Hacker News Reader

Comment by xfitm3 | Hacker News Reader

While I agree SMS based MFA is less than ideal the real issue is telephony security. Weak security allows ANI spoofing, message interception (as seen here), IMSI catching, and who knows what else.

I stopped picking up calls from unknown numbers since its practically all spam. It'll probably never be secure but I can dream.

View on HN

That’s great and all, until you’re applying for jobs. Or in sales/support. Or just new to an area. Or have a child at day-care.

When I’m on-call and they spoof a similar phone number (same area and exchange code), I gotta answer it.

Per quora, area code 308 probably has the smallest population of any area code, so getting a phone number based there and screening for 308 numbers would probably work well.

Honestly if google voice had a captcha system I could implement for non contact numbers, that would be sweet.

This is actually a feature on the Pixel 2 and Pixel 3: Screen your calls before answering them [0]. When you activate it on an incoming call it'll play a message for the caller, show you a transcript of their response, and allow you to respond with a few canned messages of your own. The best part is that it works entirely offline [1], so it doesn't require sacrificing your privacy. It's incredibly convenient.

For a while I'd been receiving a ton of spam calls. Eventually I caved and enabled "Filter spam calls" on my Phone app. Suddenly, all the calls stopped. I ultimately decided that this was a worthwhile privacy tradeoff for me, especially since I rarely use my phone. I only use it to occasionally interact with businesses, and as a way for close family to reach me at a moment's notice in case of an emergency.

[0] https://support.google.com/phoneapp/answer/9118387

[1] https://support.google.com/phoneapp/answer/9094888

Isn’t this a standard google voice feature for the last 12 years or so?

I don't think google voice showed you a transcript in real time or allowed you to interact with the caller.

No transcript, but they play back the caller's introduction to you before you decide to accept or ditch the call. Again, for the last 12 years or so. That was one of the reasons Google acquired Grand Central and launched Google Voice.

Yeah they had that but this is different, more interactive and something you can decide to use while your phone is ringing. Google voice currently does not have a call screening feature like the one on the pixel.

Well, GV is interactive by some definition, but awkward. You need to listen to the headset to hear the callers introduction, then type 1 to accept the call or hang out and send caller to voice mail.

Real time transcription would be much nicer, very true. GV is apparently on a lifeline while Google is trying to push Fi. Just like Duo and Hangouts.

Google Voice provides text transcripts for voicemail, but I'm not aware of it having ever supported anything like the screen call feature.

When you activate the feature the caller hears the following message: "Hi, the person you’re calling is using a screening service from Google, and will get a copy of this conversation. Go ahead and say your name, and why you’re calling."

Then you'll see a live transcript with whatever the caller says, and you're given multiple choices with which to respond. Here's some of the available actions / responses, along with the message the caller hears:

* Is it urgent? - “Do you need to get a hold of them urgently?” * Report as spam - “Please remove this number from your mailing and contact list. Thanks, and goodbye.” * I'll call you back - “They can’t talk right now, but they'll give you a call later. Thanks, and goodbye.” * I can't understand - "It's difficult to understand you at the moment. Could you repeat what you just said?”

You also have the option to answer or end the call at any time.

Another important detail is that this is done exclusively using on-device technologies, so it works offline and it preserves your privacy. Voicemail transcripts are generated on Google's servers.

All of this information is taken verbatim from the two articles I linked as part of my original response.

Get a number in a completely different area code than where you live. In an attempt to appear legitimate and get answered lots of spam calls with come from the area code of your phone number.

If I get a call from the area code where I live I pick it up because it’s usually the vet, doctor, school, mechanic, etc. But if I get a call from an unknown number in the area code of my phone # I can safely ignore it and let it go to voicemail. If it’s legitimate they will leave a message (and it’s never been legitimate so far).

It's great that the FTC in the US rolled with the flood of scam calls and partnered with call blocking lists [0], but ignorant question--why are scammers able to cycle through and commandeer and route through so many domestic phone numbers and remain untraceable to enforcement?

0: https://www.consumer.ftc.gov/articles/0548-blocking-unwanted...

Edit: Thanks for the pointers! Sorry this was a bit of a tangential question.

They often buy SIP services from VoIP operators, as a business, and cycle through the subscriptions.

But it's a totally different problem than the problem depicted in this article.

There's a good practical look into how this works in Martin Vigo's talk.[0]

0: https://media.ccc.de/v/35c3-9383-compromising_online_account...

Because once you get connected to the SIP network you are assumed trusted. Getting connected to the SIP network is easy and requires no verification.

Problem of this attack is that the subscriber never gets any indication that the attack occured. So you can't do anything to defend yourself.

The attack described is two-part:

1. The criminals launch a phishing campaign against you specifically to get your bank username and password. This is defensible, although the harder step, by being vigilant, not clicking links, regularly changing your password, ensuring your password is unique so they won't be able to find it on a database of another breached web service, etc.

2. They intercept your SMS-based 2FA. This is not possible if you are not using SMS-based 2FA. Switch to a more secure method of 2FA, or communicate your concerns to your bank if none is available (really, make it public, because this is a big deal), or switch banks.

I believe there are things you can do to defend yourself, although having to do these things is clearly not ideal. Hopefully just knowing about it will improve a person's defensive posture against such types of attacks.

Edit: formatting (for anyone who's ever wondered: https://news.ycombinator.com/formatdoc)

"Switch to a more secure method of 2FA"

What would you suggest? I've heard that using your phone for 2FA is a bad idea several times now, but I'm not hearing suggested alternatives. Clearly your alternatives are limited by what you're offered, but I would still welcome advice for what practical alternatives I should try to use instead of phone.

An app or hardware generating TOTP or HOTP codes is generally considered better than SMS based authentication but is susceptible to phishing and requires planning around phone upgrades or backup measures in case of a lost device. Google Authenticator app, Yubikey, or the like.

I'm not claiming this is more secure by any means but I started using a Google Phone number for 2FA associated with a Google account which uses a hardware token for authentication. My reasoning being that a Google phone number cannot be transferred without logging into the account and releasing the number. So I figured if I used the most secure 2FA method for that account it would be safer than relying on my telco which doesn't employ any serious security measures and is likely more susceptible to social engineering than Google.

I think there needs to be a larger effort to shame the banks into fixing their MFA support. Some of them sign onto FIDO2 for example but don't enable it for their customers. I've looked for every bank I do business with and NONE of them support non-SMS MFA.

"Switch to a more secure method of 2FA"

If you can... All the institutions (bank, 401K, IRA) I use will fall back to SMS even if you have a more secure method. I gave up trying to find one that didn't.

Instead I got a burner phone with cash. Don't really know if it helps but it seems less likely that some database dump has my name associated with that number.

Reply on news.ycombinator.com