Comment by xyzzy_plugh | Hacker News Reader

Comment by xyzzy_plugh | Hacker News Reader

Parent Full thread

You're not wrong, but it's real problem, both technically and socially, without much in the way of a good solution. Android and iOS provide significant security by virtue of the chain of trust running starting with Google or Apple down through their software and hardware (Google is a bit special here, I'll admit).

This makes it easy for businesses like banks to work with those ecosystems and provide a secure experience without inventing much themselves. What's the alternative? SMS 2FA is abysmal. Maybe they could provide you a configurable webhook, but now they don't control the experience, and that's part of their requirements. Not to mention I wouldn't trust a bank to implement webhooks correctly.

The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Whether it's for chain of security, microprocessors, springs in our toasters, it's not possible to keep everything open and interchangeable while maintaining our current way of life.

I'd love that, but it's not realistic, as far as I can tell.

Before the "standardization" on SMS first and later on Google/Apple systems, there were a number of methods, since banks did try to do R&D to cut out on fraud:

* One-time-pads (yes, I had a bank that would give me a card with 50 codes you were supposed to use once, then go back to the branch for more. Didn't last long, though, and was replaced with:)

* Reusable codes: bank gives you a card with 50 codes. Bank randomly asks you for code number X. X may eventually repeat over time. (Bank also tells you your specific card serial number so that you can identify them).

* Credit cards housing an actual e-Ink display that would give TOTP codes. https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-cre...

* Actual FIDO devices.

My bank issues a fido device: a card scanner with a built in camera that reads qr codes. Excellent tool, but for a few years now the bank is actively discouraging its use, touting the benefits of apps instead. It costs them around 60 euro to issue the device, and, sadly, thats incentive enough to advocate less secure solutions. When they take it away from me, I am out of options as this is the last bank in my country that issues them to individuals :-/

Rabobank? Yes it’s nice but I always find it a pain haha. 60€ wow, when they were first send around they very easily gave me 2 extra to put at work etc.

What about N26, I don’t remember needing the app and I can log into a website. Not sure though…

"What's the alternative? SMS 2FA is abysmal."

It seems to be forgotten that email 2FA exists.

I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ?

There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.

The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails).

Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.

if someone gets access to your phone they can do way more damage, but this is accepted.

It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale

> SMS 2FA is abysmal

Is there actually anything wrong with SMS 2FA, other than SIM swapping?

SIM swapping isn't a problem with SMS so much as the phone carriers, who really need to put stricter processes in place for verifying account transfers. IMO, they deserve most of the culpability.

In Scandinavia we have BankID which kind of uses SMS, but not quite. When I try to authenticate it sends a message to my phone and then I have to type in my 4-8 digit pin code on my phone. Apparently they have put a tiny application on the sim card, so sim swapping isn't an issue. Whenever I get a new sim card I have to authenticate the sim card using my hardware token and password.

Finland I got sometimes SMS in flow. For bank login it is account and password, then one time code. Then when making transaction getting SMS with which one time code to enter. And then when paying with confirmation same thing but just with SMS code.

I don't really see point of SMS in flow, but hey I can somewhat live with it.

Have only a small amount of money on you regular account for the everyday means, with all the money on another account whatever.

Lose your wallet with cards, lose your phone (or just a phone with Apple/GooglePay). Get a replacement SIM, be locked out of receiving any SMS for 24h[0]. Now be somewhere where is no local branches of your bank.[1] Or even better - be abroad.

Or just be in a taxi at 9PM when no one works and the bank locks you out - just like when it happened to me. Gladly I found an ATM where I could withdraw from a secondary account.

[0] Actual practice of cellular operators in my country. Safety

[1] Even better with the virtual banks without any.

Isn’t this a problem with _any_ type of 2FA?

I agree insofar as, this is exactly why I strongly believe that 2FA should always be optional. But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?

> Isn’t this a problem with _any_ type of 2FA?

Not quite because if you lose your YubiKey - you just lost your YubiKey, you still have the ability to call the bank (and my bank knows my number, so they greet me by the name) and at least do something, in the situation I've got in the previous comment I could lift the lock out with the code word, only if I could recall it then.

But the phone is not only your 2FA item, it is also your "virtual identity" now for too many services, banks included. And with the tendency of banks to shoehorn you to their phone apps this starts to get ridiculous, if you lose your phone you are now:

lost your banking app (2FA with push)

lost the ability to 2FA with SMS as a backup

lost the ability to install the app on the new phone (oh hi $username, it is really you despite you just gave your $username@gmail.com and password? We sent you an SMS to confirm it is really you, FOR YOUR SAFETY)

lost the ability to login to your bank account on someone's else phone (same shit with SMS to your phone number)

Bonus points: if you lost your ID or doesn't have it on you - you can't restore the SIM with your number. Or even buy a new one in many cases.

> But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?

Pfft. I was forcefully shoehorned to mandatory SMS 2FA by my bank. I've opted out of this some years ago and it did work... till I was 600km from my home, I needed to buy the train tickets, I tried to logon to the bank webapp to move the required amount to the primary account only to discover what they enabled 2FA without asking. And the phone where my SIM (known by the bank)[0] was installed was literally on it's last 10% of charge in the airplane mode. It could literally shutdown just from the act of disabling the airplane mode so I could receive the SMS.

So if the problem is not with SMS 2FA. The problem is what nowadays "SMS 2FA", at least for the banking apps[1], is way, way more than just SMS alone.

[0] I'm not sure if they monitor IMEI of the device, but I wouldn't be surprised, considering they receive the notification of the changed IMSI.

[1] Not sure how these practices are widespread world wide.

Phone carriers deserve culpability because unrelated companies use them for purposes they are not supposed to be used for?

They deserve culpability for letting someone else receive my private text messages. It doesn’t matter whether those messages contain one-time passcodes, intimate conversations, or critical business data—they were intended for me and no one else.

One thing that can and must be fixed instantly is to legislate that these businesses can not deny their services to anyone, just like systemic banks and the post office.

> The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication.

Come on, we have open webbrowsers, which are 100x more difficult to implement than a chain of trust. Surely, somebody could come up with a reliable alternative.

> What's the alternative? SMS 2FA is abysmal.

There are cross platform MFA solutions that could be supported. Your guess is as good as mine as to why banks don't support them.

Not really a technical challenge. You could force an equivalent of POSIX, maybe based on WASM, that smartphone makers would be forced to support if they want to sell in your region, and forced to support side loading those apps, as no government should be subject to the caprices of the various app stores. At this point smartphones have a fairly mature feature set to expose to the app. That would also help with the anti-competitive app store practices.

Why is SMS 2FA abysmal?

Can't your number be spoofed?

Reply on news.ycombinator.com