<story><title>Second factor SMS: Worse than its reputation</title><url>https://www.ccc.de/en/updates/2024/2fa-sms</url></story><parent_chain><item><author>slothtrop</author><text>Why isn&amp;#x27;t there any market fulfillment for &amp;quot;safe, non-intrusive ads&amp;quot;, on the part of a vendor? Is it because it&amp;#x27;s not possible, or not worth the overhead either because of cost or no effect on consumer behavior&amp;#x2F;blocking?&lt;p&gt;This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.</text></item><item><author>AegirLeet</author><text>Turns out ads aren&amp;#x27;t just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web.&lt;p&gt;In other words: If you&amp;#x27;re trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBlock Origin for them.</text></item><item><author>dools</author><text>A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like &amp;quot;BANKNAME login&amp;quot;. The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the addition of a new &amp;quot;pay anyone&amp;quot; payee, and with that her money was gone[0].&lt;p&gt;I have accounts with 2 banks, one uses SMS 2fa and the other uses an app which generates a token. I had thought that the app was by default a better choice because of the inherent lack of security in SMS as a protcol BUT in the above attack the bank that sends the SMS would have been better because they send a &lt;i&gt;different&lt;/i&gt; message when you&amp;#x27;re doing a transfer to a new payee than when you&amp;#x27;re logging in.&lt;p&gt;So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you&amp;#x27;re performing and won&amp;#x27;t accept, for example, a login token when adding a new payee. I haven&amp;#x27;t seen any bank with that level of 2fa yet, has anyone else?&lt;p&gt;I guess perhaps passkeys make this obsolete anyway since it establishes a local physical connection to a piece of hardware.&lt;p&gt;[0] Ron Howard voice: &amp;quot;she eventually got it back&amp;quot;</text></item></parent_chain><comment><author>RandallBrown</author><text>I feel like this was one of the original selling points of Google&amp;#x27;s ads. They were pretty simple, unobtrusive, mostly text, ads.</text></comment>
<story><title>Second factor SMS: Worse than its reputation</title><url>https://www.ccc.de/en/updates/2024/2fa-sms</url></story><parent_chain><item><author>slothtrop</author><text>Why isn&amp;#x27;t there any market fulfillment for &amp;quot;safe, non-intrusive ads&amp;quot;, on the part of a vendor? Is it because it&amp;#x27;s not possible, or not worth the overhead either because of cost or no effect on consumer behavior&amp;#x2F;blocking?&lt;p&gt;This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.</text></item><item><author>AegirLeet</author><text>Turns out ads aren&amp;#x27;t just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web.&lt;p&gt;In other words: If you&amp;#x27;re trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBlock Origin for them.</text></item><item><author>dools</author><text>A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like &amp;quot;BANKNAME login&amp;quot;. The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the addition of a new &amp;quot;pay anyone&amp;quot; payee, and with that her money was gone[0].&lt;p&gt;I have accounts with 2 banks, one uses SMS 2fa and the other uses an app which generates a token. I had thought that the app was by default a better choice because of the inherent lack of security in SMS as a protcol BUT in the above attack the bank that sends the SMS would have been better because they send a &lt;i&gt;different&lt;/i&gt; message when you&amp;#x27;re doing a transfer to a new payee than when you&amp;#x27;re logging in.&lt;p&gt;So really the ideal is not just having an app that generates a token but one that generates a specific type of token depending on what type of transaction you&amp;#x27;re performing and won&amp;#x27;t accept, for example, a login token when adding a new payee. I haven&amp;#x27;t seen any bank with that level of 2fa yet, has anyone else?&lt;p&gt;I guess perhaps passkeys make this obsolete anyway since it establishes a local physical connection to a piece of hardware.&lt;p&gt;[0] Ron Howard voice: &amp;quot;she eventually got it back&amp;quot;</text></item></parent_chain><comment><author>rurp</author><text>Intrusive ads are more profitable for the ad company, while the costs are largely born by other parties. A strategy to privatize the gains and socialize the costs is common in a lot of sleazy industries.</text></comment>