Hacker News Reader

Comment by SilverRed | Hacker News Reader

You can't guess the 2FA code. It changes faster than you could ever attempt to test all combinations.

It doesn’t matter that the code changes, each guess has a 1/1000000 chance of being the right code. Yes you can’t guarantee you’ll find the code in 1000000 tries, but you still only need to do half of that to have 50% chance of a match.

If someone attempts 500,000 failed 2FA attempts on an account, I think its safe to lock that account/take extra steps.

But you could try ~100 password variations and then attack the 2FA.

Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number.

If you can filter 10,000 accounts down to 100 with known passwords, now you just have to bypass 2FA on 100 accounts.

How can you register a number if its already registered?

A common service offered (I think required to be offered, actually) by telephone service providers is "number porting" - where you switch providers but keep the same number, because people don't like changing phone numbers more than they have to.

It used to be this didn't have any real backend checks, so you could effectively steal someone's number, at least temporarily.

> Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number.

Surely not?

> "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," Lucky225 added, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers.

From 2021:

https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

EDIT: yea it's not 'registering' the number but rather rerouting a copy of all messages to another number.

Reply on news.ycombinator.com