Hacker News Reader

Comment by exabrial | Hacker News Reader

Dear everyone at Apple, Facebook, Google, etc. Please stop and remove the ability to use texting as 2FA. The mobile telecom industry is not hardened.

View on HN

2FA over SMS is fine. It’s not the most secure thing, but it’s an improvement over just having a password.

The problem is when people forget the “2” part and allow SMS to be a substitute for having the password. That should never be done.

The related problem is that, as a used, it’s hard to tell when some service wants your number for proper 2FA, or when they want it as a separate authentication mechanism they just happen to call “2FA.”

If you register your phone nr your password basically get useless as someone can remotely (from another country even) steal your phone number and then reset your password.

That would be one factor, no?

I mean if SMS is not just used as second factor, but also used for password reset/override, it basically become a one factor. So yes.

> ...it’s hard to tell when some service wants your number for proper 2FA, or when they want it as a separate authentication mechanism they just happen to call “2FA.”

...or when they want it to be able to call or text you with other BS entirely. I hesitate to give my cell number to any company. I have a separate number (formerly a landline, now strictly a voicemail box) that I use specifically for companies.

I gave my cell number to a new dentist recently, thinking "medical office, probably important they be able to reach me." That turned out to be a mistake. They subscribed me to an automated appointment confirmation service, and they also send me a text (from a different number than the confirmation service) after I finish a visit to solicit reviews. This is exactly why I hate giving it out.

The "best" part is password recovery — where SMS is typically the "second factor" to a completely insecure "secure question"

You have no obligation to answer the secure questions truthfully, or not to write a long random string of text... Starting with "Do not accept the answer if I can't spell this exactly" in case a human gets involved...

Of course you'll be SOL if you legitimately lose your password and the answers to those questions.

Sounds like a good reason to use a password manager and good backups to store them?

It frustrates me how almost every company's "secure question" system is utterly retarded and recklessly dangerous.

1. They draw from fixed unimaginative pools of often-overlapping questions, so that a breach in one company compromises you on multiple others.

2. Unlike a password, the actual secret question is often plaintext

If I had to design a replacement... The user would always be allowed to define custom questions, all questions could be assigned multiple synonymous correct answers (e.g. "Dr. Smith", "Doctor Smith"), and they all go through a one-way hash with salt.

Just today Google prevented me from logging in with the correct password and asked for a phone number as additional verification. Any phone number.

The account has no associated number so it's not a verification at all!

That's not for your benefit, that's for them to verify you're a human / not a spammer / collect information (at least that seems like the most reasonable explanation to me).

Google has a new account setting called Advanced Protection. All it accepts is two hardware U2F keys (primary and backup) and your password. It supposedly makes your Google account pretty hardened. The only issue is that you can only use Chrome with U2F keys right now because Firefox U2F isn't fully baked yet.

I'm using it with the Titan keys (they're not my favorite, but work) and it works pretty well. I can't do as much 3rd party stuff, but I only keep my Google account (right now) for my old email address that's already forwarded to my new email address, Google Music, and Google Pay, so that doesn't affect me much. If you use a lot of 3rd party apps or get your mail via IMAP and the like, it's going to be more difficult.

A weird thing is that Google doesn't seem to allow for U2F key use without Advanced Protection turned on, which is puzzling to me.

Weird, I have U2F keys in my non-Advanced Protection account.

Maybe I was looking in the wrong place, good to know, thanks.

For what it's worth, I use a U2F key regularly with Firefox. Just enable the security.webauth.u2f flag under about:config. I realize that's not a good solution for everyone, but if you're just looking to do it for yourself it works.

You know, I figured out what the problem was and it works now. I had setup FF Sync on a PC that didn't have U2F turned on yet.

> The mobile telecom industry is not hardened.

The PSTN and phone system telecom industry in general is not hardened. The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine.

SS7 needs to be burnt to the ground, the ashes stomped around on a bit, and shoveled into a dustbin.

> The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine.

This happens to every system eventually if it lives long enough.

My biggest takeaway from it is that many things standardized before a certain era are based entirely on two concepts of operations:

a) only a certain elite group of people or companies will be able to use it (in this case, PSTN operators)

b) total trust between all parties using it, so there's no need for provably-hardened cryptography.

both of which are now laughable in a modern network security threat environment.

In this case SS7 was just never designed with the concept that malicious third parties might get access to it, or that it would not be operated by RBOCs (regional bell operating companies), or the international equivalent thereof (national run telcos such as British Telecom, Telecom Italia, etc).

You know pre-paid burner phones are a reasonable option to harden security at your own pace, right?

No one is forcing you to use the same number for everything. And don't complain that it's just too expensive and unrealistic to maintain more than one phone number, because that is simply untrue.

Yes, I am aware of NIST's guidelines, regarding SMS as a layer of multi-factor authentication [0]. Those guidelines are for large organizations that dictate user behavior in a top-down hierarchy. Individual security profiles are much more flexible, and don't require the same degree of adherence to recommended practices.

[0] https://pages.nist.gov/800-63-3/sp800-63b.html

Seems pretty wasteful solution if everyone maintains a secondary burner phone for login. But it works for the short term, and I would worry about fees, and inactivity cancelations.

Or, allow it, and inform them there's a safer method called Google authenticator. Authenticators make your logins dependent upon 3rd party software, and is only as secure as how that single source of failure is.

There's many 2FA apps compatible with the TOTP and HOTP standards and they rarely, if ever require an update.

Absolutely minimal 3rd party involvement, I'd say less than most web browsers these days as there really isn't a significant attack surface for the apps.

If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive:

https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a...

https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

https://github.com/google/google-authenticator/wiki/Key-Uri-...

It always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.

Many of these services, I believe google is one, still require mobile phone as a fallback option.

Paypal, an actual bank, still only allows SMS 2fa. It's stupid.

Wrong. TOTP is supported, although hidden.

https://www.paypal-community.com/t5/Tips-from-Moderators/Pay...

It uses Verisign's VIP app instead of Google Authenticator (or Authy or whatever).

You can use any TOTP app.

According to some threads I've read it doesn't work in all circumstances.

Personally I wouldn't risk it since it could mean risking getting locked out of your account.

I've been using it for a few years now and I haven't encountered a place where I couldn't use it. It might force you to enter the TOTP code at the end of your password though, but it works.

It's not hidden, it's de facto disabled for 99% of users. Fix this, Paypal.

And even this option is not available in all countries. I've almost stopped using Paypal completely because of this.

Google requires at least 2 ways of 2fa protection. You can enable a third one and disable the phone completely.

Requiring the phone number is mostly an anti-bot/spammer measure. Once they've seen your phone number you don't need to let them use it anymore.

I think it depends on the mobile provider and country.

Most of these attacks are social engineering.

For paypal, texting is even the only 2FA option for non-US citizens. Baffling.

You can use a symantec hardware token.

Paypal’s ceo is head of symantec’s board. Paypal must use symantec software wherever it is available, and their mfa is no exception.

This is still baffling as you say though, because symantecs mfa system does allow for other mechanisms.

Paypal's Symantec HW token can be replaced with a TOTP app.

I can't. It only seems to be available for US citizens.

Reply on news.ycombinator.com