10 ms·
Second factor SMS: Worse than its reputation
- F30 2y ago"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."
- slow_typist 2y agoLook at the list of customers, most of them should be able to build their own service. Instead they bought API access without the leastest of due diligence, putting their customers and their reputation at risk. Additionally, the merging of different customer’s data by the processor is probably not GDPR-compliant (even if access control was in place).
- lmz 2y ago> most of them should be able to build their own service. Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.
- stavros 2y agoNo, the hard part is having to secure all these little random services that I've now built. Why would I not just pay for someone whose job it was to worry about this instead?
- PinguTS 2y agoSo you say, that for Google, Amazon, Facebook, Microsoft, which are among those costumers, it is too hard to negotiate with the various teclos?
- lmz 2y agoNot in the US at least for those companies, but the world is a big place and this other comment https://news.ycombinator.com/item?id=40935323 https://news.ycombinator.com/item?id=40935323 mentioned places like Gambia and Burkina Faso... It just makes sense to outsource local delivery to companies that are better connected locally.
- Tepix 2y agoIt's not their core business, which is why they let SMS aggregators deal with it and merely switch inbetween those.
- fatnoah 2y agoYes, and there are multiple levels of aggregators. For example, in a past life, I built SMS APIs and back-ends, including ones used by smaller telecoms to enable their subscribers to send/receive SMS. (We were pretty small, and only accounted for something like 0.5% if US SMS traffic) We connected to multiple aggregators. It's been a few years, but the big players in the US (Verizon, AT&T, Sprint, T-Mobile) were split between different aggregators. It was a similar situation in Europe. A big part of working with a new aggregator was a full review of security and privacy, and that became even more important as we began the process of being acquired by an F100 company. I'm still trying to figure out why messages were stored in S3 buckets to begin with. That's an architecture choice that makes little sense to me, especially since the limited size of SMS makes them pretty space efficient.
- sleepyhead 2y agoWe at MakePlans were affected by this breach as we use Twilio. We are not using Twilio Verify (their 2FA api) but rather handle 2FA SMS ourselves in our app using Twilio as one of our providers. So the CCC definition of this being only 2FA-SMS is incorrect, it was all SMS sent through this Twilio third party gateway that was exposed to a limited set of countries (France, Italy, Burkina Faso, Ivory Coast, and Gambia). GDPR is not necessary applicable here. An SMS gateway is most likely classified as a telecom carrier, and thus any local telco laws would be applicable and not GDPR. That applies only to the transfer of the SMS though, so for example a customer GUI of sent SMS would be out of that scope. (And before someone tells us that SMS 2FA is insecure I would like to point out that we use this for verification purposes in our booking system when a customer makes a booking. So for end-customers, not for users. It is a chosen strategy for making verification easy as alternatives are too complex for many consumers. All users however authenticate with email and password, and have the option of adding TOTP 2FA).
- slow_typist 2y agoI think 2FA via texts is better than no 2FA. But only if you do not make the texts world readable. Apart from that, to me it seems justifiable to follow a risk based approach. Booking systems up to a certain value/amount, fine. Online Banking and health related services, thank you, no.
- sleepyhead 2y agoIt's not really 2FA even. More like a magic link (which is what we use for verification via email). The customer has no password, just verifies using a code via sms/email.
- slow_typist 2y agoPasswordless, so to speak. Does it help with conversion rates?
- sleepyhead 2y ago
- deleted 2y ago[deleted]
- kkfx 2y agoThe modern auth invented just to push mobile + cloud model is DISGUSTING. We have since decades smart cards for various things, from payments to IDs, why the hell not keep inserting readers in keyboards and laptops bodies, selling cheap desktop USB reader and teach people to use them? Simply because with them there is no way to force mobile computing allowing some third party to snoop a bit in end users lives. I hope a day or another people will understand and IMPOSE an end to such crappy unsafe practice.
- worksonmine 2y agoMany people today don't even own a computer and do everything on their phones. Teaching the masses safe habits rather than convenient ones is a difficult problem, most don't care.
- Hamuko 2y agoYou can use Yubikeys, which are basically the modern and better version of "smart cards", on phones and tablets just fine. I have a Yubico Security Key on my keychain and I can use it on my iPhone with NFC or with my iPad using USB-C.
- kkfx 2y agoYou need it. While your bank already gives you (typically) a card you can also use as is for auth for them. Your country probably have some e-documents already, no need for extras to authenticate the public sector services and so on. The point is offering something already usable and gives people a habit on that. After we might add yubi for generic services like GMail and so on.
- Hamuko 2y agoI have zero clue as to what you're talking about. And what card am I getting from my bank?
- 2y ago
- throw0101d 2y agoIf the choice between no 2FA and SMS, which is better?
- ossobuco 2y agoAs the linked post says itself, "2FA-SMS is Better Than Nothing"
- account42 2y agoThat really depends what else the company uses your number for now that you have given it to them for 2FA. Often enough it ends up being usable as a one factor for account "recovery".
- hun3 2y agoBut it's also the most cost expensive (from provider side) among 1FA and 2FA-OTP
- pilif 2y agoI think conversion rate and support cost associated with 2FA-OTP are worse enough for SMS to still be worth it, especially as a phone number also gives you a good marketing ability and a reasonably unique identifier for a user. If not, everybody would be using OTP already.
- reginald78 2y agoThat is what everyone dances around in these discussions. It doesn't matter if it is a good second factor because it is an excellent user tracking identifier and that is what they were really after. Twitter and facebook both lied about only using these numbers for security and then almost immediately put them to use for advertising purposes. We only know about it because they were big enough to sue, I'm sure every crappy site that gets the number sells it. As a bonus, it also allows them to dump a lot of the infrastructure and support problems onto some one other than themselves. The biggest problem with SMS-2FA in my opinion is a lot of places are setup so it isn't even a second factor. I can often reset my password just through email so it just seems like throwing a threadbare blanket marked security over the top of a user tracking scam.
- sleepyhead 2y agoApparently the messages on the S3 bucket were updated every five minutes: https://www.zeit.de/digital/datenschutz/2024-07/it-sicherheit-datenschutz-passwoerter-zwei-faktor-authentifizierung-sicherheitsluecke https://www.zeit.de/digital/datenschutz/2024-07/it-sicherhei... The CCC definition of this being only 2FA-SMS is incorrect though. It was not only Twilio Verify (2FA API) that was affected, it was all SMS sent through this vendor.
- PinguTS 2y agoWhere do you have the Twillio Verify reference from? It is nowhere mentioned.
- sleepyhead 2y agoIt is not but CCC is indicating that this provider was only used for 2FA. Sorry I was getting a bit ahead of myself here, this was earlier exposed as a breach of Twilio's vendor (IdentifyMobile). In the case of Twilio they offer an API for 2FA, Twilio Verify. I wanted to clarify that this breach was not only for 2FA, Verify API in the case of Twilio, but for all SMS sent through IdentifyMobile.
- averageRoyalty 2y agoHardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.
- TonyTrapp 2y agoIt is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.
- commandersaki 2y agoI don't see why SMS would need to write to a store, public or not. One can implement SMS-2FA using TOTP for example, it's just that the TOTP secret is not shared with the recipient.
- TonyTrapp 2y agoYes, it is not a technical necessity to store these messages. But there is the option to do it (and some people are evidently doing it). The point is that for one-time-passwords, it's not even an option, not matter how hard you try. You simply cannot make this class of mistake. Unless you try really really hard to fuck up and, say, for some very weird reason, exfiltrate the one-time passwords generated on the user's device every few seconds.
- warkdarrior 2y agoHow does the bank verify the OTP generated on the user's device?
- captrb 2y agoWhat if my OTP base data is exported to a publically-readable datastore? I could be tricked into exporting the QR codes from Google Authenticator, for example. Though I see that there are significantly better 2FA methods, it does seem like the biggest flaws with SMS 2FA are in the insecure implementations, not the actual concept.
- deleted 2y ago[deleted]
- skilled 2y agoTwilio said the data was accessible between May 10 and May 15, 2024[0]. I mean, even if we disregard the auth codes thing, which according to CCC were being generated on a static timer, if someone did get access to this bucket - they would have gotten away with a juicy list of phone numbers and names from some of the top companies, at the very least. I'm not sure how hard it would be for an S3 scanner to guess "idmdatastore", so it is difficult to say if anyone else got in. Even if not, a live database storing live data without encryption or anything is crazy. I feel like IdentifyMobile will feel the wrath of this no matter what. [0]: https://stackdiary.com/twilio-issues-an-alert-about-a-security-incident-with-a-3rd-party-carrier/ https://stackdiary.com/twilio-issues-an-alert-about-a-securi...
- didntcheck 2y agoAnd unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!
- jdiez17 2y agoHot take: rooted phones are inherently less secure. That does not include GrapheneOS btw, since you don't have root privileges on an official build of GrapheneOS.
- hedora 2y ago"Less secure" depends on your threat model. I'm much less worried a hypothetical attack where I accidentally give sudo access to a malicious app than I am about the well-established ongoing attacks where Google violates the entire population's privacy, or the regular stream of malware that makes it into the official app store.
- jampekka 2y agoNot that long ago it was considered a problem to have a rootkit on your machine [1]. Nowadays it's getting hard to acquire a device that hasn't been rootkitted at the factory. [1] https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo...
- hiatus 2y ago> Hot take: rooted phones are inherently less secure. My computer is rooted, making it inherently less secure than my phone, yet I have no trouble accessing my bank website. What threat is a bank protecting against by disallowing app usage on a rooted phone?
- throwaway290 2y ago> What threat The threat to majority. Very very few people own a computer than a phone. And those people are much more tech savvy.
- dools 2y agoA family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the addition of a new "pay anyone" payee, and with that her money was gone[0]. I have accounts with 2 banks, one uses SMS 2fa and the other uses an app which generates a token. I had thought that the app was by default a better choice because of the inherent lack of security in SMS as a protcol BUT in the above attack the bank that sends the SMS would have been better because they send a different message when you're doing a transfer to a new payee than when you're logging in. So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you're performing and won't accept, for example, a login token when adding a new payee. I haven't seen any bank with that level of 2fa yet, has anyone else? I guess perhaps passkeys make this obsolete anyway since it establishes a local physical connection to a piece of hardware. [0] Ron Howard voice: "she eventually got it back"
- bckr 2y agoAnother lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank
- akira2501 2y agoIf Google ad words even allows a scammer to create an ad for a bank login page then we have a more fundamental problem.
- dools 2y agoAlso that Google, as a search engine that is also the world's biggest advertising company really should be able to manage not to sell ads to phishing scammers!
- Ekaros 2y ago
- 0xbadcafebee 2y agoI can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. Your desktop, laptop, tablet, and phone can all share a password manager. They work offline and online. Passwords generated are unique, breaking password reuse attacks. Password managers support auto-filled TOTP codes per-login. They support passkeys. There's password managers built into browsers in addition to the 3rd party ones. There are personal, family, and enterprise options. They could be installed as a system service to isolate them from userland attacks. They support advanced functionality like SSH keys, git signing and biometrics. If you're a stickler about having a completely independent factor from your desktop/phone/etc, password managers could be used with different profiles on different devices, and allow several easy ways to pass an auth token between devices (via sound, picture, bluetooth, network, etc), ensuring an independent device authenticates the login to avoid malware attacking the password manager. We already have the tools to do something way more secure than SMS, and it's already on most of our devices/browsers. We just have to make it the preferred factor.
- amluto 2y ago> I can't think of any reason why we should not make password managers mandatory for all web authentication today, with the password manager being the 2nd factor. A password manager is, in essentially every respect except interoperability, inferior to WebAuthn. Let’s not make an inferior solution mandatory when we already have a superior solution.
- jampekka 2y ago> Let’s not make an inferior solution mandatory when we already have a superior solution. With a slight caveat that it doesn't work. At least not on Linux without some proprietary junk dongles or their emulators.
- mixmastamyk 2y agoHuh, can you be more specific? I thought I was using this on Linux with bitwarden. Is a yubikey “junk?”
- deleted 2y ago[deleted]
- LorenDB 2y agoI think we should just ban companies from implementing SMS 2FA. https://lorendb.dev/posts/lets-ban-sms-2fa/ https://lorendb.dev/posts/lets-ban-sms-2fa/
- JohnMakin 2y agoThis causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.
- Tepix 2y agoBut did you RTFA? SMS aggregators can also be hacked or can leak SMSs by accident.
- JohnMakin 2y agoThis would still be a targeted attack if exploited, and arguably much more difficult than sim swapping. And yes, I did RTFA, and my point still stands.
- mixmastamyk 2y agoBan would need to be combined with a requirement for something else.
- elric 2y agoI've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.
- brandon272 2y agoThey force SMS 2FA because it is a lot more frictionless to assume that your users have a phone number than to assume that they have a 2FA app installed on their phone and know how to manage those tools. It's also easier to support.
- ryandrake 2y agoUgghhh, "frictionless" as if we're talking about logging into Candy Crush here. Are the "Growth Hackers" infiltrating banking apps now? I don't want my bank software to be frictionless. I want it to be secure.
- brandon272 2y agoThe person I was replying to said "they just want your phone number", which to me implies that we're not talking about 2FA at the level of banking apps, as the bank already has your phone number, among plenty of other details. Most banking apps I have used also do not use SMS 2FA.
- rafram 2y agoThat’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!
- dylan604 2y agosince COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device. I know I'm not the first person to be unable to port a number, so calling a phone number something that never changes is a bit skewed
- Hobadee 2y agoNIST has explicitly said you shouldn't use SMS 2FA for a while now: NIST SP 800-63B §5.1.3.3. https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB
- brandon272 2y agoThe perspectives and interests of NIST and the things that a service provider has has to worry about with respect to their customer/user experience are not necessarily aligned. Customer: "What do you mean two factor app? I thought the code was supposed to come to my phone?" Support: "It did, but we no longer support SMS two factor authentication." Customer: "But I had no problems when the code came to my phone." Support: "Yes, but NIST recommends that we don't use SMS 2FA" Customer: "What's NIST? I'm finding this very frustrating, I need to get into my account."
- Hello71 2y agoit would be most convenient to have no 2FA. hell, skip the password too, then nobody will forget theirs. security is tradeoffs, but NIST says "if you take security seriously, you should not use SMS 2FA".
- LordKeren 2y agoIt’s all a gradual improvement over time though, as both companies are able to adopt better practices and customers become accustomed to it. Many, many more people are using TOPT than a decade ago.
- akira2501 2y ago> Customer: "But I had no problems when the code came to my phone." "Unfortunately, many of our other customers, and customers of other financial institutions were not correctly protected by the code alone.. and were still getting scammed or confused.. and losing _all_ their money." > Customer: "[...] I'm finding this very frustrating, I need to get into my account." "That is understandable, but we take the security of your account and your personal information very seriously, and this requires us to make changes to maintain that security in the face of new threats and actors as they evolve."
- omh 2y agoThe article conflates two issues that have different security implications. The "1-click login" links are a concern and just having access to the SMS would be enough to take over things like WhatsApp. But 2FA codes seem notably less worrying. They are the second factor and require an attacker to have the password too. For these cases I'm much more relaxed about the use of SMS and the risks of interception.
- pphysch 2y ago> They are the second factor and require an attacker to have the password too. For every leaked database of SMS messages there are 1000 leaked databases of account credentials
- omh 2y agoGood point. But what's the threat model here? I didn't think of 2FA as being protection against password reuse. People should still avoid reusing passwords and change them if they know of a breach. Are there really attackers who are picking up breach databases and then sim-swapping to get the 2FA as well?
- samspot 2y agoI think 999 of those databases are the same data set. I lost a password ten years ago from a blog breach and I get almost a monthly notification about it showing up again and again.
- bigmattystyles 2y agoIt always feel useless when you get the second factor on the very device you are logging in from. I know it's not because you still have to physically have the device but instinctively, I always think true 2FA should involve different devices.
- cpcallen 2y agoIn the UK it seems that almost all online banking transactions are now verified by SMS. As far as I can tell this is required by law, and replaced the previous, bank card + card reader + pin verification system, which was not only more secure but also did not depend on having a working mobile phone with signal. I hope that this will in due course be recognised as a terrible mistake and rectified. Unfortunately my hope is only faint.
- xnorswap 2y agoWhich bank? I'm with LLoyds and transactions are verified via the app, not SMS.
- switch007 2y agoFirst line is not true at all. SMS is an option, but many support app based 2fa Agree about the card reader being useful for offline. But I never remembered the thing and was often stuck when travelling
- DanielHB 2y agoSweden solved this problem years ago with BankID https://en.wikipedia.org/wiki/BankID https://en.wikipedia.org/wiki/BankID It is amazing what a little cooperation between public and private institutions can achieve. It is the only way to login and 2fa to government services and most banks (some legacy systems are still supported by banks) and it works great. It is incredible there is no system like this for every country, heck it is incredible that there isn't a system like this for the whole EU.
- mixmastamyk 2y agoIs it true that it doesn’t support Linux as the wiki implies? I guess the card form could be used instead.
- DanielHB 2y agoIt is pretty complicated for the average person to install custom certificates on their OS. I didn't even knew that BankID supported it, pretty much every one uses the app.
- jampekka 2y agoEU is introducing Digital Wallet for this. I hope it will nicer to use than the Finnish version of BankID. Also would be nicer to be less dependent of banks or other private rent-seeking institutions. Not having too high hopes though. https://ec.europa.eu/digital-building-blocks/sites/display/EUDIGITALIDENTITYWALLET/EU+Digital+Identity+Wallet+Home https://ec.europa.eu/digital-building-blocks/sites/display/E...
- RajBhai 2y agoHow about the login service send the code encrypted in the SMS such that it can only be decrypted on the phone of the actual user? Still vulnerable to phishing attempts, but better than relying on deficiencies of SMS technology .
- weinzierl 2y agoCan someone explain to me how SIM swapping actually works? All the articles and videos I found are like: 1. Attacker calls phone companies support hotline or alternatively his confidante there 2. ** MAGIC ** 3. Atacker has access to SMS messages sent to victims number I understand that some might be deliberately vague but I don't want a step by step instructions, just a high level technical overview. And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address.
- toast0 2y agoIf you have a never registered, not expired SIM for a carrier, the carrier can register it to an account given the IMSI. You can also do this with eSIM without needing a physical SIM. So, step 1, convince the carrier representative. Step 2, give the the IMSI. Step 3, put the sim in your phone and receive SMS. If you do step 1 in a physical store, the representative will probably give you a new sim from their stack even.
- weinzierl 2y agoThanks, this is the hint I needed.
- zinekeller 2y agoExcept for state-level attacks (in which case you're screwed anyways), in some countries the process tends to be lax (on-the-spot issuance of replacement SIM without robust identity verification or allowing SIM replacement to any arbitary address without verification). This also does not consider insider attacks, where people in the company... can just re-issue any SIM for any number they please (and therefore there are people who are willing to issue illicit SIMs in exchange for money).
- mnw21cam 2y ago> And to give another hint why this is so hard for me to understand: To the best of my knowledge, if I call my phone company with whatever scenario that I can imagine that involves my SIM, all they will do is send me a new SIM to my physical address. That's basically SIM-swapping. The only step you haven't described is getting the new SIM sent somewhere else, which probably isn't too hard a thing to achieve given sufficient corruption. Ultimately, the phone company uses its information to work out where to send an SMS, and that information is an entry in a database - SMS to number X is routed to SIM card ID Y. If an inside job can change that database entry for a while, that's enough to attack SMS-2FA.
- rsync 2y agoRandom thought I’ve been having as we keep bringing this topic up these past few weeks… How interesting or uninteresting would bi-modal 2FA be ? That is: you receive a code by text and you enter the code by email… I haven’t spent any time to work out whether this significantly changes the attack surface but… At first glance it does seem like you would need to own two different account types… … So I guess a first question would be: does this exist anywhere? Has anyone ever seen this or done this?
- hypercube33 2y agoHow do you secure email then? This obviously won't work for login to that.
- warkdarrior 2y agoBi-modal 2FA is already here: you receive a code by text and you enter the code in your web browser (or a proprietary app like a banking app). Moving from web browser to email for entering the 2FA code means that you (the user) have to make sure to send email to the correct address, not one provided by the attacker.
- thepasswordis 2y agoI’ve recently become pretty disillusion with 2FA in general. Google has recently started enforcing their own “click yes on already authorize mobile device” 2FA, which is very frustrating. I have hardware 2FA keys that I keep in a safe. I deliberately do not keep them on me, and using them to re-auth is mentally an “event”. This is not the case with my cell phone, which my kids play with, gets left on my dresser while the cleaners work, etc. Really pushing me to run my own services again, but that obviously comes with its own challenges.
- warkdarrior 2y agoGoogle lets you choose which authenticators to use (SMS, push to mobile, TOTP, etc). It sounds like you should disable push to mobile for your accounts.
- thepasswordis 2y agoYou cannot disable this anymore. You can add a hardware key, but cannot disable the mobile confirmation thing.
- uconnectlol 2y agoWow SMS 2FA forced bullshit that suddenly got astroturfed right on the day of the Snoweden revelations is actually indeed bullshit. When will they have opt out of this or is this just the end of the web? 20 years ago I did not need or want anything more than a password (obviously cryptographic key auth would be better but not if it's brought to you by X.509). And of course all the HNers who eat this shit up and defend it like little dogs are suddenly on the other side. Email verification is fucking dumb too, and of course now every email forces phone SMS shit.
- tamimio 2y agoThe rule of thumb is that you should always avoid any services that still rely on SMS or phone numbers as an ID or 2FA. They simply don’t care about your privacy or security, even if they advertise it. A prime example is Signal. Unfortunately, for some other services, like banks or government agencies, you don’t have any option. You can only minimize the impact by using a unique password and username and keeping them updated.
- TacticalCoder 2y agoOut of curiosity, I just tried with ChatGPT 4o... Screenshot of a legit banking website and asking it to describe it to me, to give me the exact URL in the screenshot and to tell me if it's legit or not. It described me the whole page, explaining it was a login page to log in to bank X in country Y. He compared the URL with the bank's name, etc. Then I modified one letter in the URL, changing "https://online.banking.com https://online.banking.com" (just an example) to "https://online.banklng.com https://online.banklng.com" and asked ChatGPT 4o again. He said it was a phishing attempt. So, basically, you can, today, already have a screenshot automatically analyzed and have a model tell you if it's seemingly legit or not.
- shreddit 2y agoSo what you are telling me is that windows “recall” feature could actually protect people from phishing attacks…
- mattigames 2y agoDid you just call chatGPT "he"? Oh that may get you in quite a lot of hot water this days!
- compootr 2y agothat's called a hallucination. AI models are simply guessing what to say with differing sizes of word banks At it's best, it may even "recognize" the top 90% of sites. Often, it's not a bulletproof solution, and shouldn't be trusted to generate either false positive/negative My best operational security advice is not to click shit in your inbox and navigate directly to the hostname you trust to do sensitive actions
- beepbooptheory 2y agoDid you ask it with the modified page in the same context?
- swatcoder 2y agoI know everybody's doing it because they don't know better, but it's a terrible idea to make the inductive leap from one successful sample to some abstract sense of what a ML model is suited for. Especially for anything important. As a sibling comment noted, performance will almost certainly be sensitive to temperature (randomness), exact prompt phrasing, exact sequence of messages in a dialog, and the training-data frequency of both the site being analyzed and the phishing approach used. One could conceivably train a specialized ML model, perhaps with an LLM component, to detect sophsticated phishing attempts and I would assume this has even been done. But using a relying on generic "helpful chatbot" to do that reliably and sufficiently is a really bad idea. That's not what it's for, not what's good at, and not something its vendor promises for it to remain good at even if it happens to be today.
- refurb 2y agoIn Singapore, the banks have moved away from SMS entirely, even for notifications. Now they have to come through the app. But for login you basically register a single phone, download a certificate to it and that becomes your second factor. If you login via web or another phone, you need to approve the login from that phone. Of course if you lose the phone (or it's damaged) you need to go to the bank to fix it, but that seems like a reasonable approach.
- efitz 2y agoSeveral financial institutions I work with require 2FA with SMS, and do not offer an option for HOTP/TOTP. FML.
- unstatusthequo 2y agoI like that IdentifyMobile's website[0] isn't even protected with a valid HTTPS cert. Falls back to HTTP. Oh and it's WordPress. And last updated 2015. Guess that's all telling. Nice that so many important companies used this crappy provider for such things. [0] http://www.identifymobile.com/ http://www.identifymobile.com/
- simoncunningham 2y agoCertain financial institutions in some regions mandate telephone-network based 2FA for their customers accounts, and in the event of an account compromise attempt to pin the onus of liability on the customer. Maddening they wont give customers better options if they want to secure themselves.
- seoulmetro 2y agoThat's because SMS verification isn't 2FA. It's faux 2FA. You don't possess your phone app or your phone number... it can be cloned and intercepted. A key you hold on your person is 2FA.
- ablob 2y agoAny push-based service would be vulnerable to this, wouldn't it? The medium doesn't matter if somewhere in the chain someone stores the message (in public).