Feds Warn SMS Authentication Is Unsafe After ‘Worst Hack in Our Nation’s History’
Feds Warn SMS Authentication Is Unsafe After ‘Worst Hack in Our Nation’s History’
Since when was sms ever secure? My understanding is that messages are sent in the clear, meaning your carrier and the recipient's carrier both have the opportunity to intercept messages.
I mean that's the message content, not the authentication, but still, sms is the opposite of secure, always has been.
Not true. SMS is encrypted in 3G, LTE, 5G. Block cyphers like Kasumi and A/9 are used. SMS is reasonably secure, because it's hard to infiltrate telecom systems like S7
it's hard to infiltrate telecom systems like S7
Telecom systems can be (and are) infiltrated though, which is what the FBI is warning about.
SS7 is very insecure. See this video, too: https://www.youtube.com/watch?v=wVyu7NB7W6Y
Watch the video again to see how hard it was for Derrick to get access. He got it via his telecom/academia researcher contact.
It's hard, but not hard enough from what I've been able to gather. We should want something better IMO. I'm surprised that TOTP isn't more common.
S7 will be retired or extended with access control. TOTP apps don't work for edge cases like broken phone. Dedicated token devices get lost. SMS will continue being the main solution for 2FA.
Nah what we need is good privacy-focussed companies getting into the public IAM space.
You know how you can sign into stuff with your Google or Facebook account? And get a 2FA push to your phone?
Like that. Except by a company with a shred of ethics and morality. Like Proton.
I do also think that we all should have a cryptographically secure federally issued identity for official uses such as signing documents or signing into financial accounts and other things that must use your official identity, and not an online pseudonym. Like SSN but on a smartcard. Basically CAC or ECA but for general civilian use.
Proton is already used for identity management: OTP via email. They'll implement OAuth if there's enough demand for it. A company's purpose is to be profitable, ethics side is largely irrelevant.
Many countries already have digital government ID: Australia, Estonia, Russia.
A company's purpose is to be profitable, ethics side is largely irrelevant.
Maybe so, but companies such as Proton's biggest asset is their reputation...a reputation of being privacy-focussed. Without that they are nothing, and they know that. As a result, they try to live up to that reputation as well as possible.
Being as it was started by Sir Tim Berners-Lee (among some of CERN's other founding fathers of the web) is just icing on the cake.
Proton gives data to governments if requested. Why are you trying to shill it?
You can use TOTP with multiple devices. For example with an app on your phone and something like KeePass on your laptop/desktop.
Still not convenient since you don't walk around with this in your pocket - but it doesn't have to be just one point of failure.
What about people who only have one device? Kids, elderly, people with only work computer.
I agree, it's not a perfect system. Even if you do have multiple devices - you may be locked out if you lose your phone while traveling, can have multiple failures.
Although I don't know what is remotely secure and is elderly friendly. Email or SMS 2FA would have been the closest in mind, but it's not secure, and plenty of elderly struggle with both.
Pedantic types always mention that secure is only relevant in the context of a particular threat model. The elderly can use hardware authentication like those RSA devices or ubikey. Unfortunately, this is expensive, and banks don't believe there's demand for that. Would you switch banks for this feature?
Im not terribly familiar with the HW keys; Are you able to get multiple keys? I would worry that it would be similar to TOTP, in that if you lose/misplace/don't have the device then you would be locked out.
And I probably wouldn't switch banks for it, it would depend on how much more secure I perceived it and any other bank differences.
Yes, you can have multiple devices with the same seed for the pseudorandom number generator. You can turn any computer into a hardware authenticator. In practice, it depends on the bank or your employer. Google reduced phishing success rate to zero after switching to ubikey.
As for perception, you really nailed it. It's more important than actual difficulty of gaining access to your accounts. Remember that most articles are written by low skill blue teamers who manipulate your perception into thinking it's really easy while they don't possess the skills to do it. Always call them out in a manner like "you claim it's easy, have you done it?". They will always say no.
because it’s hard to infiltrate telecom systems like S7
cough You can pay a few grand and get access to SS7 networks.
Might be out of reach for most of us, but we can rest assured that any and all security firms and goverrnment agencies have access to this information at a moment's notice.
Simply paying is not sufficient. You need to be a telecom company, or a researcher afaik.
In what world would the US gov care to get into your bank account? Or your Facebook account when it's already tightly controlled?
