A leaky database spilled 2FA codes for the tech giants

techcrunch.com

42 points·arkadiyt··9 comments

The error: A database connected straight to the internet.

This description alone points to multiple organizational failures:

* Nobody did security scans from the outside

* Managing the firewall failed or the firewall does not exist.

* They have a culture where having production systems without passwords is acceptable. Also: They don't know who has access to their production data.

* Their customers rely on a third party without regular audits

We probably can go on like this for a while.

Only thing that's both safe and convenient to use is FIDO2 physical keys. For 2FA I hate it when services provide more secure options like FIDO2 keys and least secure options like SMS OTP and no way to disable them. Even worse is when some sites still do security questions.

Equally galling to the leak itself is that XY is storing text messages long after delivering them. Inexcusable.

All SMS providers retain full messages for spam/abuse analysis, etc.

SMS is not a secure message transport and has never been advised as such.

This FOIA'd DoJ doc from 2010 seems few major carriers retain SMS contents, and only one for more than a week: https://www.aclu.org/cell-phone-location-tracking-request-re...

How many more reasons do we need to not use SMS as an authentication tool?

Don't 2FA codes have short expiry times?

Doesn't matter if you have live access. It's on demand.

This is why real 2fa is 'something you have' not 'something else you know)

The assumption here is that sms 2fa requires something you have, but that's always been really horny for telephone numbers, since the phone company is the one that actually 'has' numbers

In this case it turned out that “something you have” was “access to prod”

Reply on news.ycombinator.com