7 ms·

This is the most naive take on HN. The only secure computer is one that's been unplugged and buried in six feet of concrete, everything after that is a compromi

This is the most naive take on HN. The only secure computer is one that's been unplugged and buried in six feet of concrete, everything after that is a compromise The real world security issues that companies face are things like: - users that re-use tiny passwords written on post-it note that's attached to their monitor - regulated industries that don't allow them to actually lock a user out, which causes leaky social engineering flows for their help centers - users that constantly forget their passwords, and have terrible forgotten password questions/answers - passwords they share with a friend/partner, that they then have a falling out with The reason SMS 2FA is popular, is because the average use case is that the user's (reused and/or weak) password was captured somewhere, and this protects the user from simple attacks to their account where the password is known. It's just like the pin code for most modern smartphones: just secure enough to keep the average person out if their phone is lost or stolen "But Joe, having a more secure system isn't that much harder on the user and is infinitely more secure". I promise you, it is that much harder. Most users can barely understand/handle SMS 2FA. Remember, we have to force users to not use trivially simple passwords like 'password'. Shoot, companies like AOL still derive monthly subscription fees because it's too hard for people to figure out how to change email providers

iso1631 4y ago
My bank wanted me to verbally give them a new password (with various constaints like uppercase, lowercase, symbols, at least 12 characters) over the phone, having already identified with a dozen or so personal bits of information. Apparently it was perfectly secure because to use it I also need an SMS
- coldpie 4y ago
  Yikes. You should get a new bank. There are acceptable places for compromising security a bit, but reading out your password over the phone and then verifying SMS code also over the phone is definitely not one of them.
codegeek 4y ago
I hear you. However, don't force it on me then. Why not make it optional and give me a big disclaimer that I assume the risk if not signing up for that SMS based 2FA ? We already check many boxes. happy to check 1 more.
- Kiro 4y ago
  You are the one forcing your opinion on us. "We are tired". No, you are tired.
- Shish2k 4y ago
  > give me a big disclaimer that I assume the risk Are you (and everybody else who ticks this box) going to pay for the company’s time dealing with the resulting tech-support phone calls? You might be willing to assume the risk for your own data, but for the company to offer this option, you also need to assume the risk of increasing their operating expenses
TacticalCoder 4y ago
> The reason SMS 2FA is popular, is because the average use case is that the user's (reused and/or weak) password was captured somewhere... People are not disputing the effectiveness of 2FA. They're saying that SMS is not a reasonable way to implement 2FA. All my banks' websites in Europe (I've got several) are requiring the use of a physical device, provided by the bank, and protected by a PIN. I need to use such devices both to log in and to confirm wire transfer / stock buys / etc. U2F keys like Yubikeys and physical 2FA devices like those provided by my banks are way better than SMS 2FA. Why not strive towards that instead of saying that SMS 2FA is popular for reasons and that nothing can be done about it?
- vanilla_nut 4y ago
  Physical 2FA devices impose a significant price burden on folks who don't have a lot of disposable income. Imagine scraping by to pay rent from your minimum wage job, and you're told that you can't sign up for $SERVICE because you don't have a new enough phone or a yubikey. Email 2FA works just fine. Set a long, secure password for your email account. Trust that your email provider won't allow anyone to brute force their way into the account. Don't use that email for any other accounts. Bam, security is fine. Stop trying to force more and more purchases and apps down other people's throats. Maybe I don't have a smartphone or a yubikey. I should still be able to use services, especially when many of them are required to function in society today.
- pmontra 4y ago
  Italy here. A couple of my banks let me login by confirming my identity with a fingerprint on my phone, in their app. Another one still supports their old 6 digits OTP generator, but also has the app with the fingerprint authorization. Mastercard does key6 but they or my bank also send a SMS with a numeric code. Paypal sends an SMS with an OTP. It seems that nobody wants to spend money on hardware here.
  - ghaff 4y ago
    The parent did refer to banks giving them to people. I just got a USB one in a swag bag at an event from Google so I guess they're pretty inexpensive these days. But I don't disagree with the basic point. Most everyone has a phone and won't carry around a separate hardware device in general irrespective of price.
insanitybit 4y ago
> I promise you, it is that much harder. Than TOTP? Than email? The problem with SMS is that it adds additional vulnerabilities through sim jacking. Every other 2FA method is tied much more strongly to an identity.
- hn_throwaway_99 4y ago
  > Than TOTP? Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device. > Than email? Probably not much better than email for most users, but I guarantee for a large subset of users the SMS experience is better. With email you need to go to a separate app/page on the same device, with SMS you get a notification on a separate device or a notification popup on the same device (that usually lets you easily copy the code). Again, I totally agree that SMS has issues, but people arguing against it should spend some time in a usability lab with non-tech people - the kind of issues they hit will blow your mind. > The problem with SMS is that it adds additional vulnerabilities through sim jacking. Then fix the SIM-jacking problem. Which, I'll note, phone companies have made a lot of improvements in making this harder, and in the US government has gotten involved in making this harder. Most importantly, note that SIM-jacking is really just a "how do we verify someone who lost a device" problem. That exact same problem exists with TOTP and hardware keys. All we really need are uniform guidelines for proving identity when a device is lost so you're not at the mercy of some low-paid, outsourced service rep to keep your account secure in the face of a persuasive bad guy.
  - insanitybit 4y ago
    > Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device. You can store your backup codes in any number of ways. The easiest being to just download them and have them automatically backed up to Google Photos/ iCloud. > Again, I totally agree that SMS has issues, but people arguing against it should spend some time in a usability lab with non-tech people - the kind of issues they hit will blow your mind. I don't really care about usability when the solution is strictly worse than doing nothing. Like, to be clear, users would be safer without SMS if they just used a unique password. SMS is a terrible solution that really only solves "you used the same password across two sites, one of those sites got popped, the attacker doesn't have access to the common tooling to phish your SMS, and you can't figure out how to use email apparently". > Then fix the SIM-jacking problem. It's a lot harder to fix "make SIM recovery safe" than it is to fix "make email recovery safe" because phone numbers transfer all the time and emails rarely do. Further, almost all account recovery ends up falling back to email natively, so there's no additional attacks added. At the end of the day: 1. Every modern browser supports a synchronized password manager, which makes all non-FIDO2 MFA basically useless 2. SMS 2FA adds additional attack surface through SIM jacking 3. Every modern phone is a FIDO2 compatible token SMS 2FA is simply a technology that has no place. Attacker tooling has already started to adapt to non-FIDO2 MFA so the time for that approach is just over, the best thing we can do is stop pushing for adding new vulnerabilities just to fail to solve a problem that has trivial solutions. In short, it adds nothing over other techniques and it strictly increases attack surface.

iso1631 4y ago

My bank wanted me to verbally give them a new password (with various constaints like uppercase, lowercase, symbols, at least 12 characters) over the phone, having already identified with a dozen or so personal bits of information. Apparently it was perfectly secure because to use it I also need an SMS

coldpie 4y ago
Yikes. You should get a new bank. There are acceptable places for compromising security a bit, but reading out your password over the phone and then verifying SMS code also over the phone is definitely not one of them.

codegeek 4y ago

I hear you. However, don't force it on me then. Why not make it optional and give me a big disclaimer that I assume the risk if not signing up for that SMS based 2FA ? We already check many boxes. happy to check 1 more.

Kiro 4y ago
You are the one forcing your opinion on us. "We are tired". No, you are tired.
Shish2k 4y ago
> give me a big disclaimer that I assume the risk Are you (and everybody else who ticks this box) going to pay for the company’s time dealing with the resulting tech-support phone calls? You might be willing to assume the risk for your own data, but for the company to offer this option, you also need to assume the risk of increasing their operating expenses

TacticalCoder 4y ago

> The reason SMS 2FA is popular, is because the average use case is that the user's (reused and/or weak) password was captured somewhere... People are not disputing the effectiveness of 2FA. They're saying that SMS is not a reasonable way to implement 2FA. All my banks' websites in Europe (I've got several) are requiring the use of a physical device, provided by the bank, and protected by a PIN. I need to use such devices both to log in and to confirm wire transfer / stock buys / etc. U2F keys like Yubikeys and physical 2FA devices like those provided by my banks are way better than SMS 2FA. Why not strive towards that instead of saying that SMS 2FA is popular for reasons and that nothing can be done about it?

vanilla_nut 4y ago
Physical 2FA devices impose a significant price burden on folks who don't have a lot of disposable income. Imagine scraping by to pay rent from your minimum wage job, and you're told that you can't sign up for $SERVICE because you don't have a new enough phone or a yubikey. Email 2FA works just fine. Set a long, secure password for your email account. Trust that your email provider won't allow anyone to brute force their way into the account. Don't use that email for any other accounts. Bam, security is fine. Stop trying to force more and more purchases and apps down other people's throats. Maybe I don't have a smartphone or a yubikey. I should still be able to use services, especially when many of them are required to function in society today.
pmontra 4y ago
Italy here. A couple of my banks let me login by confirming my identity with a fingerprint on my phone, in their app. Another one still supports their old 6 digits OTP generator, but also has the app with the fingerprint authorization. Mastercard does key6 but they or my bank also send a SMS with a numeric code. Paypal sends an SMS with an OTP. It seems that nobody wants to spend money on hardware here.
- ghaff 4y ago
  The parent did refer to banks giving them to people. I just got a USB one in a swag bag at an event from Google so I guess they're pretty inexpensive these days. But I don't disagree with the basic point. Most everyone has a phone and won't carry around a separate hardware device in general irrespective of price.

insanitybit 4y ago

> I promise you, it is that much harder. Than TOTP? Than email? The problem with SMS is that it adds additional vulnerabilities through sim jacking. Every other 2FA method is tied much more strongly to an identity.

hn_throwaway_99 4y ago
> Than TOTP? Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device. > Than email? Probably not much better than email for most users, but I guarantee for a large subset of users the SMS experience is better. With email you need to go to a separate app/page on the same device, with SMS you get a notification on a separate device or a notification popup on the same device (that usually lets you easily copy the code). Again, I totally agree that SMS has issues, but people arguing against it should spend some time in a usability lab with non-tech people - the kind of issues they hit will blow your mind. > The problem with SMS is that it adds additional vulnerabilities through sim jacking. Then fix the SIM-jacking problem. Which, I'll note, phone companies have made a lot of improvements in making this harder, and in the US government has gotten involved in making this harder. Most importantly, note that SIM-jacking is really just a "how do we verify someone who lost a device" problem. That exact same problem exists with TOTP and hardware keys. All we really need are uniform guidelines for proving identity when a device is lost so you're not at the mercy of some low-paid, outsourced service rep to keep your account secure in the face of a persuasive bad guy.
- insanitybit 4y ago
  > Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device. You can store your backup codes in any number of ways. The easiest being to just download them and have them automatically backed up to Google Photos/ iCloud. > Again, I totally agree that SMS has issues, but people arguing against it should spend some time in a usability lab with non-tech people - the kind of issues they hit will blow your mind. I don't really care about usability when the solution is strictly worse than doing nothing. Like, to be clear, users would be safer without SMS if they just used a unique password. SMS is a terrible solution that really only solves "you used the same password across two sites, one of those sites got popped, the attacker doesn't have access to the common tooling to phish your SMS, and you can't figure out how to use email apparently". > Then fix the SIM-jacking problem. It's a lot harder to fix "make SIM recovery safe" than it is to fix "make email recovery safe" because phone numbers transfer all the time and emails rarely do. Further, almost all account recovery ends up falling back to email natively, so there's no additional attacks added. At the end of the day: 1. Every modern browser supports a synchronized password manager, which makes all non-FIDO2 MFA basically useless 2. SMS 2FA adds additional attack surface through SIM jacking 3. Every modern phone is a FIDO2 compatible token SMS 2FA is simply a technology that has no place. Attacker tooling has already started to adapt to non-FIDO2 MFA so the time for that approach is just over, the best thing we can do is stop pushing for adding new vulnerabilities just to fail to solve a problem that has trivial solutions. In short, it adds nothing over other techniques and it strictly increases attack surface.