Hacker News Reader

Comment by hw | Hacker News Reader

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

View on HN

In Norway we have "BankID" which is a 2FA solution for authentication and digital signature. It started as a normal 2FA solution with a hardware token combined with username (social security number) and password. A few years ago they introduced a mobile solution where you don't get a SMS or get prompted by an app, but rather it's some kind of functionality on the SIM card. Very convenient and works on all banks, most finance institutions and everywhere else you need to sign things.

Lately there have been attacks on BankID in Sweden.

They call you up and pretend to be from your bank, then ask you to open your BankID app and verify your identity so that they can share some very important information with you.

You open your app, and ID yourself, thereby logging them into your bank account on their end.

In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear.

It's disgusting how twisted these criminal activities have become.

I remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them.

Every alternative way in is a larger attack area.

You mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.

I got a Yubikey a few weeks ago and thought I'd switch to an online bank that offered Yibikey login... I spent hours looking and couldn't find any. Not even one. Couldn't even find any offering Google Authenticator. I saw that a few of the biggest banks will ship you an RSA token/similar device if you ask, but not quite what I had in mind.

How does the phone number get identified? You would think that'd be confidential.

I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.

SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"

use a burner sim like: https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]

The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA.

Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2]

As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally.

[1] https://support.twilio.com/hc/en-us/articles/223181668-Can-T...

[2] https://news.ycombinator.com/item?id=16773171

You could use https://jmp.chat/ instead - JMP does support short codes, and you can use is anywhere you have Internet access, regardless of whether you have a SIM or not.

Depends on your country doesn’t it? Where I live you need to identify yourself with your national 2factor ID if you want to do anything phone related. Both for security reasons, but also because of big brother tracking us.

But the side effect of this is that you can’t highjack a phone number unless you highjack the cell tower between it and the network.

Doesn’t 2fa mean password + phone? How is getting the phone sufficient?

You can often reset the password if you can intercept the chosen token generator, like SMS.

Reply on news.ycombinator.com