Hacker News Reader

Comment by tpetry | Hacker News Reader

The industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.

View on HN

SMS 2FA is fine. 2FA adds another layer on top of your password. The second factor doesn’t have to be particularly secure to make you safer.

The problem is SMS account recovery, which is a really bad idea.

> The problem is SMS account recovery, which is a really bad idea.

The problem is that a lot of services tie the two together. Often one implies the other. Even if it doesn't, though, it's also easier to social engineer -- "look! I have access to the 2fa phone number! I just can't access my password manager!"

Companies do that, but they shouldn't call it 2FA at that point as it is no longer a _second_ factor: it has become the primary factor.

I'm not sure I've ever seen SMS account recovery.

Google has sms account recovery.

In times like these, I am glad to live in a stone age country like German, where it is near-impossible to get a new SIM without going to the store in person and presenting a government-issued ID.

Sorry but you are wrong. Today was news on heise that clearing bank accounts by replacements and transfering the money to some popular new banks like fidor and n26 resulted in a temporary ban of a small bank to transfer any money to these banks. It‘s happening here too ;)

Or a country like Sweden where you have to authenticate customer service through 2 FA using an application connected to your bank account, where you input a password or fingerprint.

And then the change only happens after you confirm a text message sent to your phone asking you to approve the request.

Does the 20 year old minimum wage employee working at that store know how to spot a good quality fake ID card?

What about hackers bribing an employee?

I would say that for the average user sms 2FA is secure enough.

P.S. I might have a different perspective as where i am from, there really aren't important services (banks etc.) that are using sms 2FA. Mobile operators doesn't ship SIM cards over mail, you can get a new SIM only in person providing ID (or PIN/PUK in case of prepaid cards). Probably my country is just too small market for these kind of attacks so i feel secure enough when using sms 2FA.

Depends on what it’s protecting, for example banks using it isn’t, as it’s a common enough attack vector it’s appeared on consumer programs on TV fairly often and they had to introduce a law to allow people to be refunded in cases of sim swap.

It wasn't secure enough for the author of this article.

Not really an average person isn't he?

How is he not an average person, as far as security goes?

1) he didn't use a password app

2) he thought google drive was a safe place for his stuff

3) he thought google drive was a secure place for his stuff

All three things, which I would bet are fairly common assumptions (the last 2 are certainly part of Google's marketing!), turned out to bite him.

He is a public personality and in that role has been related to Bitcoin. And he also has his phone number and email publicly visible on the internet.

https://gizmodo.com/a-tv-anchor-tries-to-gift-bitcoin-on-air...

It seems like this only happens to people who have poor opsec about their email addresses, phone numbers, and are publicly related to the cryptocurrency movement. I mean, I'm sure it happens to other people, but that's the only case I've ever heard about.

I would personally be wary about publicly listing the email I use with my bank, or my phone number, and I've done what I can to scrub the internet of these values. If you have to be publicly reachable through a medium other than Facebook or Twitter, have a separate email and phone number through which you conduct your serious personal business. But most people do not need this kind of public reachability, or else have it through work. For those types of people, it would behoove them to keep their profile small.

Before the identity theft occurred, what about the the author made him particularly "not average"? Being an early twitter adopter or something?

I wouldn't call a writer for ZDnet who probably has a very public persona an average JOE.

A writer for ZDnet might be a public figure, but to call him "very public" seems like a stretch. There are probably millions of people as public or more than him.

You're saying that you're safe because you're not an interesting target. People tend to agree that security through obscurity is not a good strategy.

As for how hackers can swap someone's SIM, consider:

- Does the 20 year old minimum wage employee working at that store know how to spot a good quality fake ID card?

- What about hackers bribing an employee?

Bank of America uses SMS.

Reply on news.ycombinator.com