Hacker News Reader

Comment by valuearb | Hacker News Reader

The big weak point in the authors argument is credential stuffing. They argue fairly convincingly that 2FA is vulnerable to phishing, but concede it prevents credential stuffing. Then they try to argue that credential stuffing doesn’t matter because it can be prevented by using unique passwords, which is the one thing users have been shown to rarely do. 2FA stops credential stuffing cold, that’s important.

Also 2FA can stop phishing attacks cold as well, simply by using links instead of codes. So really the author should be using their time to advocate for that.

View on HN

Also this part is very weak:

> When a service enables SMS-2FA, an attacker can simply move to a different service. This means that a new attack isn’t necessary, just a new service.

If you implement 2FA you do it to protect the user account on your service, not all services.

Yes, that was a weak argument. How is that not analogous to:

"Password hashing and salting is useless. When a service enables password hashing and salting, an attacker can simply move to a different service that stores passwords in plain text. This means that a new attack isn’t necessary, just a new service."

The largest benefit of 2FA is that if your computer gets compromised it does not automatically to lead comprising of the online bank accounts and such. There still needs to be user interaction and a bot cannot read SMSes itself. Often this time window before a user is fooled is enough to neutralise the attack. It prevents massive user account compromise in scale.

That's not true for SMS-2FA, since text messages are often delivered to the device with the browser. Safari on both macOS and iOS will offer to automatically fill in the code received from SMS.

But it is true for Windows PCs that represent more than 90% of compromised devices.

That would be consistent with ~90% marketshare, wouldn't it?

My Windows/Linux laptop has a SIM card slot

But I do not use it because of risk of getting 2FA compromised :/

I am curious as to how Safari connects the 2FA code to the web page. It would seem whatever they are doing could easily implement a database that maps 2FA SMS messages to domains, not only refusing to auto enter them on phishing sites; but warning the user they may be on one.

It doesn't; it offers to autofill a received code into a field on the page for a short time, but only actually fills it upon user interaction (so the page can't be sniffing for it via JS the moment it arrives).

This article does a better job of explaining how SMS 2FA doesn't solve the credential stuffing problem. https://passwordbits.com/dont-need-sms-2fa/

2FA can, but SMS-2FA depends on your cell provider being resilient to attacks, which they have proven they aren't.

If attacking my X account requires also attacking my SMS provider account, it doesn't make it impossible to attack my account.

However, telecom hacks are often more involved, and take more effort to pull off. If I'm a high value target, it's not a big hurdle. If I'm a low value target, I might not be worth it.

True, but U2F is still a better choice.

While telcos may eventually fix the broken protocols, it's likely to be decades before that has rolled out widely.

In the meantime attackers are going to automate telecom hacks.. why not?

That said, for simple services sending a single use password by email or SMS is quite easy :) My hairdresser does so for reservations, and it's working out fine.. Nobody cares of that account is hacked anyways.

> In the meantime attackers are going to automate telecom hacks.. why not?

A lot of telecom hacks are social engineering, which often leaves an audit trail, and is hard to automate (if they're using the same text to speech engine that makes spam calls, good luck!)

SMS spoofing is certainly automated today.

Stealing SMS messages, maybe less so.. but from what I hear the protocol is largely trust based, so it's unclear that it couldn't be.

That said, eventually telcoms will be forced to fix this. I'm just guessing it'll take another decade or two.. it's not like robocalls were trivially fixed when they became annoying.

Article addresses that:

> SIM swapping attacks are a legitimate concern, but if that was the only problem with SMS-2FA, my opinion is that would not be enough to dismiss it.

Reply on news.ycombinator.com