Hacker News Reader

Comment by nsenifty | Hacker News Reader

I don't understand why the 2FA texts don't clearly state what the intent of the code is?

Something on the lines of "you or someone tried to create a new Google voice number. Please enter this code xyz on the form to proceed".

View on HN

Around here all banks that used SMS for 2FA did that. You'd get sms detailing the transaction - whether it's log in, transfer or anything. In case it is a transfer, the text included the amount and destination account.

Everyone mostly went to "authentication apps" now but those still show what are you confirming.

Not sure why it is not a common practice.

Yes, this is called WYSIWYS (what you see is what you sign) and I suffer whenever I receive a confirmation code saying absolutely nothing. However, when _you_ write the code to some trusted web app, there is that context, at least. But reading the code to some random person on the phone? No way!

It's probably a fine line between "brief and readable" and "detailed but people cut to the chase and get burned".

Do you really need a message like that? If you didn’t try to sign in But you get a notification, it’s pretty freaking clear what’s going on. Alternatively if you just signed up a new account you should probably expect a message like that

A common attack is to impersonate a trusted institution and ask for confirmation via an SMS code. The attacker is going through the lost your password recovery flow for 2FA, but pretends it's just for confirmation of identity. If they're smart they can even perform the attack twice and change the 2FA number for your account. If the code was accompanied by an explanation of the intent it would mitigate the attack, that's why.

Clear to whom? Have you ever worked with the average user?

It doesn’t matter how many notifications you give the average user if that’s your argument

Reply on news.ycombinator.com