644
Feds Warn SMS Authentication Is Unsafe After ‘Worst Hack in Our Nation’s History’ (gizmodo.com)
submitted 2 years ago by to c/technology@lemmy.world
158 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 2 years ago (16 children)

Not true. SMS is encrypted in 3G, LTE, 5G. Block cyphers like Kasumi and A/9 are used. SMS is reasonably secure, because it's hard to infiltrate telecom systems like S7

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 6 points 2 years ago* (last edited 2 years ago) (1 child)

    it's hard to infiltrate telecom systems like S7

    Telecom systems can be (and are) infiltrated though, which is what the FBI is warning about.

    SS7 is very insecure. See this video, too: https://www.youtube.com/watch?v=wVyu7NB7W6Y

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 2 years ago* (1 child)

    because it’s hard to infiltrate telecom systems like S7

    cough You can pay a few grand and get access to SS7 networks.

    Might be out of reach for most of us, but we can rest assured that any and all security firms and goverrnment agencies have access to this information at a moment's notice.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 2 years ago

    Simply paying is not sufficient. You need to be a telecom company, or a researcher afaik.

    In what world would the US gov care to get into your bank account? Or your Facebook account when it's already tightly controlled?

  • permalink
  • fedilink
  • source
  • parent
  • [+] 5 points 2 years ago* (last edited 1 year ago) (11 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 4 points 2 years ago (10 children)

    S7 will be retired or extended with access control. TOTP apps don't work for edge cases like broken phone. Dedicated token devices get lost. SMS will continue being the main solution for 2FA.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 3 points 2 years ago* (3 children)

    Nah what we need is good privacy-focussed companies getting into the public IAM space.

    You know how you can sign into stuff with your Google or Facebook account? And get a 2FA push to your phone?

    Like that. Except by a company with a shred of ethics and morality. Like Proton.

    I do also think that we all should have a cryptographically secure federally issued identity for official uses such as signing documents or signing into financial accounts and other things that must use your official identity, and not an online pseudonym. Like SSN but on a smartcard. Basically CAC or ECA but for general civilian use.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    Proton is already used for identity management: OTP via email. They'll implement OAuth if there's enough demand for it. A company's purpose is to be profitable, ethics side is largely irrelevant.

    Many countries already have digital government ID: Australia, Estonia, Russia.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago* (1 child)

    A company's purpose is to be profitable, ethics side is largely irrelevant.

    Maybe so, but companies such as Proton's biggest asset is their reputation...a reputation of being privacy-focussed. Without that they are nothing, and they know that. As a result, they try to live up to that reputation as well as possible.

    Being as it was started by Sir Tim Berners-Lee (among some of CERN's other founding fathers of the web) is just icing on the cake.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago (5 children)

    You can use TOTP with multiple devices. For example with an app on your phone and something like KeePass on your laptop/desktop.

    Still not convenient since you don't walk around with this in your pocket - but it doesn't have to be just one point of failure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 2 years ago (4 children)

    What about people who only have one device? Kids, elderly, people with only work computer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 years ago (3 children)

    I agree, it's not a perfect system. Even if you do have multiple devices - you may be locked out if you lose your phone while traveling, can have multiple failures.

    Although I don't know what is remotely secure and is elderly friendly. Email or SMS 2FA would have been the closest in mind, but it's not secure, and plenty of elderly struggle with both.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 years ago (2 children)

    Pedantic types always mention that secure is only relevant in the context of a particular threat model. The elderly can use hardware authentication like those RSA devices or ubikey. Unfortunately, this is expensive, and banks don't believe there's demand for that. Would you switch banks for this feature?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (1 child)

    Im not terribly familiar with the HW keys; Are you able to get multiple keys? I would worry that it would be similar to TOTP, in that if you lose/misplace/don't have the device then you would be locked out.

    And I probably wouldn't switch banks for it, it would depend on how much more secure I perceived it and any other bank differences.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 years ago

    Yes, you can have multiple devices with the same seed for the pseudorandom number generator. You can turn any computer into a hardware authenticator. In practice, it depends on the bank or your employer. Google reduced phishing success rate to zero after switching to ubikey.

    As for perception, you really nailed it. It's more important than actual difficulty of gaining access to your accounts. Remember that most articles are written by low skill blue teamers who manipulate your perception into thinking it's really easy while they don't possess the skills to do it. Always call them out in a manner like "you claim it's easy, have you done it?". They will always say no.

  • permalink
  • fedilink
  • source
  • parent