Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

48

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the attack. Even an "average user" might have crypto wallets or precious twitter accounts. Sometimes the gain of an attack is also not that obvious, like when a ...


15

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new system that comes up every few months and that completely obsoletes everything else is usually based on personal financial interests, dogma, belief, and snake oil. ...


10

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability and risk against cost and inconvenience. A different question you could ask is whether SMS 2FA is sufficient mitigation against criminal teams working on mass ...


9

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more than just obtain the recovery SMS. To use SMS recovery, you must have access to a computer and browser where you have previously used LastPass. LastPass ...


8

Great question! I'll attempt to break down the security models. Is there anything inherently more secure about having users enter a 4/8 digit code online vs. sending a code or simple message from their device? While SMS as a whole makes for a weak 2FA method (see the article above from The Verge), at least the former requires the attacker to do some ...


7

Having multiple factors of authentication are always more secure than any one of those factors apart. A password and a token from an SMS message is harder for an attacker to circumvent than just a password or just a token sent through SMS. However, SMS itself is currently considered the least secure authentication method, and there does not seem to be any ...


5

The worry is that 2FA protects you in cases where your passwords get leaked. The 2FA is a mitigating control to prevent people from abusing that password. However people often re-use their password across multiple websites, including their email and most people do not protect it with 2FA. This means that if your password leaks, there is a higher likelihood ...


4

From an OpSec-perspective, I'd argue that a second, dedicated phone (dumb or smart) is a good idea as long as you treat the dedicated phone as exactly that: dedicated to one exact use case. You minimize the attack surface because you'll be less prone to web-borne attacks and you'll slightly elevate your security, albeit through obscurity (of your banking ...


4

Bruce Schenier talks about this issue here. To quote the article. Here are two new active attacks we're starting to see: Man-in-the-Middle attack. An attacker puts up a fake bank website and entices user to that website. User types in his password, and the attacker in turn uses it to access the bank's real website. Done right, the user will ...


4

To echo James' response. It is entirely possible for someone to send you something for a number that doesn't belong to them. This will usually be criminals trying to get you to click a link and steal credentials. Whether this is likely will be dependant on the nature of the message received. If the message is generic and contains a link then sure it's a ...


4

If you still have service to your phone, it's unlikely to be a SIM swap attack. Generally, one of the consequences of a SIM swap is that all the services provisioned on your phone (including your phone number) are transferred to the attacker's phone, by the exact same process as those services would be transferred to your new phone when you upgrade. This is ...


4

Although SMS 2FA is not as strong as TOTP base MFA or the use of a hardware security key (e.g. yubikey) it still offers a significant amount of protection against the typical attacker who's just trying to make use of weak or compromised passwords.


3

A screenshot doesn't prove anything. At all. As long as you know how to use Paint you can modify anything you want. So the screenshot could be fake. Or he could indeed have sent that message and then deleted it. Conclusion: you can't know based on just the information you currently have. You'll have to find more information: If it was an actual text ...


3

By storing the token in the database and sending the (encrypted) id of it to client you've just created new token. Forget about JWT tokens, you new token is the encrypted integer ID in the database. You shouldn't use ID as the new token: IDs are usually incremented (and therefore predictable), and in some encryption schemes flipping the bit in cyphertext ...


3

It is a continuation of the multi-factor approach. The phone number (that the service already has saved) could easily be looked up. That is, they could send you the SMS recovery code without ever asking you anything other than your user name. But, by asking, the service is checking a "something you know" (normally a password, but now your phone number) ...


3

As with most things, it depends. For SMS 2 Factor authentication the answer is - not really The network /telco transmitting the the SMS data is the same whether it is a smart phone or a dumb phone. Call centre operatives who get socially engineered can allow takeover of the relevant number or the actual network can get hacked and the SMS intercepted. If ...


3

The problem I see with this statement is that both of these attacks to me feel like they're essentially only really feasible for attacks targeted at a specific user with the goal of breaching a targeted service. [...] You can't do SIM swap attacks in an automated way or even at scale (unless there is a serious issue with a phone provider). [......


3

You have two areas where you can control this. First, you can control the user/number pair spamming by recording the number you sent an SMS to and limiting the number of messages your system can send to that number. For the case where someone generates multiple users and multiple numbers, you can control that on the user-creation process before the SMS part....


2

Email Verification First If your UX allows, you can require the user to first create an account based on their email address. Once the address is verified you can allow adding a phone number and then verify it your usual way. A legitimate user likely has an email address already, and therefore the setup remains easy. However, an attacker would have to ...


2

I've heard of some banks that send two pin mailers instead of a single one but I think that's two halves of a complete pin number. You can't have more than one pin numbers for a debit or credit card.


2

I don’t think it’s a good idea to require a response message if your goal is just to make the verification process easier. At least, you should remember that it will be impossible to pass the verification if the user is not able to send SMS (e.g., do not have credits or the user is in roaming and he did not buy a plan with outgoing SMS). In addition, ...


2

Sadly, there isn't really a way to prevent it. It's an inherent weakness of the SS7 system. However, you can try to educate your users to not fall for these scams. Maybe you can even hack back and try to play their game and trick them.


2

I don't see any glaring security issue with this, except for I don't really trust SMS for 2FA. I prefer TOTP codes, generated by Google Authenticator, Authy, or any other password manager out there. Back to your process: you don't need 2 timestamp fields. It's trivial to calculate time + 5min on any language you use, so adding it twice is superfluous. Just ...


2

Two-factor authentication means that you prove two things. In most cases, the two things are "something you know" and "something you have". In your case, the "something you know" is the user's password, which they must get correct before the authentication code text will even be sent. The "something you have" is then the phone, which will display the ...


2

Maybe... just maybe.. a simple answer is that your friend has a malware on his phone, and the "victim" isn't actually you but him. I'd suggest you let him know he should comb through his installed apps/plugins, ask if he's installed anything sketchy lately, especially if it reoccurs.


2

SMPP is an application layer protocol and is not intended to offer transport functionality. It is therefore assumed that the underlying network connection will provide reliable data transfer from point to point including packet encryption. Vulnerabilities that are found in SMPP protocol: Zero Confidentiality: As there is no encryption standard specified ...


1

The SMTP protocol has always had support for temporarily down servers. The nominal use case is that a message is submitted by a Mail User Agent (typically a mail reader like Thunderbird) to its closest Mail Transfert Agent (sendmail, postfix, exim, etc.), what is declared as the SMTP server. Then the MTA tries to deliver the message either to a forwarder if ...


1

I think it will keep its place because there is no "buy in" on the user's end IE they don't need to complete any actions on their device prior to using it. I haven't come across any data suggesting that using SMS 2FA decreases security over not using 2FA.


1

You need in Appenter link description here 2FA, see the attached image as an example in gmail. Above most operators are installing SS7/Signalling firewall to ensure that subscribers are secure from SMS interception and redirection attacks.


1

You're overthinking this tiny aspect of your security approach. If the attacker doesn't also have the user's password (and username for that matter, but that should be easy to find publicly in most cases), then a 2FA code won't do them any good, and if they already have the user's password and can actually get an image of the user's phone in real-time to ...


Only top voted, non community-wiki answers of a minimum length are eligible