Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by thaumasiotes on Saturday May 06, 2017 @10:44PM (#14283568)

> “something you know" can be told to someone else, which isn't true of TOTP. It's also always valid and reusable whereas the one-time code is closer to an on-demand verification

This is not correct. When I set up TOTP 2FA, the site generates a seed and tells it to me. It is always valid and always reusable, and it's no more difficult for me to communicate it to anyone else than it was for the site to communicate it to me.

[ Parent | on HN ]

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by virgilp on Friday May 12, 2017 @04:45AM (#14322348)

Well, technically, everything that you have (and can provide as "proof") is susceptible to being interpreted as "something you know". If I know enough about that thing that you have, I can probably manufacture a good-enough replica that I can provide as "proof of ownership".

Think of the physical one-time tokens: If I know the data stored on it, I can replicate them too. So, are they "something you have", or "something you know"? The reason why they're "something you have" is that it's easier to have the physical ownership of the device, than to know they "secret" of the device. But, the same is true about Google Authenticator! In that respect, Google Authenticator can be, indeed, interpreted as "something you have".

[ Parent | on HN ]

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by acdha on Sunday May 07, 2017 @10:16AM (#14285560)

Again, think of what that means in normal usage: it's technically possible but there's no UI to do it and in cases like iOS the system actively blocks it.

If you're building a consumer service, that's a big improvement over someone picking their dog's name and saving it in a Word doc on their desktop.

[ Parent | on HN ]