TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Why is using SMS bad for 2FA?

17 点作者 PranavBerry超过 3 年前
I have read in a few places that using SMS is really insecure for 2FA. A few people on this thread (https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29004930) also said that SMS should be avoided as the 2nd factor.<p>What are the security vulnerabilities with SMS? How common are these vulnerabilities? Have there been any security breaches due to these vulnerabilities?<p>PS - I am ideating on creating a 2FA method using public-key cryptography. To login, you just scan the QR code from my authenticator and enter your phone&#x27;s pin or use Face&#x2F;Touch ID. This uses two factors so, first it ensures that the users posses the phone and second it ensures that the user knows the passcode or has Touch&#x2F;Face ID. Please let me know if you have any feedback on this idea and if this solves the problems with SMS.

10 条评论

toast0超过 3 年前
SMS has poor end to end security. It&#x27;s not end to end encrypted, and there&#x27;s no guarantee of effective transport encryption, and the parties involved may not be trusted.<p>In the common case, the sender will submit an SMS to an aggregator. The aggregator may send it on to the carrier&#x27;s gateway, or another aggregator or a &#x27;grey route&#x27;. Grey routes are usually things like gsm modems or automated phones with consumer oriented service plans. The carrier&#x27;s gateway may be operated by a third party, and is hooked up to the internal messaging system.<p>Generally speaking, all of these points log message content for a significant amount of time, and often logs are available in near real time. That&#x27;s potentially a lot of people who have legitimate access to view the messages in real time; if any of the points in the message flow have a security issue, your messages are vulnerable. And the message flow is opaque.<p>Sometimes, the over the air part of the messaging isn&#x27;t well encrypted either, so being in the right place with the right equipment gives you access to the codes, without any insider access.<p>With respect to your idea... If I&#x27;m a common person with one phone and no other computing devices, how do I scan the QR code on the screen from the app I want to login to with the app you&#x27;ve provided. Also, when I lose&#x2F;drop&#x2F;etc that single device, how do I get my account back? Account recovery that relies on users to take proactive steps tends to be low success. This is the hard part, and where SMS as 2FA tends to do well; account recovery is outsourced to the phone companies of the world.
评论 #29259155 未加载
LinuxBender超过 3 年前
SMS is not a great form of MFA but in many cases it is the only option and better than nothing assuming it was implemented correctly, being one of multiple factors and is not a stand-alone factor. Someone will suggest U2F, but most financial institutions don&#x27;t even know what that is much less have any plans to support it. This will sound negative, but sadly my login to a video game is more secure than my login to a bank and I do not see that changing in my lifetime. I would love to be proven wrong. For now I have set most of my bank accounts to read-only meaning I have to go into a branch office, show ID to do anything.<p>As for QR codes, those can be copied or replaced. Maybe if my bank had a QR code behind secured glass that could be used to locally on site import and pin their public certs if applications widely supported it. I will never use digital face&#x2F;touch ID for anything. There are no companies or governments competent or qualified to hold that information and use it for authentication and authorization.
评论 #29255749 未加载
评论 #29255883 未加载
PaulHoule超过 3 年前
There are many ways to intercept SMS such as having a corrupt person who works for your carrier. This place got hacked too:<p><a href="https:&#x2F;&#x2F;urgentcomm.com&#x2F;2021&#x2F;10&#x2F;07&#x2F;syniverse-quietly-admits-it-was-hacked-for-five-years&#x2F;" rel="nofollow">https:&#x2F;&#x2F;urgentcomm.com&#x2F;2021&#x2F;10&#x2F;07&#x2F;syniverse-quietly-admits-i...</a><p>Also what fraction of people are going to let their phone number lapse over the next 20 years? If my goal is not &quot;target somebody in particular&quot; but &quot;cultivate false identities&quot; the range for mischief is greater.
eesmith超过 3 年前
Thespian2 in that thread commented at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29005345" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29005345</a> :<p>&gt; SMS - it&#x27;s just too easy for SIM swap attacks, and good social engineering to phish SMS codes. &quot;Hi, this is $BANKNAME - we saw some suspicious activity on your account, so we are going to send a one-time code to you now. Please enter it back to us here to verify your identity&quot; (scammer then uses your stolen password, tries to log in, real bank sends you real code, which you now are tricked into sending to scammer to complete their login as you).<p>First three DDG hits for &quot;SIM swap attack&quot; are <a href="https:&#x2F;&#x2F;www.consumer.ftc.gov&#x2F;blog&#x2F;2019&#x2F;10&#x2F;sim-swap-scams-how-protect-yourself" rel="nofollow">https:&#x2F;&#x2F;www.consumer.ftc.gov&#x2F;blog&#x2F;2019&#x2F;10&#x2F;sim-swap-scams-how...</a> and <a href="https:&#x2F;&#x2F;us.norton.com&#x2F;internetsecurity-mobile-sim-swap-fraud.html" rel="nofollow">https:&#x2F;&#x2F;us.norton.com&#x2F;internetsecurity-mobile-sim-swap-fraud...</a> and <a href="https:&#x2F;&#x2F;privacypros.io&#x2F;u2f&#x2F;sim-swapping&#x2F;" rel="nofollow">https:&#x2F;&#x2F;privacypros.io&#x2F;u2f&#x2F;sim-swapping&#x2F;</a> .<p>Here&#x27;s a recent news piece on the topic: <a href="https:&#x2F;&#x2F;www.lightreading.com&#x2F;security&#x2F;heres-how-atandt-verizon-and-t-mobile-are-fighting-sim-swaps&#x2F;d&#x2F;d-id&#x2F;773548" rel="nofollow">https:&#x2F;&#x2F;www.lightreading.com&#x2F;security&#x2F;heres-how-atandt-veriz...</a> (&quot;The FCC has received numerous complaints from consumers who have suffered significant distress, inconvenience and financial harm as a result of SIM swapping and port-out fraud&quot;.)
评论 #29255264 未加载
Froedlich超过 3 年前
SMS generally requires a cellular phone. Some people don&#x27;t have one. Me, for example.
warrenm超过 3 年前
Problems with SMS:<p>- it&#x27;s best effort: message may (or may not) be delivered; they may (or may not) come in order; they may (or may not) be timely<p>- SIM stealing&#x2F;swapping is <i>not</i> hard<p>- it&#x27;s all plain-text<p>- if you fatfinger the phone number, your auth code goes to the wrong place
warrenm超过 3 年前
&gt;To login, you just scan the QR code from my authenticator and enter your phone&#x27;s pin or use Face&#x2F;Touch ID<p>Others see the problem with having to scan your QR code while using the device that, presumably, <i>needs</i> the QR code scanned ... you&#x27;ve just mandated multiple devices<p>You might look at SQRL (<a href="https:&#x2F;&#x2F;www.grc.com&#x2F;sqrl&#x2F;sqrl.htm" rel="nofollow">https:&#x2F;&#x2F;www.grc.com&#x2F;sqrl&#x2F;sqrl.htm</a>)<p>Or just use &quot;normal&quot; TOTP systems like the myriad authenticator tools <i>already</i> out there
rvz超过 3 年前
This is exactly why: [0]<p>[0] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29254051" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29254051</a>
Rafert超过 3 年前
You might want to look into what the FIDO Alliance is doing with WebAuthn. The problem is already being solved.
评论 #29257442 未加载
joshxyz超过 3 年前
Why is it bad: prone to mitm attacks in many ways.<p>Better alternative: hmac based totp