer.
- Calwestjobs 1y ago
  only system which does it securely is bitcoin cold wallet / offline computer signed transaction or as you pointed out, signing it on smartcard with keypad reader. but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline. and there is no way for attacker to MITM, and here lies the problem. companies can not blame you as easily as with currently deployed technologies... they hide breaches all the time, f... PCI
  - lxgr 1y ago
    > but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline. and there is no way for attacker to MITM There totally is! How do you know you're entering the TOTP on a legitimate website? WebAuthN prevents that, both by not letting you use a given key on the wrong website, and by including the origin in the signature generated using the key which the relying party can then check for plausibility.

TOTP, HOTP. SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.

gruez 1y ago

>your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that. This is mostly a red herring because most of the places that require SMS TOP already have your full name/address (eg. financial institutions, healthcare providers) or are in a position to intercept communications that they can infer that information (eg. google). If apps/sites like tiktok wants my phone number for 2fa, they can fuck off, or get a burner number.

Calwestjobs 1y ago
yes marketer gets your name from bank etc, you can not lie there about your name. and everywhere else, your data is connected just your number. same problem with signal messenger or facebook messenger building databases of numbers and contacts. neo4j clone from palantir.
globie 1y ago
I don't understand how this post stacks up against the myriad of communications apps that not only require phone verification when creating a new profile (and maybe SMS2FA), but put great effort into blocking as many VoIP/burner/prepaid numbers as possible. "Most"? maybe "a troubling few"? Phone verification is absolutely a widely exploited data mining opportunity, I don't see how it's a red herring at all. It's one of the worst surveillance mechanisms we live with today, only partially waved away with the 2000's concept of burner numbers.
- PaulHoule 1y ago
  To single out Meta properties, I'd point to both Instagram and WhatsApp. It was an official policy early on that you could only create a WhatsApp account if it was connected to a "real" cellular number, I think the same has been true about Instagram for a while in that every time I tried to create an account without a cellular number it didn't work. Put in a cellular number and it worked just fine.
  - reginald78 1y ago
    Last time I tried to create a throwaway account for facebook it didn't actually ask for my mobile number. Just automatically banned me for being suspicious and then demanded a video of my head with no assurance that would actually help. I generally avoid meta but it seems like most craiglist sales have moved to facebook marketplace.

lxgr 1y ago

Neither TOTP nor HOTP provide "what you see is what you sign" property, unfortunately, which can be critical for bank and other transactions. "Enter this code only if you want to pay <amount> to <merchant>" is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example). Not even WebAuthN provides that property on a compromised computer; for that, you'd need something like the SPC extension [1] and a hardware authenticator with a small display. That's unfortunately why we're currently stuck with proprietary bank confirmation apps that can provide it. I really wish there was a vendor-neutral standard for it, but given how push notifications work (or rather don't work) for federated client apps, I'm not holding my breath. [1] https://www.w3.org/TR/secure-payment-confirmation/ https://www.w3.org/TR/secure-payment-confirmation/

vanburen 1y ago
Yeah this is a big problem. I have been sent 2F messages via WhatsApp by some services (e.g. PayPal). This isn't great, but better then SMS and having to have a separate app for each authenticating service though. A vendor neutral service would be a lot nicer.
Calwestjobs 1y ago
only system which does it securely is bitcoin cold wallet / offline computer signed transaction or as you pointed out, signing it on smartcard with keypad reader. but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline. and there is no way for attacker to MITM, and here lies the problem. companies can not blame you as easily as with currently deployed technologies... they hide breaches all the time, f... PCI
- lxgr 1y ago
  > but for login TOTP is better then anything else. i can put it on arduino with small oled board and have it in safe/vault offline. and there is no way for attacker to MITM There totally is! How do you know you're entering the TOTP on a legitimate website? WebAuthN prevents that, both by not letting you use a given key on the wrong website, and by including the origin in the signature generated using the key which the relying party can then check for plausibility.