Hacker News Reader

This.

I deal with relatively higher volumes of information that must remain secure.

With google, I have hardware authentication device and 10 codes.

Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write it down. This feels like a reasonably secure approach.

No SMS text option. The idea that your phone number is the key that allows you to reset all your passwords (no matter how complicated / securing no matter how much sensitive info) is ridiculous.

> No SMS text option. ... ridicolous

Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0]

[0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-...

I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked..

They stole your SIM. SMS option was now in their control.

SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.

> sure its better than not having 2FA but only a little better.

I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.

Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone.

Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.

You do realize that the minimum wage worker at your local phone store can setup a new phone with your number?

That they may have friends who they accidentally do this for?

That they may not detect the fake ID some random person with your name and number shows them?

Etc etc. None of this requires getting your phone.

No, as other threads have pointed out, SMS is trivially hacked

If the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.

Everything you said agrees with what simonebrunozzi said. SMS is a bad 2FA option.

> sure its better than not having 2FA but only a little better

Only if the provider doesn't decide to be "helpful" and start allowing password resets via SMS on your 2FA number.

The problem is that twitter forces you to add a phone number, and once that phone number is added it will automatically be able for 2FA. If you don’t believe me then remove your phone number and wait. Eventually you’ll login and get a message saying your account is suspicious and you need to add a number.

Any redundancy on that piece of hardware?

"Two is one and one is none," as the Special Operations folks will explain.

Sure, the math is squirrely; but the sentiment is real.

The recovery codes.

I don't think SMS is real 2FA, because many site can reset password by SMS, meaning having the phone number = controlling the account = 1FA. So, it is not better but worse to have SMS "2FA" since it depends on competence of mobile provider, which may be absurdly weak at preventing social engineering.

These gaps would be obvious if services displayed all their authentication options completely in some graphical or table form. I personally would like a logic circuit diagram showing eg:

(password AND SMS) OR (password AND app) OR SMS --> Get in!

Then it would be obvious that the password is sort of redundant and it's really less secure than 1FA. It would also be clear what you have to lose to be locked out yourself. Only having 2 factors is not great because that's twice as many ways to get locked out. You really need 3 or more but it's never clear if that's reducing security to 1FA level or not because they don't clearly show you what the account recovery options are.

Does anyone know if there’s a way to prevent your SMS from being rerouted, or get a special protected number?

The ability to do this would not mitigate Microsoft’s responsibilities here, but at least it would allow some people to help themselves.

I'm not a subject matter expert, but a Google Voice number can be used to receive texts and is protected by the relatively robust security of your Google account.

If the issue is the SS7 network, that won’t help unless the originating text is also in Google Voice.

That seems pretty possible though, if SS7 is the only issue then providers of 2factor SMS auth should just have a number on each network and when a 2factor request comes in they should determine what network its being sent to and then actually send the SMS from the number they have on that network.

Unfortunately, some services won’t accept a Google Voice or any voip number.

If you had that protection, what would you do if your phone was lost/stolen and you wanted the number transferred to a new SIM card? You lose your number forever if it was impossible to transfer. If there's some way to transfer it, like showing your passport in person in the phone company's office, a hacker can pretend to be you and do that too if your account is valuable enough to be worth the risk. Ultimately, you're still trusting the phone company not to assign your number to somebody else, and that's what they're not good at.

I guess I’d like the ability to delegate the responsibility of updating the ownership of my phone number to an entity of my choosing. The phone company would only be able to update with this entity’s go-ahead. Services could specialize in this kind of work so identity verification would be a core competency, and I could pay more for better protection.

>> or get a special protected number?

That's an interesting point. Maybe an unlisted burner that you don't use for anything else could be your SMS backup number. At least that adds one small layer of security.

It's like being in an episode of The Wire just to stay semi-secure online ;-).

> However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and use an SMS text.

Not sure how that works if they (Microsoft) don’t have your phone number.

Can you explain this a bit further? We just switched to Office 365 and I ran into this today but I had assumed user error. So even though I have an authentication key set up there’s always the possibility that a password reset can be authenticated via my phone number?

Pretty sure you can remove sms from the 2fac process by going to:

My Account > Security & Privacy > Additional Security Verification > Update Your Phone Numbers Used for Account Security

And then setting the preferred method to "use verification code from app". Once you finish setting up the authenticator app you can delete your phone number from the 2fac list.

At the end of that process you should be left with only having the app authenticator as a 2fac option.

See https://docs.microsoft.com/en-us/azure/active-directory/user... for some details, but the MSFT documentation on this isn't very good in general.

When I uncheck Authentication phone I get a red error message: "Configure at least one phone so that if you lose the app you are not locked out of the account."

If You are able to remove it, I’m wondering if there is some sort of policy or limitation our VAR is adding to our instance.

edit - added quotes to the error message

Yes, same thing happens to me. I’m the first account (and the only current admin) that purchased all the licenses so I wonder if that’s why. Is your account an admin or do you have any additional privileges? It makes sense that they need at least one phone number on file but there should be a way to opt out of SMS 2FA.

There are 2 other admins in our domain. We all get the same error. Through the Azure console I can disable MFA for other accounts, so even if I lost my app, one of the other 2 admins could just disable MFA until I re-enable it on another device.

Apple’s iCloud Accounts are the same now. They now require a phone number for new accounts and there is no way to remove the number.