Millions of people imperiled through sign-in links sent by SMS
Millions of people imperiled through sign-in links sent by SMS
Even well-known services with millions of users are exposing sensitive data.Dan Goodin (Ars Technica)
like this
⇧
Even well-known services with millions of users are exposing sensitive data.Dan Goodin (Ars Technica)
like this
artyom
in reply to along_the_road • • •This is a crazy problem. Even Apple requires you to use SMS 2FA, and does not let you opt out or use any alternatives.
My employer uses this as well and I was locked out (couldn't do any work) for an entire day because their SMS messages were not being delivered.
As a side note, Apple is also the only platform I've ever used that requires you to type your password in without seeing it, which makes using an actually-secure-password really fucking difficult.
Jul (they/she)
in reply to artyom • • •2FA isn't the issue. The issue is single factor logins with only text messages, no password and often no username. Those messages allow anyone who intercepts them to login, no username or password is involved at all.
2FA via SMS is a perfectly fine solution, though there are more secure options like yubikeys or TOTP generation apps.
artyom
in reply to Jul (they/she) • • •Completely disagree
sem
in reply to artyom • • •artyom
in reply to sem • • •Jul (they/she)
in reply to artyom • • •How so?
It's a second factor. It's "something you know", "something you have", and/or "something you are". The username and password is the "something you know" and the sms message is "something you have" (I.e. the phone). There's no need for the second factor to be secret as long as it is single use and time sensitive and is only used as a second factor, not the only factor.
This article was about single factor messages that are the entirety of the login flow, so not about 2FA, but I'm still interested in the concerns for second factor. It is still adding security over a password alone which is the only goal in the 2FA subject.
artyom
in reply to Jul (they/she) • • •All of the same reasons for single factor also apply to MFA.
It's also dependent on other services, is a privacy violation, and a giant fucking pain in the ass if you ever want to change your phone number, or like me, you have service issues.
There are many other alternate, more secure, more convenient, more resilient options.
Jul (they/she)
in reply to artyom • • •Problem is finding something that is universal that is a "something you have" is difficult to find that almost everyone has. Almost everyone has a cell phone these days, so it's a good option to use as that kind of factor. Email is a second "something you know" factor (I.e. via the password to your email account) and could be the same something if you use the same password. And getting someone to carry yet another device even if it's simple like a Yubikey or something like that can be difficult. And unless biometric devices become universal on computers as well as phones, the "something you are" factor is hard to accomplish universally as well.
So, what options do you think are better that can be a "something you have" for use as a second factor to a password or other type of "something you know" factor?
artyom
in reply to Jul (they/she) • • •Jul (they/she)
in reply to artyom • • •artyom
in reply to Jul (they/she) • • •You know what I meant.
And anyone can get the keys to your phone number much more easily using the methods detailed in the OP, and what's more there's nothing you can do to prevent it, because you don't control it, and carriers obviously don't care.
Jul (they/she)
in reply to artyom • • •That's the thing though, with SMS 2FA you don't have the keys at all, so you can't generate codes, you only get the code you intercept. Same with email based, but with sms, the message has to be intercepted in a timely manner, which is much more difficult for SMS than if they already have your password that's used for your email account. Plus the issues with SMS not being encrypted only really exists on 2G services which they really need to get rid of, or at least disable at the account level so 2G only works for emergency calls. 4G and up are significantly more secure (not perfect but requires much more complex hardware and knowledge of secrets from the cell company) and generally require the hacker to be masquerading as the user on the cellular network. Otherwise, hack the cell provider which is how a lot of the archived messages they mentioned are retrieved, because, yeah, they usually aren't stored encrypted. But if the TTL of the TOTP code is 10-60minutes and single use as well as invalidated once a new code is sent like a bank or really any decent system should, archived mes
... Show more...That's the thing though, with SMS 2FA you don't have the keys at all, so you can't generate codes, you only get the code you intercept. Same with email based, but with sms, the message has to be intercepted in a timely manner, which is much more difficult for SMS than if they already have your password that's used for your email account. Plus the issues with SMS not being encrypted only really exists on 2G services which they really need to get rid of, or at least disable at the account level so 2G only works for emergency calls. 4G and up are significantly more secure (not perfect but requires much more complex hardware and knowledge of secrets from the cell company) and generally require the hacker to be masquerading as the user on the cellular network. Otherwise, hack the cell provider which is how a lot of the archived messages they mentioned are retrieved, because, yeah, they usually aren't stored encrypted. But if the TTL of the TOTP code is 10-60minutes and single use as well as invalidated once a new code is sent like a bank or really any decent system should, archived message caches aren't useful.
The issue mentioned in the article is totally separate. These are links that you can log in without needing to even know a username, much less a password, associated with that code. Guessing a random code generated for a specific account is much more difficult, not to mention needing the password. The article is more hypothetical in the actual security of the SMS messages going to a particular phone for a particular account and more about how bad the links being generated are since if you get one link from any insecure sms message you can access many random accounts as well as the one you intercepted and no other factor, even user id, is needed to use the links. So you can send one code just to your own account and then use that to hack others without even having to intercept anything nefariously.
artyom
in reply to Jul (they/she) • • •I don't understand what you mean by "keys" here. Nothing in encrypted. You generate codes by initiating the login process.
There is no encryption in SMS...
They don't usually hack anything except the humans working at the carrier's service provider.
You don't need archived messages. The most common method is sim swap. Where they stay receiving your sms messages.
Yes but all those same attacks are vulnerabilities mfa as well, as I said previously.
Jul (they/she)
in reply to artyom • • •The way TOTP works is there is a key (usually in the form of a QR code) for TOTP apps. That key is stored in your TOTP app locally, but also often stored I'm the cloud of you use Google's app. Codes are generated using that key and the current timestamp. Otherwise a valid code can't be generated.
The messages aren't encrypted at rest but, the connections are. You need a key in the physical sim card to intercept anything. You can't just intercept and duplicate a sim card's identifier like with 2G. No casual hacker is going to hack LTE or newer technologies, only professionals like governments and government backed spy agencies. Not saying it's as secure as OT should be, but the effort and cost is not worth it most of the time.
And sim swap only works if you also have the person's username and password for 2fa. For the issue mentioned in the article it does w
... Show more...The way TOTP works is there is a key (usually in the form of a QR code) for TOTP apps. That key is stored in your TOTP app locally, but also often stored I'm the cloud of you use Google's app. Codes are generated using that key and the current timestamp. Otherwise a valid code can't be generated.
The messages aren't encrypted at rest but, the connections are. You need a key in the physical sim card to intercept anything. You can't just intercept and duplicate a sim card's identifier like with 2G. No casual hacker is going to hack LTE or newer technologies, only professionals like governments and government backed spy agencies. Not saying it's as secure as OT should be, but the effort and cost is not worth it most of the time.
And sim swap only works if you also have the person's username and password for 2fa. For the issue mentioned in the article it does work because you dont need any knowledge or other factor other than the message itself to login. Single factor logins with not even needing to have a username, much less a password, are obviously going to be an issue, which is why I'm emphasizing, I'm interested in 2FA like a bank might use, not the issue mentioned in the article which is totally different.
artyom
in reply to Jul (they/she) • • •Okay I thought you were still talking about SMS.
No you do not. Most phones don't even have this anymore.
Yes, and for the 3rd time, all the same vulnerabilities exist in MFA.
Jul (they/she)
in reply to artyom • • •I was talking about sms. All types of cryptographic code generation uses one or more keys. The sms type just uses one that only the sender holds, it's never shared with anyone which can cause it to be more easily lost.
The sim cards and their cryptographic keys are just built into the phones, and the codes are swapped when you sign up, same concept as renovable sim cards.
And again, it doesn't matter of a sms code is intercepted as much as the entire login method. If you dont have the username and password, what good does an sms code do for anything? The issue in the article is that there's nothing else to know, just the current format of the set of codes being generated by the system. Then you can randomly guess a similar code and get access to a random person's account. Much, much different from the use MFA which is worthless without ALL of the factors, not just a single one.
artyom
in reply to Jul (they/she) • • •The entire point of MFA is to protect against someone who does have your username and password...
Jul (they/she)
in reply to artyom • • •Exactly, so it does that job because it requires an entirely different and complex skill-set to intercept sms messages and you have to do both things now if sms 2FA is in place. With the issue in the article you dont even need to intercept sms meant for a particular user to get access to random users' accounts, thus totally different issue.
I asked, what is better for a second factor than SMS?
artyom
in reply to Jul (they/she) • • •It does, really poorly, for the reasons I've listed, and for the reasons in the OP.
Not a different issue at all. Exact same issue, with lower risk.
I answered this like 12 comments ago.
We're going around in circles now so I'll bid you good night.