We Regret to Inform You That Two-Factor Authentication is Not Invincible [Collision Course #6]

Hello and welcome to the 6th issue of Collision Course, a newsletter about tech policy, consumer privacy, and the future. Click here to read previous issues of the newsletter.

Today, big news from Reddit, and why two-factor authentication isn’t as secure as you think.

Reddit, the popular social networking site, announced today that they’d been hacked and that attackers had gotten access to users’ personal information:

It’s bad news for Reddit, but what’s most interesting is that, per their blogpost, the hacker seems to have obtained access to user data by circumventing Reddit’s two-factor authentication, intercepting SMS messages with one-time login codes.

It sounds techy, but if you’ve ever used an ATM, you’re familiar with two-factor authentication (also called 2FA). To access your account or withdraw money, ATMs require something you have (your bank card) and something you know (your four-digit PIN).

The same thinking is behind 2FA for email, Twitter, Facebook, and many other web services.

If you’re like over 90 percent of Gmail users, you don’t use 2FA. You type something you know (your password), and you’re on your way.

2FA adds another step — the something you have. After you type in your password, you receive a six-digit code in a text message that you have to type into your web browser.

Here’s 2FA in action:

Since your phone is something you have, and by entering the code you’re proving that you’re the account owner and should be granted access.

While 2FA useful for something like Gmail or Twitter (so attackers can’t impersonate you), it’s absolutely necessary for something like online banking, since attackers can wire money out in minutes if they gain access to your account.

If you have 2FA enabled, even if you’re tricked into entering your password on a fake website, or if your password is posted online as part of a data breach, your account is still safe. The attacker doesn’t have something you have.

Their blogpost makes it sound like Reddit engineers had 2FA enabled. So, how did they get hacked?

The truth is that 2FA isn’t bullet-proof, and the reason why is something called “SMS hijacking.” Here’s how the con works:

(This actually happens.)

Traditional 2FA (through text message) isn’t useless just because it’s susceptible to the attack that probably snagged the Reddit engineers. That sort of attack is hyper-targeted, and most of us aren’t important or interesting enough for an attacker to go to the trouble of impersonating us to our service provider.

2FA still protects you from phishing, and from your password being used after an attacker finds it in a database breach. For instructions on how to enable two-factor authentication on various internet accounts, check out https://twofactorauth.org.

Making a more secure 2FA essentially means making a slightly different something-you-have. Cellphones are still pretty good things to choose, since they often come everywhere with us. Google has an authenticator app that provides the same sort of six-digit code, but since it’s an app rather than an SMS, it’s harder to hack. A Yubikey is also a good way to go: it’s a physical device that plugs into your computer’s USB port and authenticates you to various internet services.

–

As always, I welcome your feedback, and I’d love to hear your suggestions for what you’d like to see covered in this newsletter. I’m @tommycollison on Twitter, or you can email tommy@collison.ie. Please get in touch! 📩📬