Hacker News Reader

Comment by space_rock | Hacker News Reader

Agree. Although I would like coinbase to move away from SMS 2fa

They already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at all (they don't browse HN and Krebs), which is much, much worse.

Coinbase should continue doing what they are doing, which is to support SMS, and educate and encourage users where possible to use something else instead.

Ok before I was locked out of my account for changing phone numbers they only had SMS

You can change your phone number by re-validating your identity. During the 2FA step when logging in, you can click on "I need to change my phone number" (or similar).

I'm not entirely familiar with coinbase, so is it really 2fa or is it 1fa in that you can use SMS as a recovery method when you don't know your password?

How about allowing users to turn off sms.

Coinbase does allow SMS to be turned off. I did that on my account. When SMS is turned off, and when a U2F security key is the only 2FA you configured, if you lose the security key the only way to recover the account is to contact their support department and provide a photo of yourself holding your ID.

for many users the alternative is no 2FA at all

I'm pretty sure people have phones and Coinbase can force them to install a 2FA app.

Which works fine until they buy a new phone and trade in or reset the old one without transferring the private keys -- and now you're locked out of your own account because you lost your second factor.

No problem, just reset your factor over SMS!

There are multiple ways to avoid this, such as using an app that saves those keys (eg Authy) or using recovery keys.

But then bad guy just logs in to Authy with the same stolen credentials because most normal people will probably use the same credentials for everything, including Authy. And arguably, the smartest tech-savvy folk wouldn't be storing their 2FA keys in the cloud like Authy anyway.

If your cloud account is protected by 2FA that's also in the cloud... it's turtles all the way down.

How do you “Log in” to Authy? It’s tied to your Apple/Google ID afaik and the 2fa codes are also protected with a passphrase.

> and now you're locked out of your own account because you lost your second factor.

To verify someone's identity ("Identity Proofing") using Stripe Identity [1] costs ~$2. They support IDs from 33 countries, and have implemented fraud detection in the flow. If you were so paranoid as to defend against someone stealing your government issued ID (used in the proofing process), you could paper mail a OTP to physical address on file.

Does it suck and its the cost of no digital ID infrastructure in the US? Yes. Is it insurmountable? Not at all. At the end of the day, people are the weakest link, and we must fallback to meatspace trust anchors (in this case, possession of government provided ID that can be provided on demand with robust fraud detection mechanisms). You are who you are, and own what you own, not because of key material but because of the law.

[1] https://stripe.com/identity

Emergency single-use codes. They can be printed and stored in a safe. Not every service with 2FA has this feature, I have no idea why. How hard could it possibly be?

I don't have a phone that will run apps. I'm pretty sure I'm not alone.

> which is much, much worse.

This attack wouldn't have been possible if they didn't allow SMS 2FA, so I don't think that's fair to say at all.

What if the users had no 2fa at all? attackers still had their passwords and their emails, and their sms numbers

What they should be doing, is to subsidise YubiKeys to their high-value customers.

Not just to lock down the logins to Coinbase, but to also secure their customers' email, Twitter accounts, and as many other online systems as would support hardware backed WebAuthn. Hell, PokerStars did this with RSA tokens back in 2008 so it's not like it's a new idea.

I love my YubiKey but it doesn't work with my phone. Have newer models solved this problem?

My iPhone supports my Google Titankey through NFC, and I think newer Yubikeys also have NFC.

HOLD ON. You can get your iPhone to actually recognize your Titan key via NFC?

Please tell me how to do that?

Two iPhones and every type of Titan key that is currently sold, still haven't been able to make NFC work, nor authentication over Bluetooth.

You just tap your key to the back of your iPhone whenever prompted (such as Coinbase app login).

Have you actually done that with a Titan key and had it work?

Yes. You need NFC chipped phone and and NFC model YubiKey.

That also solves a major usability issue: instead of trying to juggle between a mobile application and a TOTP authenticator (on the same device!), or plugging in a USB adapter for authentication needs, you just quickly tap/wave your keyring next to the phone. Or take your phone quickly by your pocket when you need the second factor.

Wait, why should they accept customer funds if they don't think they can keep them safely? If somebody is saying, "Let me hold on to your money for you," it seems like a minimum bar is them being pretty sure it's not going to go anywhere.

Using SMS 2FA is negligent, considering it’s been four+ years since NIST told the industry not to use it because it’s not safe.

(It’s also the only option offered by many US banks, which is a sad commentary on the level of tech innovation in finance in the USA.)

I don't know about you, but in the days of smartphones, login + mail + sms seems pointless. The only lock is the pin code / fingerprint on your phone, since when that is unlocked, the attacker gets to trigger all validation steps.

The important part is having physical access to the phone. A targeted attack against you now requires a physical element, rather than being entirely online.

Assuming the phone is not remotely exploited.

Agree with everything you say, but add to that a lot of sms 2fa exploits are sim or redirection attacks. It’s possible to get access to a phone number without access to the phone.

Here’s an old story of a friend who had a weird talk with someone who had redirected their phone:

https://williame.github.io/post/24949768311.html

Reply on news.ycombinator.com