SMS Multifactor Authentication in Antarctica(brr.fyi)
brr.fyi
SMS Multifactor Authentication in Antarctica
https://brr.fyi/posts/sms-mfa
157 comments
>my personal Google Voice number for the authentication code
A lot of financial institutions do not allow gv/voip numbers anymore. So, I've had to add one more layer to this, namely forwarding sms from phone to gv, which then goes to email. It looks like there aren't great solutions for forwarding sms to email directly on android, but there is an sms forwarder app on f-droid that works for forwarding to gv.
A lot of financial institutions do not allow gv/voip numbers anymore. So, I've had to add one more layer to this, namely forwarding sms from phone to gv, which then goes to email. It looks like there aren't great solutions for forwarding sms to email directly on android, but there is an sms forwarder app on f-droid that works for forwarding to gv.
> It looks like there aren't great solutions for forwarding sms to email directly on android
You can also do this with a Particle board or some other similar embedded device running code on bare metal instead of an Android phone. The advantage being that you won't fall victim to a Java crash or software update, and you can probably set up a watchdog reboot on it.
You can also do this with a Particle board or some other similar embedded device running code on bare metal instead of an Android phone. The advantage being that you won't fall victim to a Java crash or software update, and you can probably set up a watchdog reboot on it.
[deleted]
This seems insane to me. If I were in this situation, I would simply not use Teams if I can't log into it. The only way to get situations like this resolved is for the pain to be felt by someone with the power to change it. Absorbing the pain yourself by working around it is just enabling these things.
Who has the power to change it? How do you make them feel pain? Is this the hill you want to die on? If you can't suffer the asinine 2FA problems while trying to get work done on your glacially slow PC in your 88F office, you will not last long enough to make change. More accurately, you'll probably be able to stick around forever, but without promotions, approbation, or influence.
The answer is to be heroically productive, despite all these ridiculous obstacles, and then to use your reputation to build a base of opposition within your organization from which to fight these problems. If that sounds hard, exhausting, and thankless, then you have your answer for why these things don't get fixed.
The answer is to be heroically productive, despite all these ridiculous obstacles, and then to use your reputation to build a base of opposition within your organization from which to fight these problems. If that sounds hard, exhausting, and thankless, then you have your answer for why these things don't get fixed.
>Who has the power to change it?
It doesn't particularly matter who has the power to change it, but it's probably near to the top of the organizational structure.
>How do you make them feel pain?
The way I see it, either:
1. Teams is crucial and not being able to access it easily means eventually things that are important to the people at the top of the organization are missed or take too long. This is the pain you can make them feel. You presumably have your ass covered by raising your issues in writing earlier, so the blame ultimately doesn't rest with you.
or
2. Teams was never important, so not being able to access it easily turns out to not really be that much of an issue for anyone who has any kind of influence.
>you will not last long enough to make change
The person doing this is not trying to make change. Rather, the whole point is to stop insulating decision makers from the consequences of their decisions.
It doesn't particularly matter who has the power to change it, but it's probably near to the top of the organizational structure.
>How do you make them feel pain?
The way I see it, either:
1. Teams is crucial and not being able to access it easily means eventually things that are important to the people at the top of the organization are missed or take too long. This is the pain you can make them feel. You presumably have your ass covered by raising your issues in writing earlier, so the blame ultimately doesn't rest with you.
or
2. Teams was never important, so not being able to access it easily turns out to not really be that much of an issue for anyone who has any kind of influence.
>you will not last long enough to make change
The person doing this is not trying to make change. Rather, the whole point is to stop insulating decision makers from the consequences of their decisions.
I love your indignation; it validates the way I've felt about various things over the years, so you deserve some explanation of the culture and my thought process:
I'm reminded of the investing maxim that "markets can stay irrational longer than you can stay solvent." I'm a military officer who's not yet senior enough to be vested for retirement benefits, but senior enough to be within striking distance of vesting after 15+ years ("golden handcuffs"). The career model for officers is also "up or out" and every year counts (i.e. one needs to remain within the top 50% of performers who've also devoted the last 15+ years of their lives to this). If it takes the bureaucracy longer than a year to change something stupid, I need to be very thoughtful about what stupid things I choose to protest with disobedience. Furthermore, as someone who works in the IT part of the organization, saying that I can't figure out a way to stay logged into Teams would be an especially bad look. A significant part of my job at the time was helping non-IT people to find solutions for stupid IT problems while advocating for changes to the IT people above me.
I'm reminded of the investing maxim that "markets can stay irrational longer than you can stay solvent." I'm a military officer who's not yet senior enough to be vested for retirement benefits, but senior enough to be within striking distance of vesting after 15+ years ("golden handcuffs"). The career model for officers is also "up or out" and every year counts (i.e. one needs to remain within the top 50% of performers who've also devoted the last 15+ years of their lives to this). If it takes the bureaucracy longer than a year to change something stupid, I need to be very thoughtful about what stupid things I choose to protest with disobedience. Furthermore, as someone who works in the IT part of the organization, saying that I can't figure out a way to stay logged into Teams would be an especially bad look. A significant part of my job at the time was helping non-IT people to find solutions for stupid IT problems while advocating for changes to the IT people above me.
Nobody uses Teams voluntarily.
So the DoD deploys IT that some of its users virtually can't login to?
Appart from avalability, at least that's secure :)
Appart from avalability, at least that's secure :)
It's even worse when you consider the DoD at least have multiple functioning internal PKIs and issue smartcards in the form of the CAC and others to all its users.
I'm sorry, we don't want your fancy crypto, please accept this insecure SMS.
I'm sorry, we don't want your fancy crypto, please accept this insecure SMS.
To be fair, I guess it's a product of being an organization of three million people who are globally dispersed, working in every conceivable environment. There are a lot of edge cases. So while smart card login was better for my case, other people worked in situations where username / password and SMS authentication was a dream. At the same time, we want everything to be uniform and interchangeable, because we've seen that patchworks of incompatible solutions can be even worse.
You can use the voice call method of MFA on Teams, send it to a Twilio number, and use a Twilio Studio workflow to automatically pick up and press # a few seconds later to confirm.
(Yes, I've done this.)
(Yes, I've done this.)
I wish there was some credible government authority to clearly tell services they cannot offer SMS only 2FA, they cannot limit to “mobile phones only” (ie no Google voice), and they can’t restrict TOTP to one off proprietary tools like Authy. “Person is within USA with mobile phone plan” is hardly an authentication scheme.
And also that they must offer users the possibility of disabling SMS-based authentication if another scheme is enabled.
On Microsoft 365, if you setup "forced MFA" on your organisation, then they additionally force users to add a phone number which can be used for account recovery.
I get why Microsoft wants to keep account recovery possible in this manner, but I am not someone who needs it, and there needs to be a way for me to make my account more secure where my phone company can't take over my account...
On Microsoft 365, if you setup "forced MFA" on your organisation, then they additionally force users to add a phone number which can be used for account recovery.
I get why Microsoft wants to keep account recovery possible in this manner, but I am not someone who needs it, and there needs to be a way for me to make my account more secure where my phone company can't take over my account...
You can actually stop the MFA onboarding process when it asks for your phone number—just close the tab or window. You’ll still get TOTP or whatever else you already configured. It makes it sound as though you also need to add a phone number, but you don’t.
I just ran into this. My bank used to send codes over email, but for some reason a couple of months ago they decided SMS was the only option.
I said "So you're forcing people to have a phone with a plan?"
"Yes."
I said "So you're forcing people to have a phone with a plan?"
"Yes."
[deleted]
[deleted]
Phone companies should have banned SMS 2FA as an abusive use, or at least charged extra for senders. What it does is offloading KYC to mobile phone subscriber databases.
It is in all the parties’ best interest (too big to fail business, mobile network, and the government). No accountability, low cost, and the ability to finger point.
How does the TOTP secret get copied into Authy? Seems like you could just copy the data out of that and into an open source tool instead of Authy.
The TOTP URIs can be exported - I use this to export them into Bitwarden:
https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
You don't even need to move to Antarctica, just moving to a different country is enough to experience a lot of SMS pain. Many companies are hardcoded to only allow SMS to numbers in the same country code. Even if you work around this by bringing a SIM card along (meaning paying for a plan, keeping it topped up, etc), you can still run into issues if they're sending SMSes from an country-specific short code and you ever need to reply for any reason ("Is this transaction fraud? Reply Y/N in the next 10 minutes or we'll helpfully cancel your card!").
I've been lucky enough to have my phone number for the past decade and all of the services I use have already authenticated that number. When I moved to Europe earlier this year, I ported my number from BIG_NAME_CARRIER to Google Voice and so far everything has been fine.
That said, I'm still vigilant for alternative login options when I see them because I assume sooner than later, some company will audit all customer numbers on file and realize mine has changed from `mobile` to `voip` like mentioned in the article.
I think the only ones still tied to my number are a credit card and a neobank, but I could theoretically live without those.
That said, I'm still vigilant for alternative login options when I see them because I assume sooner than later, some company will audit all customer numbers on file and realize mine has changed from `mobile` to `voip` like mentioned in the article.
I think the only ones still tied to my number are a credit card and a neobank, but I could theoretically live without those.
I've been travelling for the last two years. With Wifi-calling, I can send/receive calls and text messages just fine. The only caveat is when I am outside of wifi I have to turn a hotspot from the other phone.
second this, dealing with it myself.
gave my number to bank to send me TOTPs, and then moved away literally dozens of thousand km away to find out that roaming is not enabled by default (had to buy a new sim card from new carrier), you have to visit office in-person, and on top of that, bank wouldn't send SMS to foreign numbers, so my card is good to cash out basically, forget the online payments
gave my number to bank to send me TOTPs, and then moved away literally dozens of thousand km away to find out that roaming is not enabled by default (had to buy a new sim card from new carrier), you have to visit office in-person, and on top of that, bank wouldn't send SMS to foreign numbers, so my card is good to cash out basically, forget the online payments
Yeah, I know someone with more money than technical savvy or patience who ended up fedexing their phone to family to get 2F codes.
I'm from a small and flat country and no matter where I've been there's always been reception, so I understand the assumption that some people might make that everyone is connected all the time.
But I've been traveling around in the UK and I know you shouldn't take reception for granted. In Malvern, Worcestershire there's no reception in some parts of the city, and in Wales I only have reception in the cities.
We had a situation last week where we were setting up a tool, and I couldn't proceed because they required 2FA through SMS, not a great first impression.
But I've been traveling around in the UK and I know you shouldn't take reception for granted. In Malvern, Worcestershire there's no reception in some parts of the city, and in Wales I only have reception in the cities.
We had a situation last week where we were setting up a tool, and I couldn't proceed because they required 2FA through SMS, not a great first impression.
2FA Mule is the proper name for his "phone in a drawer" method:
[1] https://kozubik.com/items/2famule/
[1] https://kozubik.com/items/2famule/
It’s generally expected that you have a cell phone, accessible at all times, which can receive SMS text message MFA codes.
This drives me crazy. I don't want my phone number to be a single point dependancy for such services.
This drives me crazy. I don't want my phone number to be a single point dependancy for such services.
I also don’t like giving my permanent, cross-app cross-company tracking identifier to those with whom I am doing business, allowing them to buy tons of additional data about me from data brokers (and selling my transaction data back).
Phone numbers are commonly used for this. I change mine monthly.
Phone numbers are commonly used for this. I change mine monthly.
Leaving the Android phone at home and forwarding SMS with IFTTT is an ingenious approach. A similar solution with an iPhone at home could be accomplished with text message forwarding enabled in iMessage: https://support.apple.com/en-us/HT208386
Yeah I wondered while reading. My text messages come to all my iDevices by default. Would that stop working with Antarctic internet?
I had a close call a couple of years ago when I had to travel unexpectedly and discovered that my phone provider’s new wholesaler relationship didn’t offer SMS roaming. Since I suddenly had to use a government app to get back into the country and the only MFA I believed they offered was text message, I had a little panic. Fortunately I got in with an email or something, but I quickly changed mobile providers for this reason.
It’s taken me until now to have a personal TOTP process robust enough to want to move my stuff across. When I get back from my current travels, it makes sense to try to move as much as I can to my new, synced, backed-up, personal authenticator solution.
It’s taken me until now to have a personal TOTP process robust enough to want to move my stuff across. When I get back from my current travels, it makes sense to try to move as much as I can to my new, synced, backed-up, personal authenticator solution.
As an additional option, if you use the Android/Google Messages app, you can link another device/laptop and any communications are bounced through Google's cloud, but End-to-End encrypted. I use this all the time from my tablet I take into the Data Center, and frequently leave my phone upstairs. Keeps support for RCS as well.
Additionally, you can also use Google Fi, which supports the same messages app, and syncing the messages and responses like Apple's iMessage, just by logging into your Google Account after a little setup. I believe it's also intercepted upstream, and isn't reliant on another device being powered on.
Disc: Googler, not on Messages.
Additionally, you can also use Google Fi, which supports the same messages app, and syncing the messages and responses like Apple's iMessage, just by logging into your Google Account after a little setup. I believe it's also intercepted upstream, and isn't reliant on another device being powered on.
Disc: Googler, not on Messages.
Yeah, Messages device pairing should work perfectly for this.
Google Fi boots you off the network if you're outside of the US for 3-ish months.
This has not been my experience - you cannot have data enabled outside the US for extended periods of time, but leaving SMS/voice enabled seems fine.
I wonder, does someone maintain a list of banks and credit unions that strive for modern security? It might affect my choice of banks.
https://2fa.directory/us/#banking
I got a TOTP card from Bank of America like 10 years ago. Ended up screwing me a bit when I lost it and then couldn't make changes to my account... I personally kinda hate 2FA now.
I got a TOTP card from Bank of America like 10 years ago. Ended up screwing me a bit when I lost it and then couldn't make changes to my account... I personally kinda hate 2FA now.
Only two banks on that list do not support SMS: Credit Suisse and Mercury (my employer). Banking is sad.
I think banks that do support SMS in addition to TOTP are also fine. Still, those are pretty rare as well.
Wondering if there's a similar list for European banks.
UPD: there's link to https://2fa.directory/int/#banking on the U.S. page
Wondering if there's a similar list for European banks.
UPD: there's link to https://2fa.directory/int/#banking on the U.S. page
If you qualify (you’re a vet or anybody in your immediate family is), navy federal is pretty friendly with both global access and multiple 2FA options including SMS to Google voice. Their primary customer base is armed forces who will login from abroad and not have access to normal SMS.
I have the same issue in Canada. The bank I was using dropped support for email 2FA and only supports SMS now. I look at the alternatives and they all only support SMS or a custom app. There are a few that don't support 2FA at all which I assume just means that they are slow and will push me into SMS 2FA in a few years.
I would love to switch to a bank that supported TOTP.
I would love to switch to a bank that supported TOTP.
This is trivial for Android phones running the Google Messages texting app. Go to https://messages.google.com, scan the QR code with the Messages app, and now all your text messages are accessible via the Messages Web site. Bank auth codes work fine (at least for my NZ banks).
Trivial except for the remotely sysadmining an Android phone part. That's doable, but requires some work.
For the more adventurous, you might be able to combine a Raspberry Pi with a USB 3G/4G Modem dongle or even a specialised Hat for it.
It should be a case of inserting the SIM card, and use AT commands over serial to send/receive SMS.
Combine it with a watchdog timer and a remote-controlled power-plug and you can even power it off/on again remotely if it crashes.
It should be a case of inserting the SIM card, and use AT commands over serial to send/receive SMS.
Combine it with a watchdog timer and a remote-controlled power-plug and you can even power it off/on again remotely if it crashes.
MikroTik LTE routers are another good candidate. Land a wireguard tunnel on one, log in, and read the sms that come in via syslog.
Much, much easier to deploy a 2FA Mule with the excellent "SMS Forwarder" app and a $8/mo tello plan:
https://kozubik.com/items/2famule/
https://kozubik.com/items/2famule/
The problem with using phones is that they're very much intended to have someone poke at them, and they're not intended to stay on charge 24x7.
I've got a work phone in front of me, all it's used for is getting 2FA prompts (SMS and Duo). Yet randomly I'll find it's rebooted for some update because the manufacturer has decided that I have to have it, and now I have to unlock it to launch Duo. I have disabled updates as much as I can, but it still gets some periodic updates.
I ran a bunch of Android tablets for a while, and their batteries swelled up over time because they sat on charge all the time.
Maybe if you can run a custom ROM to achieve some of this. But it's not an option for my 'work' phone, since the Manufacturer doesn't allow unlocking the boot rom.
My point is not all devices are equal, and I think if I was going somewhere remote I'd probably choose not to rely on a phone.
I've got a work phone in front of me, all it's used for is getting 2FA prompts (SMS and Duo). Yet randomly I'll find it's rebooted for some update because the manufacturer has decided that I have to have it, and now I have to unlock it to launch Duo. I have disabled updates as much as I can, but it still gets some periodic updates.
I ran a bunch of Android tablets for a while, and their batteries swelled up over time because they sat on charge all the time.
Maybe if you can run a custom ROM to achieve some of this. But it's not an option for my 'work' phone, since the Manufacturer doesn't allow unlocking the boot rom.
My point is not all devices are equal, and I think if I was going somewhere remote I'd probably choose not to rely on a phone.
I have two pixel 4 (seen in the photos there) and I have noticed two things:
> 1 year uptime with no crashes or reboots
Android (whatever version) informs me that it's not charging fully for blah blah battery reasons ... which is to say, it is in some way smartly conditioning its own battery.
I can't say any more about it since this isn't my area of expertise but at least with these pixel 4a devices, these issues aren't present.
> 1 year uptime with no crashes or reboots
Android (whatever version) informs me that it's not charging fully for blah blah battery reasons ... which is to say, it is in some way smartly conditioning its own battery.
I can't say any more about it since this isn't my area of expertise but at least with these pixel 4a devices, these issues aren't present.
Seems like they could have one of those mini femtocells that cellphone companies will send you if you have no reception at your place - these just plug into your home internet and then rebroadcast a 3G or 4G signal. I still have an older 3G one from Sprint I am keeping around (probably wont even work anymore).
One of these could temporarily be plugged in on request - they could have just a few of them (at whoever is head of IT) for different carriers just for this situation.
One of these could temporarily be plugged in on request - they could have just a few of them (at whoever is head of IT) for different carriers just for this situation.
I'm curious how much bandwidth these require. Antarctica has very, very little bandwidth.
Each simultaneous call costs you ~100Kbps. An SMS is 140 bytes, and limited by desired SMS throughput. I use a T-Mobile femtocell with a SpaceX Dishy, but VSAT (64 Kbps up to 8 Mbps) should be fine for SMS only.
https://explorersweb.com/starlink-in-antarctica/
McMurdo could run their own BTS and provide SMS access only to mobile phones if the desire and funding was available. This would give you a legit mobile network registration.
http://openbts.org/
https://www.theverge.com/2022/10/6/23389641/ukama-open-sourc...
https://explorersweb.com/starlink-in-antarctica/
McMurdo could run their own BTS and provide SMS access only to mobile phones if the desire and funding was available. This would give you a legit mobile network registration.
http://openbts.org/
https://www.theverge.com/2022/10/6/23389641/ukama-open-sourc...
I haven’t heard of femtocells and now wondering why we don’t use these instead of WiFi? In my experience LTE connections are much more reliable than WiFi - rarely having mobile data issues but WiFi won’t work in the next room.
Are femtocells just as crappy as WiFi?
Are femtocells just as crappy as WiFi?
In Dubai apartments are full of these things that you the phone company just shows up and plugs in; they connect to the building fibre rather than being linked to you personally or you personally paying for them https://www.reddit.com/r/dubai/comments/on8gdh/we_recently_m...
Why use femtocell over Wi-Fi? It costs same as normal mobile data usage (maybe it depends). It's generally slower than Wi-Fi because not much bandwidth is assigned for it. No LAN connectivity. Its routing isn't optimal for just internet access because it routes home-ISP-internet-mobileISP-internet, instead of home-ISP-internet.
They're slow and use licensed bands
I have one of those. It requires a GPS signal to work, and instantly stops working if it isn't at your registered home address, which I assume cannot be Antarctica.
Just want to say, this is a God-tier URL
If anyone is interested, you can use Traccar to use an Android phone as an HTTP SMS API gateway.
https://github.com/traccar/traccar-sms-gateway
https://news.ycombinator.com/item?id=28125074
I use a phone in a drawer for MFA codes and use this to access the OTPs remotely, with some minor PHP scripting for a simple web-accessible front-end.
https://github.com/traccar/traccar-sms-gateway
https://news.ycombinator.com/item?id=28125074
I use a phone in a drawer for MFA codes and use this to access the OTPs remotely, with some minor PHP scripting for a simple web-accessible front-end.
Another app does just incoming SMS to URL: https://f-droid.org/en/packages/tech.bogomolov.incomingsmsga...
Very cool!
I also have a phone number solely for MFAs, and phone is in drawer at home. Battery is good for weeks, so not plugged in. Every incoming SMS, an app forwards it to a Google Apps Script, and GAS pings my telegram bot, which sends it my all devices with telegram installed.
What phone capable of running apps has a battery that lasts for weeks? Old feature phone with a custom (?) Java applet or something?
If you want your phone that is capable of running apps to last for weeks on battery, the big trick is to make sure it doesn't actually run apps for the most part. The second part is to make sure it has good reception. Also, disable any radios you don't need, etc.
If you took a random Android, put in a sim, uninstalled or disabled as many apps as possible, and left it screen off where it had a good view of local towers, you'd have pretty good battery life. It wouldn't be very exciting... but if it just needs to sit in a drawer (hopefully not a metal drawer, see reception issue) and forward a couple sms a week, it'd probably make it through at least one week.
If you go for a model that has a higher capacity battery as a feature, that'll help too.
If you took a random Android, put in a sim, uninstalled or disabled as many apps as possible, and left it screen off where it had a good view of local towers, you'd have pretty good battery life. It wouldn't be very exciting... but if it just needs to sit in a drawer (hopefully not a metal drawer, see reception issue) and forward a couple sms a week, it'd probably make it through at least one week.
If you go for a model that has a higher capacity battery as a feature, that'll help too.
My work iPhone 11 will run for a week in low-power mode - the battery is pretty large without the screen on with a bunch of apps keeping the CPU and cellular radio warm. I use mine mostly for MFA messages & Exchange when away from my desk and that’s a lot more power-efficient than I thought.
Yeah, I thought about low power mode but at least on my Samsung phone that kills basically all of the background apps/services, which would include any forwarding service. Or well, you can choose to allow background stuff but that's where the battery savings really kick in. I guess I haven't actually tried it with zero direct usage of the screen or phone, maybe it could last that long...
Its Huawei Honor Nova 5T, about 2 years old, with location and data off, network on, wifi on, and no extra apps except stock & that one sms forwarding app. I believe Android 10 or newer.
Why not just keep the phone plugged in?
Its at my home, I go there every day. I usually see it when battery is around 10%. Its USB C, so charges pretty quickly like in minutes. I can use the same charger I use for my regular phone.
While that makes sense, it doesn’t really answer why you don’t leave it plugged in.
Fire hazard, worse for battery, taking up a charging plug, etc
Very interesting! Do you have a blog or anything written for your setup?
I wonder why OP hasn’t mentioned CAP schemes [1], which I’m sure has to exist in the US, too?
For example, I’m using a domestic CAP-like system (dubbed Secoder in Germany) for several of my bank accounts. It exploits the fact that your ATM card is a trusted computer with a built-in digital signature/HMAC feature.
You have to spend 20 € for a small battery-powered device, which features a card reader, a display, a PIN pad and a camera. (There’s also a USB-based variant without batteries and camera.)
On each online transaction, you insert your card and point the camera at the QR-encoded challenge on your computer screen. The display then asks you to confirm recipient and amount, and if you do, it sends the whole thing to the ATM card, which then shows you the 2FA code based on HMAC.
CAP seems to have become a niche thing as everyone is preferring apps nowadays, and those are much cheaper to maintain. I still think the CAP system is superior to apps, because it’s offline, carrier-independent and easy to use.
[1]: https://en.wikipedia.org/wiki/Chip_Authentication_Program
For example, I’m using a domestic CAP-like system (dubbed Secoder in Germany) for several of my bank accounts. It exploits the fact that your ATM card is a trusted computer with a built-in digital signature/HMAC feature.
You have to spend 20 € for a small battery-powered device, which features a card reader, a display, a PIN pad and a camera. (There’s also a USB-based variant without batteries and camera.)
On each online transaction, you insert your card and point the camera at the QR-encoded challenge on your computer screen. The display then asks you to confirm recipient and amount, and if you do, it sends the whole thing to the ATM card, which then shows you the 2FA code based on HMAC.
CAP seems to have become a niche thing as everyone is preferring apps nowadays, and those are much cheaper to maintain. I still think the CAP system is superior to apps, because it’s offline, carrier-independent and easy to use.
[1]: https://en.wikipedia.org/wiki/Chip_Authentication_Program
> which I’m sure has to exist in the US, too?
Considering that they haven't deployed chip cards until mid-2010s it's unlikely that this even exists (and indeed this was not available on any US banks).
Considering that they haven't deployed chip cards until mid-2010s it's unlikely that this even exists (and indeed this was not available on any US banks).
The main problem that OP is experiencing is that the services that they need to access only support SMS 2FA. Talking about a different unsupported scheme doesn't seem relevant.
Good point. One might argue though that you could switch to a competing bank which does support that scheme.
This may work for some services but there is going to be at least a few that are hard to replace and only support SMS.
At least in my experience trying to find a Canadian bank with reasonable 2FA they were all either SMS or a custom app. So I just sucked it up and stuck with my current one because there was no choice.
At least in my experience trying to find a Canadian bank with reasonable 2FA they were all either SMS or a custom app. So I just sucked it up and stuck with my current one because there was no choice.
>camera
What is it used for?
What is it used for?
It’s used for scanning the QR code displayed on the computer (or phone).
The QR code contains:
- the monetary amount,
- parts of the recipient’s account number (both helps thwart MITM attacks)
- and a random challenge (which helps prevent replay attacks.)
That’s for the wireless model. Wired CAP devices don’t have a camera since they can use USB.
The QR code contains:
- the monetary amount,
- parts of the recipient’s account number (both helps thwart MITM attacks)
- and a random challenge (which helps prevent replay attacks.)
That’s for the wireless model. Wired CAP devices don’t have a camera since they can use USB.
Leaving your phone charged for extended amount of time like this is really bad though. The battery will swell (fire hazzard), it's just a matter of time when. Sometimes you're lucky and it took a year or more for the battery to swell, sometimes it swells just after a few month. The compromise is probably put the phone in a fireproof surface instead of a drawer.
Don't modern battery charge control chips take care of this automatically?
I mean, many laptops spend 99% of their time on plugged in/docked, and that doesn't cause any battery problems.
I mean, many laptops spend 99% of their time on plugged in/docked, and that doesn't cause any battery problems.
Just plug the phone charger in a power outlet timer that turns on the power just 2 hours per day. That would simulate normal daily phone charging.
This is a great idea. Can even automate it using home assistant for precise control if you're using android. Home assistant's android client reports battery life to your home assistant instance, so you can write an automation that switched on a smart switch connected to charger when the phone's battery <50% and turn off when it's >95% (or other values optimized for battery longevity.
Why aren't charger IC's smart enough by now to avoid this? (eg. let it drain a ways before topping off again).
I have a 5 year old Sony Xperia ZX which has had "battery care" enabled (possibly by default) since I bought it.
It charges the battery to something like 85% until shortly before my alarm is set, or the expected time I'll unplug it if no alarm is set. There isn't a way to manually control this, beyond changing the alarm time.
However, the battery is still going strong after 5 years.
(I wish they'd make a decent compact successor. The latest "Compact" Xperia phone seems to be 2.5cm taller! https://www.gsmarena.com/sony_xperia_5_iv-11838.php 15.6cm vs 13cm)
It charges the battery to something like 85% until shortly before my alarm is set, or the expected time I'll unplug it if no alarm is set. There isn't a way to manually control this, beyond changing the alarm time.
However, the battery is still going strong after 5 years.
(I wish they'd make a decent compact successor. The latest "Compact" Xperia phone seems to be 2.5cm taller! https://www.gsmarena.com/sony_xperia_5_iv-11838.php 15.6cm vs 13cm)
Does iPhone’s optimized battery charging help?
Not sure. I actually had an iphone with battery so swollen, the screen got popped out of the frame by itself. Maybe newer iphones is better at this stuff, but why risk your house burning down when you can take some precaution regardless the type of phone you use.
Modern phones have an option to stop charging at 85%, which mitigates some of the issue as well as extending the battery lifetime. The main thing is the battery needs to go through charge cycles, sitting is death.
Wait, what? Aren't batteries and chargers smart nowadays? I thought they automatically care about battery health no matter what the user does (apart from deep discharging of course)!
I have an AT&T number ported to Google Voice. There isn't any service out there that thinks it's a VOIP number.
"I have an AT&T number ported to Google Voice. There isn't any service out there that thinks it's a VOIP number."
This 'lookup' script that I wrote will properly identify your number as being owned by google voice:
I'm glad it continues to work for you because it should and you should be able to use a gvoice number in this fashion but ... you've just gotten lucky so far.
This 'lookup' script that I wrote will properly identify your number as being owned by google voice:
/usr/local/bin/curl -s -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name" -u $accountsid:$authtoken | /usr/local/bin/jq '.'
I'm glad it continues to work for you because it should and you should be able to use a gvoice number in this fashion but ... you've just gotten lucky so far.
I am appalled by this. Thanks for sharing. I clearly am lucky!
Not sure what bank you use, a few banks immediately unenroll your phone number when you switched carrier, most likely as a protection mechanism against SIM swap.
Below is one of the emails I got from Chase:
``` Dear Customer,
Our records indicate that you may have recently changed your mobile service provider or mobile phone number. As a result, Chase services that use this mobile number (such as text banking, text alerts, Chase QuickPaySM etc.) may have been disabled.
```
Below is one of the emails I got from Chase:
``` Dear Customer,
Our records indicate that you may have recently changed your mobile service provider or mobile phone number. As a result, Chase services that use this mobile number (such as text banking, text alerts, Chase QuickPaySM etc.) may have been disabled.
```
I ported a Verizon number to Google Voice ten years ago and I've used it as my primary phone number ever since, forwarding to my MVNO carrier number. I'd say it works fine with 95% of services, but I have run into some issues. I remember Uber being one service that rejected it. I stopped using Uber when I got a new SIM card for a new carrier, and I had trouble recovering my account which had to be tied to my old carrier number.
copenseethe(1)
You can send and receive SMS using Wifi only (VoWIFI) which most carriers support even the cheapest MVNOs. It's usually referred to as "WiFi Calling"
Again, you DO NOT need a cell phone tower to send and receive SMS and phone calls. You can register your phone on its home network near a tower and go WiFi-only forever after.
Again, you DO NOT need a cell phone tower to send and receive SMS and phone calls. You can register your phone on its home network near a tower and go WiFi-only forever after.
OP appears to have attempted it.
“ One issue is that the protocol for wifi calling is notoriously opaque. Carriers frequently change the underlying infrastructure and protocol details.
Also, the protocol assumes terrestrial broadband with reasonable latency and bandwidth. At McMurdo, as of this writing, latency to terrestrial locations is in excess of 700 milliseconds. Usable bandwidth for any given end user can vary widely, down to a few dozen kilobits per second.
The protocol also doesn’t expose any useful diagnostic info to the end user in order to troubleshoot. You just have to cross your fingers that the magic “wifi calling” icon lights up.”
“ One issue is that the protocol for wifi calling is notoriously opaque. Carriers frequently change the underlying infrastructure and protocol details.
Also, the protocol assumes terrestrial broadband with reasonable latency and bandwidth. At McMurdo, as of this writing, latency to terrestrial locations is in excess of 700 milliseconds. Usable bandwidth for any given end user can vary widely, down to a few dozen kilobits per second.
The protocol also doesn’t expose any useful diagnostic info to the end user in order to troubleshoot. You just have to cross your fingers that the magic “wifi calling” icon lights up.”
"You can register your phone on its home network near a tower and go WiFi-only forever after."
This is how it works on paper. You may have had success with this.
It does not work universally. It won't take long to find a bank / FAANG / service provider that refuses to accept anything but a bona fide mobile SIM talking to a base station.
This is how it works on paper. You may have had success with this.
It does not work universally. It won't take long to find a bank / FAANG / service provider that refuses to accept anything but a bona fide mobile SIM talking to a base station.
> It does not work universally. It won't take long to find a bank / FAANG / service provider that refuses to accept anything but a bona fide mobile SIM talking to a base station.
How does a SMS sender know this? Is there some mechanism in SMS to only deliver if by certain criteria?
How does a SMS sender know this? Is there some mechanism in SMS to only deliver if by certain criteria?
copenseethe(2)
Doesn't even need to be as far as Antartica.
I recently went on an international trip where I turned off my regular cell plan and used a local SIM card. Was surprised at the amount of services I couldn't log into because I was avoiding connecting my regular number due to the high international rate.
I recently went on an international trip where I turned off my regular cell plan and used a local SIM card. Was surprised at the amount of services I couldn't log into because I was avoiding connecting my regular number due to the high international rate.
> the amount of services I couldn't log into because I was avoiding connecting my regular number due to the high international rate
Receiving international SMS while roaming is typically[1] free - just make sure to turn off data roaming and avoid using that SIM to make phone calls.
1. It should in theory always be free on every carrier, but I wouldn’t put it past some MVNOs to charge for it.
Receiving international SMS while roaming is typically[1] free - just make sure to turn off data roaming and avoid using that SIM to make phone calls.
1. It should in theory always be free on every carrier, but I wouldn’t put it past some MVNOs to charge for it.
The inconvenience is having to swap SIM cards every time. How does this work for phones with eSIM? Can you be in multiple phone networks at once?
> How does this work for phones with eSIM? Can you be in multiple phone networks at once?
Yes, you can, and it’s much easier with eSIMs because they can be just be turned on and off through your phone settings as needed.
In this scenario you’re obviously trading redundancy for convenience - if you break your phone, you can’t just pull the eSIM out and pop it into another device. I keep a copy of my eSIM QR codes in 1password, but of course there are risks there too.
Yes, you can, and it’s much easier with eSIMs because they can be just be turned on and off through your phone settings as needed.
In this scenario you’re obviously trading redundancy for convenience - if you break your phone, you can’t just pull the eSIM out and pop it into another device. I keep a copy of my eSIM QR codes in 1password, but of course there are risks there too.
Dual SIM handsets are widely available. You can even configure your phone to use data on one sim and voice on the other, and to use VoWiFi with one sim over the data plan for the other. It's wild.
Pretty good solution. I’ve seen online services that will “virtualise” a phone and give you access to it in the cloud. Pretty sure it’s just a cheap android on a rack.
I’ve thought about using one a few times, when going travelling overseas for extended trips.
I’ve thought about using one a few times, when going travelling overseas for extended trips.
Sorry if I'm a security noob but I have a genuine question.
Why at the beginning I need to use 2FA if I can remember secure enough passwords (or use password managers) and I'll not stupid enough to give the passwords away easily?
"Sorry if I'm a security noob but I have a genuine question. Why at the beginning I need to use 2FA if I can remember secure enough passwords (or use password managers) and I'll not stupid enough to give the passwords away easily?"
Glad you asked ...
... and your comments children are not just wrong, but completely misunderstand the ecosystem they are discussing.
Mobile telephone 2FA is not for you. It's not to help you - it's not for your security. All of that is bullshit - and demonstrably so[1][2].
What is actually happening is that FAANGs, etc., have a brutal, unrelenting spam/scam problem which they have no idea how to solve.
Forcing every user to burn a phone number tied to a physical SIM card is their last-ditch attempt to throw enough sand in the gears and stay above water.
It sort of works.
It's very painful for end users, introduces all kinds of strange inconveniences and probably doesn't stop determined abusers ... but it seems to work better than anything else they've come up with thus far.
But make no mistake: It's not for you. It is not for your security or safety.
[1] Post-signup challenge to user - help us prove your identity by entering in a phone number you've never shown us before.
[2] Interestingly, very high value logins like brokerage and banking typically allow other forms of 2FA that don't involve burning a mobile number because those firms already have many other routes of identification and verification.
Glad you asked ...
... and your comments children are not just wrong, but completely misunderstand the ecosystem they are discussing.
Mobile telephone 2FA is not for you. It's not to help you - it's not for your security. All of that is bullshit - and demonstrably so[1][2].
What is actually happening is that FAANGs, etc., have a brutal, unrelenting spam/scam problem which they have no idea how to solve.
Forcing every user to burn a phone number tied to a physical SIM card is their last-ditch attempt to throw enough sand in the gears and stay above water.
It sort of works.
It's very painful for end users, introduces all kinds of strange inconveniences and probably doesn't stop determined abusers ... but it seems to work better than anything else they've come up with thus far.
But make no mistake: It's not for you. It is not for your security or safety.
[1] Post-signup challenge to user - help us prove your identity by entering in a phone number you've never shown us before.
[2] Interestingly, very high value logins like brokerage and banking typically allow other forms of 2FA that don't involve burning a mobile number because those firms already have many other routes of identification and verification.
In this case 2FA is useful if someone sniffs your password (key logger) and uses it later to try and fail to log in without your presence. Many wireless keyboards don't use encrypted comms. Keyboards can be bugged easily. There is tech to observe to thermals of keys after they are pressed from a distance. And listen to key strokes. Or capture wirelessly transmitted keystrokes with a parabolic dish pointed at you from across the street if you are far away and an SDR or ASIC. Or a compact omni antenna in a backpack sitting next to you if you are in a public area. The possibilities are endless!
I see, maybe it serves as kind of defense in depth.
I'll be surprised about most Bluetooth keyboards don't use encryption.
And I feel like it's too panorid for me to worry about someone probing to your keyboard with an USRP or a HT-301.
I'll be surprised about most Bluetooth keyboards don't use encryption.
And I feel like it's too panorid for me to worry about someone probing to your keyboard with an USRP or a HT-301.
CVE-2019-13054
CVE-2019-13055
CVE-2018-8117
CVE-2010-1184
CVE-2019-13055
CVE-2018-8117
CVE-2010-1184
These are all CVEs of security issues in the proprietary firmware of wireless input devices, that lead to either eavesdropping or input injection or both.
> I'll not stupid enough to give the passwords away easily?
Don't underestimate a determined adversary. Secondly, look for single points of failure and eliminate them as best you can. If someone gains access to your email, could they perform password resets?
Don't underestimate a determined adversary. Secondly, look for single points of failure and eliminate them as best you can. If someone gains access to your email, could they perform password resets?
> stupid
Phishing victims are not categorically stupid.
Phishing victims are not categorically stupid.
This is a situation in which self-regulation does obviously not work, and we are in dire need of legislation.
2FA schemes must always support TOTP.
Potentially, as an alternative, 2FA must not rely on SMS, as it is not secure.
2FA schemes must always support TOTP.
Potentially, as an alternative, 2FA must not rely on SMS, as it is not secure.
Probably quite costly for the device, but would a Iridium phone number work?
Such [1] a device should (not tested ;) have connectivity, even in Antarctica.
I don't know of course if the same filtering for MFA-SMS applies if the number has a +8816 or +8817 prefix.
[1] https://www.garmin.com/en-US/p/765374 (inReach Mini 2)
[1] https://www.garmin.com/en-US/p/765374 (inReach Mini 2)
the phone in a drawer solution works basically by default on apple devices. Very common solution in outback Australia (satellite internet only, no phone coverage)
Just thinking aloud here - would you need to disable all automated updates on iOS before doing this, lest the device do a reboot for a system security update, and end up on the lock screen?
There's probably some interesting failure modes when trying to get a modern device to stay connected for months on end, without deciding to reboot for a security patch or similar, or taking an automated app update.
There's probably some interesting failure modes when trying to get a modern device to stay connected for months on end, without deciding to reboot for a security patch or similar, or taking an automated app update.
I always have to enter the password to start an install. I’m not sure if there’s a failsafe after some period of time since I usually install day-of but I usually wake up to some nag saying it couldn’t be installed overnight because I didn’t authenticate, and all of my devices are set to install automatically.
I suspect it doesn't matter. if the phone is powered and on, it's still doing the iCloud stuff in the background, even if it's locked.
Note that there is a difference between regular "locked" and the "locked" after a reboot. For the later most of the disk is still encrypted so very little data and few services are operational. You can likely recieve text messages but I doubt much of iCloud syncing works.
So with forwarding on, if you receive a garden variety SMS (green in iMessage) it will forward on as a normal (blue) iMessage over IP to other iOS devices on the same account?
yes. it comes up green, but is delivered to all other same account iCloud devices. you can reply too, and it works it out. I send and receive SMSs via my MacBook and iPad.
same here, but not about MFA, to complete transaction using one of Indonesian payment gateway only allowed within 1 minute XD slow phone opening OVO app + slow internet would sometimes failed, receiving push notification, loading app took 40s total hopefully entering pin and submitting within 20s
even other payment gateway have 5 minutes at least
even other payment gateway have 5 minutes at least
I'm currently using a Twilio trial U.S. number to receive SMS from a certain bank. Redirected them to a Matrix.org channel using one of those nocode services (although writing a script for it would be trivial, too). I'm travelling a lot so having free slot for a local SIM is a major benefit :^)
I strongly suggest not using TOTP, HOTP or similar MFA solutions based on a shared secret if security is important. It is basically the same as storing your password both at your provider and in your phone in cleartext. With SMS you have at least the possibility to do auditing when a token is generated.
The problem with SMS is that it is allegedly trivial to convince a telco to port someone else's number to the new burner SIM you just bought. That seems slightly worse than shared secrets to me.
SIM swap attack is really baffling to me. Over here, even if someone gained access to your account and initiated porting, you still need to go the store and present your ID to complete it.
Social engineering is really powerful, since the people you are engineering usually have elevated access privileges. In the ID scenario, presumably there are fake ID providers one could use, although with facial recognition in common use, maybe that scenario becomes harder.
It's a second factor anyways. If the provider is fully compromised it doesn't matter much if the attacker can get the secret. If the secret leaks the password is hopefully hashed so attackers still can't get in.
I'd much rather have a reliable method of 2FA that works offline, on all of my devices and can only be hijacked from me or the service than use one that requires my phone to be nearby, working and having service and can also be hijacked by my phone company.
I'd much rather have a reliable method of 2FA that works offline, on all of my devices and can only be hijacked from me or the service than use one that requires my phone to be nearby, working and having service and can also be hijacked by my phone company.
I don’t understand the need for a separate phone. Couldn’t you just have a family member install IFTT and receive SMS codes? IFTT could be setup to forward the codes to a separate gmail account that isn’t used for anything else but for you to access these codes.
If the family member uses the same services as you this won't work without a second SIM and multi-SIM devices are rare in the US. (Getting better with eSIM though)
[deleted]
MFA futility, in its final form, is trying to log in to services on a submarine. On the bright side, you at least get the benefit of knowing immediately that the situation is completely hopeless.
Hopefully one day WebAuthn (or TLS client certs) will replace SMS auth.
I wonder if this would make a good SMS mule
https://www.gl-inet.com/products/gl-xe300/
https://www.gl-inet.com/products/gl-xe300/
MikroTik LTE devices can syslog any sms received. So you could then just go read the log off the device.
Pushbullet SMS forwarding is another phone in the drawer solution. I think they also offer end-to-end encrypted SMS forwarding. Of course highly dependent on Pushbullet infrastructure.
Just use Google Fi (cheapest $20 plan with no data) and the website for SMS (and calls). I ported my at&t number there and i am living abroad currently
T-Mobile Digits also blocks MFA for security
[deleted]
You could probably use Twillo to make this work. It would require some coding to forward the SMS to email or post it to a website someplace where you could read it. I have done this in the past (outside of Antarctica) for 2fa that requires a certain DTMF tone be pressed and I only had an old Western Electric Model 500 phone at the time. Twillo worked great for that, but it's been years since I last did it.
https://www.twilio.com/docs/glossary/what-is-dtmf
https://www.twilio.com/code-exchange/forward-sms-email
The downside to doing what I did is it basically removes 2fa. You are back to a single factor as the 2fa is now automated and that may not be appropriate for many use cases.
https://www.twilio.com/docs/glossary/what-is-dtmf
https://www.twilio.com/code-exchange/forward-sms-email
The downside to doing what I did is it basically removes 2fa. You are back to a single factor as the 2fa is now automated and that may not be appropriate for many use cases.
Won't work. Twilio is one of the many VOIP companies that are blacklisted by banks.
For a while, I had to enter a password and then get an SMS authentication code once every 24 hours to login to Teams. The problem is that cleared spaces don't allow any personal devices (there's no cellular service anyway with TEMPEST hardening) and the unclassified (NIPRNet) workstations are usually blocked from connecting to websites like Google Voice and some commercial webmail services. The authentication code would timeout after five minutes, and that didn't always leave enough time to exit building, get to my phone with cellular service somewhere, and then re-enter the building and return to my workstation with the authentication code. If you always worked at the same desk, you could set it up to make a voice call to that desk phone number for authentication, but I didn't always work at the same desk.
My own solution was to use my personal Google Voice number for the authentication code, have Google Voice forward those messages to my personal Gmail inbox, and then have Gmail forward those emails to my official DoD email inbox. (Our official email wasn't yet on O365 and only required our smart cards to login, which later became the method for O365 login, thankfully.)