Hacker News Reader

Comment by exabrial | Hacker News Reader

SMS as a second factor needs to be illegal. Apple, Twilio, and a myriad of other companies cling to it like it's safe when it's not.

View on HN

"Apple, Twilio, and a myriad of other companies cling to it like it's safe when it's not ..."

You're missing the point.

Twilio and Apple (et. al) are not using 2FA for you. It's not to protect you or to help you.

They are faced with a brutal and unceasing spam/scam/puppet onslaught. Forcing you to burn a physical SIM identity to create and maintain an account is just a blunt mechanism to slow this process down.

It is a way of attaching some costs to creating a (Twilio/Apple) account.

They're not doing it for you.

Indeed, you're correct. It's passing the buck of KYC, with an inevitable credit check to another company.

Well, how would you attack fraudsters instead

I would give them a challenge/response to post in their HN user page and restrict it to accounts >4 years old and >500 karma.

Well, you asked ...

Partially, but it's also: you will pay for a phone number, you won't pay for icloud, etc. So, as a result a phone number is costs something like 10 cents for an attacker.

Digital identity, digital identity, digital identity. Until digital identity is a first class citizen in the United States (with support through the various layers of gov from local to federal), private enterprise will continue to lean on suboptimal identity systems (SMS, pictures of government photo ID for proofing a la ID.me and Stripe Identity).

https://news.ycombinator.com/item?id=28203374

https://news.ycombinator.com/item?id=28194815

https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth...

https://www.congress.gov/bill/116th-congress/house-bill/8215...

https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...

I'd be surprised if it happened any time in the next quarter-century. RealID was passed in 2005 and it's not even fully implemented yet, and only about 1/3 of Americans have one. Even if the Feds launched a digital ID, consumer services aren't going to hop on the bandwagon immediately; most people in the US don't have a need for a federal ID, and millions of them don't have any ID at all. Private enterprise is leaning on weak identity because they want more customers with little friction. There's nothing stopping private industry from issuing cryptographic tokens or similar, and many already do. The problem with selling anything to the general public is that you will a very high number of customers who will lose every token you give them, forget every password, and won't be able to produce good proof of ID.

> The problem with selling anything to the general public is that you will a very high number of customers who will lose every token you give them, forget every password, and won't be able to produce good proof of ID.

The US Postal Service (USPS) has successfully piloted a service to check people’s identity in-person at both USPS locations and at people’s homes using their existing portable tablets used for mail delivery [1]. I'd agree that it's uphill, but it (competent digital identity implementation) is necessary for the reliable functioning of government and commerce in the twenty first century. Otherwise, SIM swaps, identity fraud, and similar will continue to be a (costly) thing.

iOS 15 is rolling out digital IDs in Wallet. I'm excited to see if this enabled a faster deployment with solid primitives.

[1] https://gcn.com/articles/2013/01/28/usps-pilot-cloud-federal...

The descendent of that 2013 pilot is today's login.gov, which is not really the kind of 'digital identity' that solves the problems at hand here. It's basically just SSO for government systems and has many of the same security concerns as other SSO systems. Login.gov passwords can be reset by email.

I think a digital ID will be impossible to implement for the sole reason of evangelicals and the conspiratorial atmosphere in the country. There are already a ton of conspiracies floating around regarding ID2020. Get the government involved, and this shit is dead in the water.

There are rational objections apart from superstition. Social security and driver's license numbers have already been abused to the extreme, and now form a backbone of the commercial surveillance web. Secure identification is an utterly terrible idea until the US gets something like the GDPR.

You don't have to be a conspiracy theorist. I don't want most of my online accounts tied to a real ID. In Asia it is apparently common for everything including video games to require your government ID to sign up.

If you make that frictionless, privacy and alt accounts are gone.

Hell no. Why people would trust the federal government to be their gateway to commerce and the Internet is beyond me. Way too ripe for abuse.

Agreed, for most services anyway. I like my country's ID card and electronic ID system and use it happily for state-adjacent services or where regulation requires IDs. I am however very much against using it for things like online shops, SaaS or even phone numbers. Most services don't need to and shouldn't identify me as a unique human, they just need enough information to bill me and provide me with their services.

Ultimately it's the court system that backs up identity. Ideally you never end up there, but its existence is what holds society together. That's where identity matters: where you're held to account for previous actions, such as contracts you've agreed to. Your identity in front of the judge has to be the same as the identity that entered into a contract. This is crucial for enforcement. If both parties to a contract cannot trust that this will happen, then a contract isn't useful to them, and business cannot take place.

For this to work, your digital identity needs to be something that the courts will directly accept as your personal identity. The fact that it is currently indirect is what causes all the problems. For example, nobody knows if some digital identity (eg. SMS verification proving ownership of a phone number) is tied 1-1 with a natural person. When companies assume it is, that's where the crack can get opened by fraudsters.

The only way to fix is this for the courts to be able to _directly_ trust an authority that issues digital identities. The only such issuer I can see working is the government.

In the US I suppose that could be a state government or the federal government, since courts (whether state or federal) will generally be able to trust digital identities issued by the other. But I don't see how this can be fixed by anyone _other_ than governments.

Having said that, I suppose it might be possible for credit agencies to issue digital identities. I haven't thought this possibility through.

It does not need to be illegal. It's not ideal 2FA, but it does not need to be legislated away.

Apple has a second factor system where you can authorize a new device using another Apple device. While this is convenient, not everybody has 2 Apple devices (for each Apple login). Worse, they use a dark pattern to make enabling this (other device auth) the default choice, so it's really easy to setup when you update your iPhone.

I firmly want it to be legislated away, but for a slightly different reason. Specifically, you should never be required to disclose a phone number to a business that doesn't absolutely need your phone number to directly render services.

I was eating at a restaurant once -- IN PERSON -- and the fucking web interface they force everyone to use to order food wanted a SMS 2FA. WTF? No. I don't require your waitress to disclose her phone number to order food. And in return, you don't ask for mine. Just take my food order, swipe my credit card, and bring the food to the table, there is no need to disclose a phone number.

I think the ideal law should be: Any business that wants 2FA MUST support at least U2F hardware keys. It's okay to also offer SMS but not okay to offer only SMS.

SMS isn't about security. It's about making it harder for bots to set up accounts. The first thing you should do after SMS verifying an account is delete the phone number so it doesn't leave a back door open.

Then why do many try to force you to enable SMS even though you are a well known customer? Sometimes it is a soft-force and a few URL changes until you bypass the request.

How do you become a "well known customer" when signing up for an account?

I have been a Twilio customer for years. Now I need to enable SMS. They should know me, not a threat.

At least at the AppleCare call center it’s called “itsme” and it’s a push message. Sadly only works on iOS or macOS

Phishing remains a way more common threat than sim swapping, yet you never see these complaints about TOTP. Sim swapping is just sexy and eats up conversation space.

Reply on news.ycombinator.com