r/AskTechnology • u/random20190826 • 1d ago
Why is it that websites (Gmail, Hotmail, Amazon) hate it when you deliberately choose to exclusively use TOTP authenticators and remove your phone number?
I have a Hotmail account, a Gmail account and an Amazon account. Years ago, I managed to remove my phone number from the first 2 and added an authenticator app for 2FA. When I bought Yubikeys (from Amazon), I added them to my Gmail, Hotmail and Amazon accounts, as well as other services (like MongoDB, Github). However, I was having difficulty removing my phone number from Aamzon, until I read a Reddit post that I can remove the phone number once I disable 2-step verification. I did that, removed the phone number, and re-enabled 2-step verification. I am able to confirm that the authenticator app is the only way to access my Amazon account from any device not already logged in.
Here is the thing, I know full well that phone number based authentication is subject to SIM swapping. I know this because I successfully perpetrated an act of SIM swapping years ago against my "sister" (in quotes, because the phone was really used by me, but the cellular account was under her name). Time based authentication is safe as long as there isn't a keylogger or other malware on your computer and you don't share the QR code/alphanumeric seed with anyone. Plus, the seed can be shared amongst devices you own, making it trivial to backup.
The thing is, Google, Microsoft and Amazon keep warning me that it is not safe or that the account is not recoverable if I lose the TOTP. But I have the codes on both my phone and my computer, which is impossible with SMS (You can't possibly set anything up where 2 phones would ring at the same time when a call is placed to a single number, right?). Why would tech companies write misinformation like this? I mean, it is obviously not true. Adding a phone number neither increases account safety, nor does it make things easier to back up/recover. I am 2/3 finished with a college diploma in computer programming and have learned about things like OAuth (a standard that can be implemented in frameworks like Next.js via something called "next-auth").
2
u/Way2trivial 1d ago
(You can't possibly set anything up where 2 phones would ring at the same time when a call is placed to a single number, right?)
Sarcasm? right?
1
u/random20190826 1d ago
No. It’s not. I know of call forwarding, but that results in calls being redirected to another number. The original number doesn’t ring.
By extension, are you claiming that it is possible for text messages to appear on multiple devices even if they are sent to only one number?
2
u/mjmcfall88 1d ago
I don't know about texts, but I have a Google voice number that rings mine and my wife's phone at the same time
1
u/random20190826 1d ago
Google Voice is only available in the United States. I am on the other side of the border in Canada.
2
u/Way2trivial 1d ago
yes in fact.. that can be arranged. Simultaneous texting to more than one phone number/
1
u/Way2trivial 1d ago
1
u/random20190826 1d ago
Oh, I didn’t know that these services exist. Thank you for letting me know.
1
u/NekkidWire 18h ago
Also you have some premium watches that are NOT bluetooth but use SIM/eSIM, that will ring together with their master phone. From Apple and other manufacturers.
Not to be confused with kids' watches (cheap garbage with 2G and GPS alerts).
1
u/VeiledShift 1d ago
(You can't possibly set anything up where 2 phones would ring at the same time when a call is placed to a single number, right?)
I know it's not relevant here, but did every millenial and up who read this part get immediate flashbacks of EVERY PHONE IN YOUR HOUSE ringing anytime anybody calls your parent's landline?
2
u/AardvarkIll6079 1d ago
Calls can absolutely ring on multiple phones. I had a phone number that rang on 4 different phones.
1
u/random20190826 1d ago
Is that a traditional cellphone with either a physical SIM card or eSIM, as opposed to a VOIP phone?
2
u/dkopgerpgdolfg 1d ago
Even better, a decades old landline connection can do this by default.
But yes, it works with normal cell phones too, if the operator supports it.
2
u/werdnum 1d ago
These big tech companies are not stupid and they have big sophisticated security teams with a lot more experience than "I have heard of OAuth" (which isn't really relevant here by the way, least of all its integration with NextJS), so you should wonder what they know that you don't.
The most likely explanation (as somebody who works in big tech but not on any of these products) is that security best practice is contextual. Probably some combination of the following (I don't know that all of these are true but they're at least plausible)
- not every user is as sophisticated as you.
- even if you're theoretically right, the reality is that they find that for typical users, removing phone based OTPs is associated with a disproportionate number of support calls related to account lockouts that they don't want to deal with.
- you might back up and sync your TOTPs across many devices but most users don't and they tend to lose them when they get a new phone.
- Sim swapping is not a super common attack vector unless you're a fairly high value target, and it's more than enough to deal with the most common attacks (low effort password reuse or guessing)
- the companies are operating under other constraints you don't know about.
Doing security for billions of users with a huge range of hardware and technical expertise is very different from one computer science student.
1
u/charleswj 22h ago
As someone else who works in big tech for a company that secures hundreds of millions of personal and business users accounts, this is 100% correct. Microsoft has even released research on the safety of just SMS MFA over password only, and it stopped something like 99%+ of all password-related attacks.
People tend to think they're way more important than they are and that sim swapping is way easier than it is in practice.
1
u/random20190826 21h ago
The problem is not about importance. For 99.999999% of SIM swappers, they do it to steal money. It is the same reason why people would use stolen credit cards to buy things online.
I keep talking about it because I know that SIM swapping is easy because I managed to do it, as I described in the OP.
1
u/charleswj 21h ago
The money is the importance here. Important means "target who is desirable enough to attack".
It is not easy in the way you describe. It takes significant effort compared to other attacks. It requires significant knowledge about the target. It requires significant time and often significant luck. It also tends to create significantly more exposure for the attacker that creates the need for even more time and effort to mitigate.
Since you say you did it, explain the specifics of your methods. What knowledge did you require, how did you acquire it, how long did it take, and what effort was expended?
1
u/random20190826 21h ago
I did it because the target is my own sister. I live with her and I know her legal name, date of birth l, address (obviously), and I control the phone in which the text verification code is sent to, as I own that phone. So, she is already compromised because she is family.
As for money, I live in Canada, which means the primary means for stealing money from online banking profiles is unauthorized Interac e-transfers. Most people have limits of anywhere from $2000 to $10000 every 24 hours. This means a thief doesn’t get very far regardless of how rich a victim is, because if you try stealing $20000 from a chequing account with $100000 in it, that will take more than 24 hours, enough time for a victim to discover that their cell service stopped. I can imagine that most people have at least a few thousand dollars in their bank accounts. This means practically anyone can be targets, from 20-year-olds to 100-year-olds, from computer illiterate people to software developers, from low income people with $1000 in the bank to millionaires, etc…
1
u/charleswj 21h ago
I did it because the target is my own sister. I live with her and I know her legal name, date of birth l, address (obviously), and I control the phone in which the text verification code is sent to, as I own that phone. So, she is already compromised because she is family.
You're essentially saying "a person can sim swap themselves (obviously), anyone who consents (obviously), or anyone who already has a very high level of trust in you", which is exactly my point. And in the third case, it's highly likely that a person who could do that could steal your totp codes or attack your finances or personal situation in other, likely more catastrophic, ways.
I wouldn't do it, but as an example: my wife has a best friend. We go to her house often. We'd be trusted there alone. I could rummage through her personal papers and find all the information (that I don't already know) required to steal her entire identity. I could add keystroke loggers to her computer. Hidden cameras pointing at her screen and kb. The list goes on.
The point is it takes effort and/or closeness, and if you can do either, you can probably get around totp anyway.
As for money, I live in Canada, which means the primary means for stealing money from online banking profiles is unauthorized Interac e-transfers. Most people have limits of anywhere from $2000 to $10000 every 24 hours. This means a thief doesn’t get very far regardless of how rich a victim is, because if you try stealing $20000 from a chequing account with $100000 in it, that will take more than 24 hours, enough time for a victim to discover that their cell service stopped. I can imagine that most people have at least a few thousand dollars in their bank accounts. This means practically anyone can be targets, from 20-year-olds to 100-year-olds, from computer illiterate people to software developers, from low income people with $1000 in the bank to millionaires, etc…
You think people are getting sim swapped by strangers for $1k?
1
u/drplokta 1d ago
If the codes are on both your phone and your computer then you’re probably using an Internet service of some kind that keeps them in sync. What’s your recovery strategy if that service has a meltdown and corrupts all copies of them?
1
u/random20190826 23h ago
I am actually not using any Internet service to keep them in sync. When I set up the codes, I set them up on my phone and computer at the same time. On my iPhone, it is Google Authenticator logged out. On my computer, it is KeePassXC. They are different programs using the same open standard. Again, I know the biggest vulnerability is malware on my computer sniffing out the seed code more than anything. I never store Authenticator codes online because I know about these dangers.
In the event that both my computer and phone get destroyed, it probably means my house is destroyed, which possibly means I am dead. Even if I am still alive, losing Authenticator codes is the least of my problems if I am homeless in a country where the temperature dips well below freezing in the winter and soars above human body temperature during the summer.
1
u/charleswj 21h ago
What percent of people who setup totp do you think take any precautions whatsoever to ensure recoverability?
For that matter, why do you think the likelihood that someone will sim swap you is greater than the likelihood that something happens to both codes? But suggesting that the only scenario where you lose access to your codes is one where you're dead or soon to be due to exposure to the elements seems intentionally crafted to make one scenario more likely than the other.
1
u/random20190826 21h ago
I don’t have any statistics to prove how many people take precautions. However, can you think of a scenario in which both my phone and computer would be either lost, stolen, damaged or destroyed, but at the same time, I would remain uninjured and my house is intact? My computer is a desktop computer that has no backup battery, which means the only scenarios are earthquakes, house fires, floods and home invasions. All of these are very deadly events.
I don’t think the most important concern is the likelihood of these things happening. But rather, what are the consequences when they happen. If a SIM swap occurs, I lose access to information, probably lose money and have a very difficult time getting reimbursed. Whereas losing both codes would render the email accounts permanently inaccessible. At that point, I would just work with banks and merchants to get things changed to a new email address and set up new authentication codes. No money is lost.
1
u/charleswj 21h ago
Nearby lightning strike. And it's very rare for people to actually die in the events you described.
At that point, I would just work with banks and merchants to get things changed to a new email address and set up new authentication codes.
How would you do this and why couldn't the sim swapper do this?
1
u/random20190826 21h ago
Ideally, if a bank knows what they are doing, they would force me to go to the branch with ID to reset things like this.
1
u/charleswj 21h ago
I haven't set foot in a bank in well over a decade, and that was for a very large cash withdrawal.
The points in trying to make are that you're obsessively focused on a technical fix for what can still be worked around but is also less of a risk than those things that can still be worked around
1
u/charleswj 21h ago
As an exercise, you should try "losing" access to all auth methods and see what it takes to get back in. If they insist on in person, say you're bedridden. I suspect you'll find that it's likely in the realm of what a person who can sim swap you can already do.
1
u/SetNo8186 23h ago
Its not account safety, its connecting your phone as an essential part of identifying who you are. In China this went to the extant your phone with it's banking info was the only medium of financial exchange - cash was diminished and you used your phone no matter what.
Unless you made a dissatisfied post online which caught the notice of authorities who froze your bank account. This was done wholesale against one group of people who were also interned and used for forced labor, and worse.
If they can link our phone and bank, then monitor our social media, we are then their lackeys with no freedom. What amazes me is that this is all open source yet so many ignore it when its spoke of, as if it can't be happening. Well, Germany is knocking down doors and arresting people for memes, it can and is happening yet so many just shrug it off. Once it's done in America, it will be extremely difficult to turn around, and there are a lot of powerful institutions attempting to further it. Being as Americans can be very difficult to coerce, it's taking much longer than anticipated with many setbacks. A lot of us have the 40,000 foot point of view after decades of living here and seeing the drastic loss of freedom over the last 50 years. It's not the country we were born in. Trying to do anything in America without valid ID is now impossible, next step is making us all bend our knee with financial control.
1
u/random20190826 22h ago
Interestingly, since I am from China, I know all too well that all of this is true. In China, your bank account and your phone number are both tied to your ID, which is so centralized that a bank teller can see your social security contributions. I know that because I was asked why I didn’t have such contributions when I opened a Chinese bank account, to which I lied about working in the US. Unlike Canada, China mandates real name registration on phone numbers. This means if you want a Chinese phone number, you must give your ID to the phone company.
Many prepaid services in Canada don’t require ID. I happen to use them not because of privacy, but because prepaid is substantially cheaper than postpaid. But here too, banks are way too reliant on cell phone based SMS authentication despite law enforcement agencies like the FBI warning about the dangers of SIM swapping. I know that it will take a very rich person losing a lot of money or hundreds of millions of average people losing money to this kind of fraud before anything will change. It is a sad state of affairs.
1
u/dmatech2 23h ago
The problem with some of these MFA techniques is that they're too good for the average normie. When someone is using SMS MFA, the user can just go to the phone company and get a new phone if theirs gets lost, and they don't have to worry about losing the TOTP secrets. Remember that a lot of people don't know how TOTP works, aren't willing to learn, and don't even care. They just want someone to scream at when it breaks. Companies don't want to have to deal with their anger, and see SIM swapping as sufficiently rare to be worth the higher risk of compromise.
1
u/random20190826 22h ago
My biggest worry is with the banks. At least with all those companies I mentioned, I had the option to disable SMS authentication even though they discourage it. With banks, no one gets that option. The problem is, bank accounts have actual money in them. That means if they are hacked, my money would be stolen. Unfortunately, the way that SMS 2FA is implemented at the banks enables someone to reset the online banking password solely based on the SMS verification code. This makes it look like the account holder gave the code away to a scammer and the bank will not reimburse for those fraud losses unless the thief is convicted. Even then, the victim may have to sue the thief directly in civil court for compensatory damages. That means if the thief doesn’t have the money, the victim cannot collect on the judgement even if they win.
1
u/charleswj 21h ago
The irony of your points is that banks are actually safer than the purely personally protected options like crypto self custody, which is essentially what removing passwords and phone numbers is (at the auth level). People lose more money, more often, from crypto than banks when controlled for how many users there are for each.
1
u/random20190826 21h ago
I wasn’t talking about crypto in any of my posts. I don’t have any cryptocurrency anywhere. All I know is that banks are far more risky than, say, Interactive Brokers (a large international stock brokerage firm). Indeed, banks with forced phone number based authentication are more dangerous than Gmail, Hotmail or Amazon, because these 3 companies at least let you remove the phone number.
1
u/charleswj 20h ago
I didn't say you did, I was making a point about "purely technical measures". There is a lot of "soft" security in use in banking than you might think. And there are different risk profiles between a regular bank and something like IB.
I'm a technologist, I get it, I like absolutes and technical fixes. But the reality is the way things are is, from a practical perspective, secure enough. If we see sudden increased risk in sim swaps and account takeovers that outweighs the risk to the 99% of getting locked out of their accounts, things will change.
1
u/random20190826 20h ago
Why would banks be different than IB if both hold real money and have the same KYC requirements? In fact, banks have brokerage arms and they use the same login for all of their services. That makes bank brokerage accounts more likely to be breached than IB, at least that is the logical conclusion based on the authentication methods available.
Basically, my argument is simple. The purpose of a bank is to keep a customer’s money safe from unauthorized access by third parties. By not offering secure means of authentication or not allowing the disablement of dangerous methods, the bank has failed in its duty of care. Therefore, when SIM swapping occurs, they shouldn’t be able to turn around and accuse the victim of being negligent in the protection of their account credentials.
1
u/charleswj 20h ago
Different banks gave different risk profiles at least partially due to different customer profiles.
Implementing what you're asking for would increase costs, financially and otherwise, on the bank and its customers. Would you be willing to pay i.e. $5/no for additional support for others who lock themselves out?
I'm sure you're aware that increased security always reduces usability.
1
u/Solid_Mongoose_3269 22h ago
Because if they have your email and phone number, that data can be used to link you all over places that the government can use to get most of your identity
1
u/Malcompliant 19h ago
Most users don't back up the codes and most users have malware on their computer. The purpose of the warning is to make it clear that your account becomes totally unrecoverable if you aren't taking the correct precautions on your end.
3
u/dkopgerpgdolfg 1d ago edited 1d ago
In the very general case:
As you say you're a CS student, I'm sure you can come to that conclusion too:
Money. That's all. Money by selling data, and/or forcing the users to use other paid products, or harming you in some way because you're endangered their profits, ... . Who cares about misinformation, lies, fraud, blackmail, defamation, libel, assault, and many more things, when the goal is to run a ultragreedy US company.
...
This example here is one thing.
GMail warns you that all external mail clients are not secure to use, only their own browser client is fine, because they can track your activity best there.
MS teams is intentionally broken with Linux user agents, but that's against some EU court ruling, so on every bug report and complaint you'll get some copy-paste "everything works, we're fully supporting Linux too" when clearly this is not the case.
Youtube intentionally slows down with script/adblockers active.
An increasing amount of restaurants threaten you if you leave a bad review.
And so on...