Hacker News Reader

Comment by latortuga | Hacker News Reader

My 401k provider recently rolled out 2FA for all accounts. It's mandatory and SMS-only. From the user-side, is there anything I can do short of complaining? Anyway to "convert" to a non-SMS version?

View on HN

Strong password & rotate it. If you're worried about 1 of the 2 factors being less secure than the other, and you can only control 1/2 factors, focus on the 1 you can control ;-).

The nice thing is that 2FA over SMS should, at least, degrade to being a possible notification channel that something is amiss. Keep your password strong and at least it will become a ping message that someone has compromised your password.

use a third party service for sms like google voice, or jmp.chat. yes, it just shifts the problem from your telecom company to a third party, but at least those providers have stronger authentication (google has totp/u2f, and jmp.chat has whatever your xmpp server provides) than what telecoms have.

That solves nothing - the SMS is still subject to all of the same potential issues as one tied directly to a cell phone.

specifically what? i already stated google voice and jmp.chat both have better authentication and 2 factor options than most cell carriers, are they're probably harder to social engineer. since they're internet based, they aren't vulnerable to SS7 exploits. I'm sure if you tried hard enough, you could hack them as well, but at least it raises the difficulty from anyone who read a social engineering guide to nation state or an APT.

> since they're internet based, they aren't vulnerable to SS7 exploits.

I think the problem with SS7 is that there's no authentication between providers. At least as far as I know.

afaik the ss7 exploits essentially involve a rogue carrier saying "hey verizon, your client 212-555-1234 is roaming on my network, plz send all his calls/texts to me". i don't think this attack applies to non-mobile providers because there's no roaming. and unlike the internet, there's no bgp-like system[1] for "announcing" phone numbers. it's all centralized, which should reduce your attack surface from every telecom in the world, to the originating telecom, whoever's in charge of the numbering database, and your carrier.

[1] https://en.wikipedia.org/wiki/Local_number_portability#Porta...

Unfortunately, no. If a service is SMS-only, then it will remain SMS-only until the provider implements time-based tokens generated from an app.

Just tell them you don't have a cellphone ?

I wonder what they would do about it.

Reply on news.ycombinator.com