Hacker News Reader

Comment by O__________O | Hacker News Reader

Stop using SMS for 2FA.

Not familiar with SMS Sender ID Verification, but after quick Google, I was unable to find any signs that it counters SMS spoofing.

SMS as a 2FA channel is broken. There are so many vulnerabilities that it just makes no sense to use; for example: corrupt telco employees, SS7, sim card cloning, sim swap, spoofing, governments, etc.

Beyond that, if you’re located or traveling internationally, it’s a nightmare to deal with.

NIST has not recommended SMS based 2FA since 2016:

https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...

View on HN

SMS has a unique advantage that no other channel has: No user onboard needed. Got a SIM ? got SMS.

I send lots of 2FA SMS for a number of banks here in Europe and they - because of the costs after PSD2[1] went live - want users to use their app for getting notifications as 2FA. They have launched several communication campaigns over the last 2-3 years, but only 30% of users have migrated from SMS to in-app notifications, mostly because they won't even install their app.

Then, we have uses cases where users don't have a regular relation with your business (p.e. e-sign for consumer goods financing on spot). In this case, I would say that SMS is the only channel you have to serve these users.

For better or worse, I do not see SMS disappearing anytime soon.

[1] https://ec.europa.eu/info/law/payment-services-psd-2-directi...

Don't have a SIM? Get fucked.

There are people who don't have a cell phone because they see it as a distraction engine that will gobble up their life. Digital addictive drugs. But it's almost impossible to maintain this stance in modern life. Have you seen the trend of restaurants that no longer print menus? Instead there is a QR code that opens up their website to get the menu. Every service now wanting SMS verification adds to their problems.

I have asked for a paper menu in these cases and almost all restaurants have been happy to oblige. One time the restaurant let me use their ipad to see the menu.

I wouldn’t count on this, but I’m trying to give a business money. Most are happy to satisfy reasonable requests.

I was at a food court recently where one of the restaurants didn't have a menu. Just a QR. I asked, and there's no paper version available. I asked what they do for blind people and got a blank stare.

So I went to the restaurant next door. If you can't even bother to scribble a menu on a chalkboard, you're not a real business.

> I asked what they do for blind people and got a blank stare.

Probably talk to them? I'm not sure where you're going with this because a paper menu isn't going to help with blindness.

Let me introduce you to the wonderful world of Braille: https://en.wikipedia.org/wiki/Braille

Does your average mildly competent restaurant have braille menus to begin with...?

It's not only about having a SIM but also have one 'they' like. I am with a small provider here in Switzerland (that is the daughter of the biggest provider) and things like Twitter, Twitch, .. don't even support that number for whatever reason.

I personally only use throwaway rental numbers on the web, basically giving me the worst security possible for any kind of account that falls back to SMS for security.

I know people who have tried to save money or tried to avoid giving money to unethical companies by only having a virtual phone number. Turns out that virtual SMS numbers are treated like radioactive Ebola by most services.

It's a lot more complex than that actually. With Signalwire for example you can rent Canadian (and US) numbers at 0.2/m that work well with surprisingly many services, but not all. In a similar fashion you always find the right company to use/abuse any service that asks for a number. You won't get around the internet with a single cheap VOIP number tho. Plus there are providers with more or less perfect Sims but they are expensive.

There are also services that are specialized on providing the right number for a one time fee. This usually works well, but more often than not destroys future account security (they all will give numbers out again, not relevant what they claim)

I could literally write a book about my life without a 'real' phone number.

I would buy and read that book, even though I know a lot of it will be out of date by the time it was ready for sale.

Things like my bank refusing to work with me over the phone because the person literally did not believe I could have a number starting with 666. That's timeless :)

We actually scrape like 30 sites offering virtual numbers to block them all. Our customers don't like seeing their SMS appearing in random sites.

They should stop being so nosy and looking over the user's shoulder, then.

That doesn't sound really effective at all. So you only go after the 'free online SMS numbers' so every number behind a minimal pay wall still works?

Skype

>Instead there is a QR code that opens up their website to get the menu.

This is a trend here in Brazil. And do they send you to a lightweight, mobile-optimized web page? No way in hell, you can be pretty damn sure they will send you to a 20MB PDF that was designed for printing.

It's mind boggling how insane this is.

> Don't have a SIM? Get fucked.

Well yes, doesn't literally everything need a phone number to work these days? Can't open a bank account, can't get paid, can't pay bills, can't exist.

Make a guess how fast one can SIM swap you if you are a good target. Phone calls and SMS should not be used for any such communication period.

2FA is ideally user generated to begin with, and not the other way around.

This is more to check the box and state to the court you tried your best.

P.S. Example: We had serious issues when people gave Google their phone numbers and the corporate accounts got hijacked.

> but only 30% of users have migrated from SMS to in-app notifications, mostly because they won't even install their app.

You say 'even' but it's hard to make sure apps aren't able to track me at all, and I while I trust my bank to keep my money safe I don't trust their app to be tracker-free.

That may be so, but the alternative approach something like Google/KeePass/whatever Authenticator which has the issue of not being bound to your number (unlike SMSs) so if your phone gets destroyed you can't simply get a new phone and sim from the operator and continue as usual, you're completely fucked instead.

Depending on the authenticator used, you are absolutely not fucked. It even works while waiting for your new phone / sim (had this happened to me on a Saturday night in France. Nothing's open Sundays).

There's Authy that does backups and you can even run it on a computer (even Linux!). 1Password can store OTPs, too, and is also backed up. There are probably a bunch of others and I'd expect KeePass to be able to do backups.

Plus, you're usually able to get the OTP seed which you can store on your own. This usually shows up as "can't scan this code?" or similar when registering.

I'm now traveling overseas, and have a local SIM in my phone. I have an older iPhone, so no dual-SIM for me. If I had to receive an SMS I guess it would still be better than my older Galaxy S5 which required a reboot, but it'd still be a pain to have to switch SIMs.

If I lost my Phone but still had my laptop, I'd be AOK with my current OTP setup. Except for a few sites which don't allow me to have anything else besides an SMS, but luckily they're not critical.

Well some do it properly I suppose, but on the other hand Google Auth has 100M users and no ways to back up. All of those people are royally screwed if anything happens.

>no ways to back up

not true. that QR code you scanned to add the key to your app? well, that was your key. you could have saved it somewhere else secure that does allow exporting.

Which all people of course do. Or is it more like 0%?

I have been one of those people. There must have been a lot of them because “export” is now an option which dumps all or selected keys and a giant non standard? QR code that can be imported into another instance. Mine are now on two devices.

Ironically the only sites that force me to use SMS for 2FA are banks.

You are only in trouble if you didn't keep a copy of your private keys backed up.

Unfortunately many of these apps treat the private keys like the app owns it which is where people run into trouble. Some will even back up to the app provider's cloud service which is just asking for it to be stolen.

> if you didn't keep a copy of your private keys backed up

Most people don't. The average person doesn't even know that's a thing since like 1 in 100 services prompts you to even do that.

They're worse than that. I had pattern lock on my phone and it stopped working one day. After a factory reset all authenticator apps lose your credentials.

On Android, if you use AndOTP, the app allows you to easily back up all your OTP secrets to an exportable file, with optional password encryption. Trivial to then import into another phone.

Google won't even allow you to enable app-based 2FA until you've signed up for SMS-based 2FA.

Unless you go back into the 2FA interface after the fact, there's no indication that app-based is even an option for Google accounts.

That's not 100% true... the one alternative is to first enable U2F hardware-based 2FA (which can be emulated on a PC using softu2f), then you can enable regular app-based TOTP codes.

Can you provide reading links for SS7 and co please. I really don’t understand why it’s so insecure.

Reply on news.ycombinator.com