> port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi
That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do).
I really wish that were illegal. A phone number is a phone number.
> she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through.
Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised.
zinekeller · 1h ago
> Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised.
I can probably illuminate some things here. This is almost certainly the SMS API they're using. Your phone, and your network by extension, does not care if the phone is technically online - so those messages get received because they're literally sending in the blind (and if the recipient is offline, the message gets temporarily stored by the receiving carrier for around 3-7 days before it is discarded).
These SMS OTP systems validate "reachability" (using APIs like https://developer.vonage.com/en/number-insight/technical-det... and https://www.twilio.com/docs/lookup/v2-api/line-status) and will not send a message if a number is 'not' reachable. Unfortunately, as implied by the air quotes, these methods are not infallible. This is done to reduce the costs of sending the message (carriers charge a lot more for commercial customers) but this is definitely stupid for a already-validated number like in this case.
jjice · 2h ago
It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me.
It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.
connicpu · 2h ago
May vary by institution, but both banks I have accounts with also support having a robot call my phone where I can confirm the login. That should at least work with WiFi calling.
BenjiWiebe · 2h ago
I've been using Citi and Discover for years with a Google Voice number. Possibly I've been grandfathered in though?
terinjokes · 2h ago
I could not use my Google Voice number (that I've had since Grand Central) for most companies that only do SMS 2FA until it became my Google Fi number. Then I guess some flag got set in the database they check against.
Suppafly · 1h ago
>I could not use my Google Voice number (that I've had since Grand Central) for most companies that only do SMS 2FA until it became my Google Fi number. Then I guess some flag got set in the database they check against.
I was wondering about that, because I can't get google voice because I have google fi, so clearly it's using the same bank of numbers, but maybe once they are fi, they are ported to T-mobile instead of their own CLEC.
pxeboot · 16m ago
They removed that restriction. You can have Fi and Voice on the same account now.
notyourwork · 1h ago
Chase bank used to not work with Google voice. I would have to use email for code. Sometime in last year? it started working.
emeril · 2h ago
yeah, I use GV with all sorts of things that don't normally allow most likely as a result of being grandfathered in - i.e., I suspect they don't recheck old active numbers as being invalid per VOIP classifications/etc.
brewdad · 2h ago
Mine has worked as well but it used to be a landline when I first acquired it many moons ago.
ravenstine · 2h ago
Execs at those companies probably think "Google = good".
notyourwork · 1h ago
Yet Facebook won’t let me sign into WhatsApp using my GV number alone.
BenjiWiebe · 1h ago
There must be something unique about my GV number. It's even allowed on WhatsApp (knock on wood).
I registered it about 13 years ago. I didn't transfer it from a landline/cell phone, it was picked from a list of Google Voice numbers available in my area code. I've never had Fi.
unethical_ban · 2h ago
I absolutely cannot stand that no bank I have (US) supports generic TOTP, which is more secure and easier to recover from backup if my phone is broken or stolen.
It's inexcusable.
lldb · 9m ago
Although they don't offer TOTP, I've noticed growing support for Passkeys which is a step in the right direction.
_bin_ · 2h ago
This is probably compliance-related. For me, TOTP isn’t “something I have”, it’s another thing I toss into my password manager and sync to all devices.
I really agree with it, but that’s probably their rationale.
throitallaway · 1h ago
That same rationale wouldn't support SMS as "something I have." iMessage and other solutions easily spread SMS into cloud and PC lands (ones that are more easily accessible than password managers.) More likely it's because of legacy and "good enough" reasons.
Personally I don't put TOTP tokens into my password manager and keep a dedicated app for it, just in case my password manager is pwned.
connicpu · 2h ago
I do the same, and it somewhat defeats the spirit of 2FA, but I still believe it's more secure. It's basically a second password where intercepting it in transit once isn't enough to be able to repeat the login in the future.
unethical_ban · 2m ago
One time password.
Yes, a digital OTP generator is more susceptible in theory to theft or duplication than a hardware token.
Yes, the benefits of digital OTP are great compared to password only, more secure than SMS, and trivial to implement.
Sargos · 1h ago
Banks didn't support TOTP long before we were able to easily sync them across devices. It's likely more along the lines of banks generally have bad IT departments and outdated digital security policies.
lxgr · 1h ago
The real problem is not having a (trusted) way of seeing what you are consenting to by entering a TOTP (which can be phished).
SMS-OTP, with all its downsides, allows attaching a message of who you're paying how much to the actual code.
lxgr · 1h ago
TOTP is alright for logins, but it's generally very phishable. For transaction confirmation, not being able to tie a code to a given recipient and amount is somewhat of a dealbreaker.
fortran77 · 1h ago
By brokerage suports TOTP but not my bank. My bank does support Yubikey-type devices though.
throitallaway · 1h ago
Vanguard supports Yubikeys. I'm yet to use a bank (~8 of them so far) that supports anything other than SMS.
_bin_ · 2h ago
Phone numbers are used like this because in the Year of our Lord 2025, they’re the best way to semi-solve the Sybil problem even somewhat without having to literally do some kind of KYC
BenjiWiebe · 2h ago
I use Wi-Fi calling on a phone only for 2FA SMS. Never had a problem with it. It was RedPocket (MVNO) with T-Mobile. Annual plan of 200MB, only a few dollars a month. No T-Mobile service here* so only SMS over Wi-Fi works. Only ever used for SMS 2FA.
*The bands acquired with the Sprint merger have service, but the cheap used phone I bought was pre-Sprint-merger and lacked those bands.
Marsymars · 1h ago
If you port your cell number to a VOIP carrier, I don’t think senders have any way of telling that it’s not still a regular cell number?
I have such a ported number and have no issues receiving SMS 2FA codes.
baby_souffle · 3h ago
> That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do).
I really wish that were illegal. A phone number is a phone number.
It pisses me off to no end. I use a few different banks and some are fine with google voice, others are not. One only allows customer service to send SMS tokens to google voice but not through the regular flow. In all but one case, they will happily robo call my google voice number and have a tts engine read me the same code that they didn’t want to SMS.
Security policy by rng, ffs!
LeifCarrotson · 2h ago
She just needs a microcell/femtocell.
Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 input, a little GPS antenna so the cell supports e911 location data, and it will broadcast LTE (or now 5g) cellular data.
I work at a shop with metal walls located in a river valley. It's a cellular data black hole. People used to climb the hill up the driveway to make and take calls, but various people called their ATT, Verizon, and T-Mobile providers and all three shipped us femtocells. Mow the users and the contractors/customers who come to visit can't even tell that their phones have switched to data over our ISP instead of a tower, it just works - including 2FA codes and MVNOs.
She may have to switch to first-party Verizon service instead of using an MVNO.
I'm surprised the major cell providers are cool with letting randos operate cell towers that back into an unknown untrusted ISP and their customers will automatically switch to when in range. It's unbelievably chill for companies that are usually so concerned about their image and controlling the whole experience end to end.
wmf · 42m ago
Femtocells are remotely controlled by the carrier, they require GPS location (and maybe spectrum sensing), and I assume the backhaul is over VPN. Obviously they can't guarantee any QoS but it's better than having no signal.
(Fun trivia: Our office paid $XX,000 for AT&T MicroCells which wouldn't activate because they couldn't get GPS signal.)
Suppafly · 1h ago
>I'm surprised the major cell providers are cool with letting randos operate cell towers that back into an unknown untrusted ISP and their customers will automatically switch to when in range.
A lot of office buildings have these in them. I think the personal ones are how they get around some of the issues with government requiring them to build networks to certain coverage. They just don't build it out and when someone complains they offer them one of these.
parliament32 · 29m ago
If the device is remotely managed and all IPSEC back to the carrier, who cares what network it's on? At worst you'd just get poor connectivity, I don't think there's any additional exposure here.
zinekeller · 1h ago
Eh, assuming it's 4G LTE (or above), it's literally the same thing as Wi-Fi calling. This is technically called IMS (IP Multimedia Subsystem, https://en.wikipedia.org/wiki/IP_Multimedia_Subsystem), and is powered by "magic" DNS (no kidding, everything points to 3gppnetwork.org) and literal IP + IPSEC. Even when your phone is connected to Wi-Fi, it enters a special mode called IWLAN which powers your Wi-Fi calling, SMS, and RCS. The only actual factor here is if the ISP that you have versus your mobile network has a good peering.
nelblu · 1h ago
Some of the comments pointed out that this is hostile behaviour for people roaming as well, and I completely agree. Here is my solution for this : When I am roaming internationally, I leave my SIM card in a spare android at home plugged into a charger. Android has an app that forwards SMS to API : https://f-droid.org/packages/tech.bogomolov.incomingsmsgatew.... Every time I receive a SMS I forward it to this API. The API in turn emails me the whole message.
I have been using this setup for a few years now without any issues. Even when I am not roaming, I still have this setup on my primary phone. So when I am on my computer and need a SMS OTP I don't need to go find my phone, I receive it in email :-).
(Note : This doesn't work with MMS but I don't need them anyway)
lldb · 5m ago
If your phone supports WiFi calling and dual SIM, you can get a data-only eSIM for the country you're visiting and you'll receive texts for your primary line over the data connection of the secondary eSIM.
pauldino · 24m ago
I did something similar where I left an old Android phone at home and logged in to what I think used to be messages.android.com (now google.com) from a laptop praying the session wouldn't get lost before I got back from my trip. :)
Lately though, SMS works over WiFi calling and usually if I need a real SMS where Google Voice won't cut it, it can wait for WiFi...
apexalpha · 20m ago
I’m sorry how is this related to roaming?
I roam all the time in Europe and have roamed a lot outside of it, I have never had any trouble receiving any SMS?
Oh, this happens to me. I didn’t even realize that’s why I wasn’t receiving some sms codes, because sometimes it works and sometimes it doesn’t. I live in a rural area and have spectrum for both wifi and mobile (just like the woman in the article). I have some cell service, but depending on how strong it is in any given day am usually relying on wifi for calling and sms.
SMS codes have been hit or miss, and this explains it well.
modeless · 3h ago
Google Fi can receive all SMS 2 factor messages on Wi-Fi including short codes. It doesn't even require that your phone is on, you can get them in any web browser on any device even if your phone is destroyed. One of my favorite features.
You can get service starting at $20 per month. Fi used to have good service in some mountain areas too, with US Cellular. Not sure what's going on with US Cellular right now though. Some kind of half acquisition by T-Mobile.
Ozarkian · 3h ago
I have been living outside the United States for twelve years.
I always had problems with SMS until I got Google Fi. And that's a problem because, as the article here says, many banks insist on SMS these days. There are various services that give you a virtual number. But they always suffer from one of two problems: (1) VOIP numbers are 'blacklisted' by some banks for security reasons: they want a real cell phone number (2) I simply don't get SMSs in some cases some technical reason
Google Fi works everywhere. Even when there is no cell phone service: it will tunnel over WiFi.
Google shuts off the data on Fi after you've been outside the USA for a month. No problem, I'm happy to pay $25 a month for a 'dataless' connection that gives me SMS and voice.
cge · 40m ago
>Google shuts off the data on Fi after you've been outside the USA for a month. No problem, I'm happy to pay $25 a month for a 'dataless' connection that gives me SMS and voice.
To be somewhat more specific: while I travel extensively and am in the US often, I am often outside of it for more than a month at a time, and it appears that Google will shut off data outside the US if you use data outside the US for too long. If you are using a different SIM for the primary data connection, it appears that they won't even if you have it enabled as a backup.
arccy · 2h ago
compared to prices for the rest of the world, you wouldn't want to use Fi for data anyway... just get a local or even "travel" esim and run with dual sims.
devoutsalsa · 2h ago
I’ve found that it’s easy to data-only eSIM package through an app store app such as Saily, but it’s harder to find a service that gives you a “real” phone number when traveling internationally. Any recommendations?
AnonC · 2h ago
I don’t have direct experience, but I’ve heard about or seen the following online (there may be many other MVNOs). All of them are activated with an eSIM and they have WiFi calling, which means it’s a real US phone number as any other and you can make/receive calls and send/receive SMS as long as you’re connected to the internet via WiFi or through a data connection on your second SIM on the phone. If you wish, you can buy real roaming too, but that tends to be expensive.
* Tello
* Red Pocket
* Good to Go Mobile
If you’re looking for a real local phone number in the location you’re traveling to, then eSIM providers like Airalo can handle that (Airalo has “global plans” that support voice and SMS). Getting such a connection for voice and SMS, as compared to a data SIM alone, would be expensive. So you could get a data eSIM that works locally and use that for “WiFi” calling/SMS with the providers mentioned above.
throw7 · 1h ago
Are you able to use rcs and "messages for web"?
The last time I checked if you wanted "cellphone is off" texting/voice (basically the old hangouts), you had to enable "fi syncing" which disabled rcs features. Is that still true? What url do you goto to do texts/voice? (i see hangouts.google.com redirects to google chat).
modeless · 1h ago
Yeah no it still disables RCS which is super lame now that iPhones finally support it. I hope Google gets around to fixing it someday. I'm not holding my breath. I'm just happy they didn't kill the feature when hangouts died. The URL changed, it's now https://messages.google.com/web/
Neywiny · 3h ago
Much agreement with the others that there's too much expectation. I rented a lime scooter for the first time last year. But, I messed up my VPN settings so I had no Internet. There was no way to tell the scooter I'm done. Even though it was stopped, no button to end the ride. They refunded me the extra time (which was maybe 5 of the 10 minutes) because they could see it was just stopped at a bike rack on gps. Idk what I'd do if my phone died or any other reasonably possible things when you're out and about and on a scooter.
TonyTrapp · 3h ago
Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.
ncpa-cpl · 1h ago
Reminds me of a cashless hotel laundromat that I had to use that didnt accept coins, tokens or had a credit card reader. So to wash my clothes I had to find a charger to charge my phone, download an app, being able to receive SMS 2FA while roaming which is a hit or miss depending on roaming agreements, having working internet connection, enabling Bluetooth and Bluetooth Nearby Devices, and then top it up with a foreign credit card. It took about 30 minutes to set it up.
I guess this would be easier in a beighbourhood laundromat with local clients, but in a hotel with many foreigners it becomes a pain with so many dependencies needed to use the washer and dryer.
lxgr · 3h ago
Are you sure that the locker has an Internet connection?
Requiring Bluetooth and an Internet connection on your phone suggests that that's exactly what they removed on their side. Quite clever, if true – why pay for network connectivity if you can just piggy back on your customers'? (Nevermind those customers without a smart phone and data plan...)
TonyTrapp · 2h ago
> Are you sure that the locker has an Internet connection?
Let's put it like this: The old ones (with a display) definitely do, because they can send email notifications. I would be very much surprised if the new ones didn't. The main reason for requiring the app isn't connectivity to the outside world, it is that they can save money on the terminal screens, which get vandalized frequently in some areas. The internet connection is probably a fraction of the cost of replacing those touch screens every few months.
jedbrooke · 48m ago
I remember running in to this problem in university too where one of the basement lab rooms didn't have cell service, but we had to log in to the school computers with our university accounts that had mandatory 2fa
also was surprised to learn from the article that some carriers don’t support the 2fa 5 digit numbers over wifi calling/sms. when I travelled abroad recently that was such a life saver since my carrier supports it
dreamcompiler · 3h ago
1. Download the Google Voice app. This phone number works for some but not all 2FA services. Not all, because some explicitly forbid GV numbers because they're afraid of fraud. GV can receive SMS messages over wifi.
2. Ask the cell phone company for a femtocell. These used to be called "AT&T Microcells" and they were cheap. I used one before cell service improved because I live in the mountains. But apparently AT&T don't make them any more and now they cost $2500.
3. Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal; I use it because I find it easier to use my laptop keyboard to type SMS messages than to use my thumbs on my phone.
magicalhippo · 3h ago
4. Get a USB modem and hook it up to a computer somewhere safe that has coverage, and access it via internet.
I'm building the opposite, using the modem and a Raspberry Pi to send me metrics from my cabin, but could easily work in reverse.
While prototyping I had it parse SMS messages I sent it.
Obviously not for everyone but we're on HN here...
lxgr · 3h ago
> Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal
It can't – how would it?
The only entity that can forward texts is the carrier, and I doubt that that service is integrated with all US carriers to somehow get them forwarded (which is technically quite difficult for various legacy protocol reasons).
Apple's satellite messaging service is the only solution I know of that can somehow hook into carriers' SMS home router (or IMS equivalent) infrastructure to intercept and out-of-band forward SMS.
miki123211 · 2h ago
> Apple's satellite messaging service is the only solution I know of that can somehow hook into carriers' SMS home router
Are you sure it actually does this?
I thought it was a pseudo-carrier that could speak MAP / Diameter, and just pretended you were roaming with them when you used satellite connectivity, perhaps with the original carrier's knowledge and consent.
As far as I understand, that's how this kind of service usually gets implemented.
lxgr · 2h ago
I assumed that that's how it works because I couldn't think of any other way to achieve the observed behavior, but pseudo roaming sounds plausible too, and presumably requires much less work on the carriers' side!
Would that approach also allow the extra functionality they seem to be offering, such as only recently messaged numbers and emergency contacts being able to send messages to satellite users, though? I suppose they could just reject all MT-Forward-SM with sender numbers they don't like?
> As far as I understand, that's how this kind of service usually gets implemented.
Do you have any other examples for solutions like this? Are you thinking of (pre-VoWifi) carrier apps or services that could receive texts, sometimes on multiple devices?
hedora · 2h ago
Sms and signaling system 7 are incredibly insecure. It has to be so it can support scammers that call you from spoofed numbers.
Anyway, it’s probably possible to make a service like that. You might need to route through a country with permissive laws.
lxgr · 1h ago
SS7 is very insecure, yes, but intercepting inbound SMS is still orders of magnitude more difficult than spoofing sender/caller numbers.
Allowing SMS interception without the home network's consent seems like a quick way to get offboarded as a roaming partner.
Loudergood · 1h ago
The real bonus to security here, access to your SMS is protected via MFA.
miki123211 · 2h ago
This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers.
Your carrier is already capable of redirecting your SMS messages to other carriers, that's what they do when you're abroad and roaming with a foreign operator. You could make a fake carrier that speaks the right protocols on the roaming side, but communicates with the customer over the internet (using an API or a proprietary app) instead of LTE or GSM.
This would essentially work like an SS7 redirection attack, but with the full knowledge and consent of the "victim." You could alleviate the security impact here by requiring SIM card authentication, just like a normal carrier does, which could be performed through the internet and an USB reader just fine.
Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. I wonder whether a gray-hat route would be possible here, especially if the company was outside US jurisdiction.
Marsymars · 1h ago
> This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers.
This has been essentially been tried multiple times, e.g. by FreedomPop and Republic Wireless.
immibis · 2h ago
> Carriers would probably hate this and might not be willing to sign roaming agreements with such a company.
This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't.
You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.
apexalpha · 22m ago
The article does not support the title in my opinion. This has little to do with living in a mountain but more having an ISP that doesn’t support a lot of default telco functionality.
Calwestjobs · 4h ago
TOTP, HOTP.
SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.
gruez · 3h ago
>your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.
This is mostly a red herring because most of the places that require SMS TOP already have your full name/address (eg. financial institutions, healthcare providers) or are in a position to intercept communications that they can infer that information (eg. google). If apps/sites like tiktok wants my phone number for 2fa, they can fuck off, or get a burner number.
globie · 3h ago
I don't understand how this post stacks up against the myriad of communications apps that not only require phone verification when creating a new profile (and maybe SMS2FA), but put great effort into blocking as many VoIP/burner/prepaid numbers as possible.
"Most"? maybe "a troubling few"?
Phone verification is absolutely a widely exploited data mining opportunity, I don't see how it's a red herring at all. It's one of the worst surveillance mechanisms we live with today, only partially waved away with the 2000's concept of burner numbers.
PaulHoule · 2h ago
To single out Meta properties, I'd point to both Instagram and WhatsApp. It was an official policy early on that you could only create a WhatsApp account if it was connected to a "real" cellular number, I think the same has been true about Instagram for a while in that every time I tried to create an account without a cellular number it didn't work. Put in a cellular number and it worked just fine.
reginald78 · 1h ago
Last time I tried to create a throwaway account for facebook it didn't actually ask for my mobile number. Just automatically banned me for being suspicious and then demanded a video of my head with no assurance that would actually help. I generally avoid meta but it seems like most craiglist sales have moved to facebook marketplace.
Calwestjobs · 3h ago
yes marketer gets your name from bank etc, you can not lie there about your name. and everywhere else, your data is connected just your number.
same problem with signal messenger or facebook messenger building databases of numbers and contacts. neo4j clone from palantir.
lxgr · 3h ago
Neither TOTP nor HOTP provide "what you see is what you sign" property, unfortunately, which can be critical for bank and other transactions.
"Enter this code only if you want to pay <amount> to <merchant>" is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example).
Not even WebAuthN provides that property on a compromised computer; for that, you'd need something like the SPC extension [1] and a hardware authenticator with a small display.
That's unfortunately why we're currently stuck with proprietary bank confirmation apps that can provide it. I really wish there was a vendor-neutral standard for it, but given how push notifications work (or rather don't work) for federated client apps, I'm not holding my breath.
Yeah this is a big problem. I have been sent 2F messages via WhatsApp by some services (e.g. PayPal).
This isn't great, but better then SMS and having to have a separate app for each authenticating service though.
A vendor neutral service would be a lot nicer.
hedora · 2h ago
She should switch cell phone providers. I’ve never had a problem receiving 2FA SMS from five digit numbers over WiFi, and heavily rely on it working. I know this for sure because I have an automation set to put my phone in airplane mode + wifi when I get home. (It eats battery when there’s a weak 5g signal.)
SMS 2FA is terrible though.
deepsun · 2h ago
Sounds like discrimination of a broad group of people. Granted, it's not a designated protected group, like by national origin, but I still think they have a good chance in court.
ecb_penguin · 1h ago
It's absolutely not discrimination and you're harming people by making such an absurd claim. Unreliable SMS delivery is not discrimination. This is how things end up on Fox News: "Is website security now discrimination?"
> but I still think they have a good chance in court.
On what grounds?
swiftcoder · 1h ago
> you have to download an app to do it, it's not just a capability that a phone has by default
Luckily this is starting to change. Apple's Passwords app does TOTP out of the box.
Though I am mystified why Google Authenticator doesn't come pre-installed in Android.
chedabob · 1h ago
For the longest time Authenticator was almost abandoned by Google, so it's not surprising the team responsible for the bundled Android apps swerved it.
It didn't need bells and whistles and constant security updates, but it took 13 years for it to get cloud-sync support so you could backup your codes.
aequitas · 54m ago
Doesn't this kind of defeat the purpose of MFA in that you now have both factors within the same application?
GuinansEyebrows · 1h ago
TIL! Thanks, I had no idea Passwords did this until now.
vanburen · 3h ago
If cell service is available in at least one area of the property, you could have a dedicated sim for receiving SMS 2FA and use a 4G router to forward the SMS to an email, e.g. Teltonika have this functionality [1].
The 4G router also has the benefit of being able to use externally mounted antennas. Which might help in low signal areas.
Not ideal, but might at least be a solution for some people.
While that is a solution someone could use, it wouldn't work for the subject here:
> she usually doesn't even have service 100 meters down the road.
vanburen · 2h ago
Yeah wont work for everyone, but a directional antenna mounted high up on house might have a better chance than a phone antenna.
brandon272 · 2h ago
The idea of mounting a directional antenna "high up" on a house (or paying someone to do it) for the purposes of receiving SMS 2FA seems wild.
vanburen · 2h ago
You can also get antennas with suction cups. I have used this before to get 4G internet in a house with no access downstairs, by sticking the antenna on an upstairs window.
An outdoor antenna would be better, but yeah more of a pain. I guess it really depends on how badly someone wants SMS.
Peacefulz · 48m ago
Hey! I'm interested in that local AVL signal group. I've lived here for 6 years and I haven't met any friends because I'm a recluse with children. If you'd be willing to share, I would be greatly appreciative. :D
brettanomyces · 3h ago
TOTP are okay for some things but often regulation means each code/challenge needs to be tied to a specific action. TOTP codes typically last for 30s and mulitple actions can happen within 30s, so it's not possible to use TOTP in many cases.
PUSH approval could be used instead but then you need to download an app for every service you use, which isn't very convenient.
PASSKEYS offer a solution which will work on both web and mobile and don't require you to download an app for every service. But it's a new concept that people need to learn so how fast they will be adopted is yet to be seen.
hedora · 2h ago
> TOTP codes typically last for 30s and mulitple actions can happen within 30s
The server just needs to remember which TOTP codes have been used and to reject after the first use.
The code is no longer sensitive after it has been used, so jam it in a database that can expire tuples after a few minutes or stick it in an login audit table if you have one.
devoutsalsa · 2h ago
My personal 2FA favorite is OTP + authenticator app. It behaves predictably and doesn’t have weird failure conditions.
SMS 2FA tied to your mobile number sucks if it doesn’t support Google Voice, especially when traveling internationally and your SIM card isn’t in your phone.
Email 2FA usually works, but I just find it annoying.
App-specific push notifications mostly work, but it’s hard to debug if you don’t get the notification. For example, I recently bought a new phone and all of my apps were reinstalled when I restored from a cloud backup. For some reason app notifications didn’t work until I uninstalled & reinstalled the apps. And reinstalling the apps was a bit confusing because some of the apps were not available in the app store based on my physical location in a different country at the time.
tptacek · 2h ago
TOTP isn't phishing-resistant, which is the whole ballgame. I've had the job of working on authentication for highly-targeted mass-market systems, and code-generators basically don't work: they raise the bar on phishing attacks to a level phishers still easily meet.
goatsi · 1h ago
TOTP and SMS 2FA prevent credential stuffing attacks, which is very valuable considering how bad people are with password reuse and how many breaches with plaintext or weakly hashed passwords there have been.
tptacek · 25m ago
Yes, but other authentication factors also prevent credential stuffing, as well as phishing, which is probably the most important problem in authentication.
kmoser · 2h ago
I hate email 2FA because I purposely don't have email on my phone. Unless I'm in front of my computer, I'm unable to log in to websites that use email 2FA.
jabroni_salad · 1h ago
I have some rural Duo customers and we always end up having to dial up the timeouts because it can take longer than a minute to receive a push notification in some areas. One of them has told me that duo is the only 'notification thingy' that works because the other implementations won't wait long enough.
lxgr · 3h ago
Beyond "just" being phishing resistant, for banking/payments, WebAuthN even has the opportunity of providing "what you see is what you sign":
The Secure Payment Confirmation [1] extension to WebAuthN supports using passkeys on third-party sites (think merchant checkouts) and including signed structured messages (think "confirm payment of <amount> at <merchant> on <today>").
It wouldn't be crazy to imagine authenticators with small OLED displays to provide an end-to-end secure channel for displaying that information, similarly to how cryptocurrency hardware wallets already do it.
Of course, this would require a certain popular hardware and software manufacturer with a competing payment solution to implement the extension...
This is a problem with her carrier or her specific account provisioning. SMS over WiFi calling works just fine, including from short codes.
I'm often traveling outside of the US, and my AT&T prepaid line most definitely does not roam outside of CAN/US/MEX. I spend the bulk of my time in WiFi calling mode. I have never had any issues receiving or sending SMS over WiFi, including to short codes.
jboggan · 2h ago
I remember in 2014 going to play a Bitcoin poker game at some Google VP's house way up in the hills, Charlie Lee was there. We tried to buy-in at the beginning to a pot address but no one could get their Coinbase SMS 2FA to work because we had no reception so we ended up writing IOUs on scraps of paper.
No comments yet
marssaxman · 2h ago
I had this problem a couple years back, when I was living in a small coastal town where cell service was spotty. Generally I could either be in a place where I could receive text messages, or a place where I could get access to wifi, but not both at the same time. When I wanted to get into my bank website, I would drive 20 minutes up the road to the next, slightly less small town, where I could get wifi and receive SMS, then drive back when I was done.
If I had stayed there longer, I might have found a better solution for my personal situation, but the experience as it was left me pretty uncomfortable with mandatory SMS 2FA as a general security tool. I'm sure there are many other people running into similar edge-cases.
hkchad · 3h ago
I have garbage cell signal in my house, was only an issue for sending/receiving large pictures/video's over iMessage, apparently those don't send over WiFi for some unknown reason as well... I called Verizon and they sent me a Fem2Cell, problem solved.
hedora · 2h ago
Those definitely work over wifi. iMessage strongly prefers it.
Maybe verizon is incompetent or malicious?
What happens if you’re overseas or in a cell dead spot with wifi? The latter happens to me all the time in the city.
It’s amazing how many hip “use your phone to order!” restaurants are in cell dead spots, and have set up wifi access points as a workaround.
tlb · 3h ago
I wonder what the companies requiring 2FA think about uncompleted 2FA bounces. Deterred fraudster? Short attention span? SMS sucks?
vbezhenar · 3h ago
Every second SMS authorization does not reach my phone. Just yesterday I couldn't log in to my GitHub from new computer, because my phone did not receive authentication code. I didn't have any bans because of that. I think that a lot of people experience similar problems, so it makes no sense to look for fraudsters, 99.9999% will be false negatives.
hocuspocus · 2h ago
There's really no reason to use SMS 2FA for GitHub though, you can literally pick anything else.
vbezhenar · 2h ago
Anything else could be lost. I can always get new SIM card for this number. I don't need to backup it and I can't accidentally delete it. That's the biggest reason for me to link phone number everywhere. I'd hate to lose access to my GitHub account.
hocuspocus · 2h ago
I don't see how I could simultaneously lose my three hardware keys (laptop, phone and Yubikey) and backup codes.
tlb · 2h ago
It's also not very hard for scammers to get a SIM card for your number, unless you're using a carrier that specializes in not allowing SIM swapping attacks.
hocuspocus · 2h ago
I dislike SMS 2FA and services that use my phone number as a stable identifier, however SIM swapping is not really a thing in most countries.
johnisgood · 1h ago
I do not know but I am given a code via SMS for each operation, and each SMS costs more than what a regular SMS costs like, so the bank often deducts quite a lot of money from me for "SMS fee".
mindslight · 2h ago
I assume it shows up as a hAcKErS sToPpEd figure in a quarterly report where they pat themselves on the back for it along with CAPTCHA hassling, blocking browsers that are too secure, network address bans, popups about "passkeys", forced password changes practically every login, etc. If they had any sense they wouldn't be pushing this nonconsensual trash to begin with.
vzaliva · 1h ago
"it turns out messages from 5 digit shortcodes often aren't supported over wifi calling."
This does not seems plausible. I live in urban area but do not have good cellural connection at home and my mobile phones are usually route calls via home Wifi. All SMS come through. It is just a low-lever transport and I doubt it cares about message size or numbers.
InfamousRece · 1h ago
Short code SMS goes through different providers than regular SMS, so the deliverability will differ.
clircle · 1h ago
Where does the trend of not capitalizing the first word in a sentence in techie blog posts come from?
Meleagris · 2h ago
Perhaps there’s a B2C offering to be made here. An SMS proxy, forwarding 2FA codes to people without SMS.
At this point it's pretty clear 2FA SMS is just a ploy to get PII customer data under the guise of security
bityard · 2h ago
The ONLY accounts I have that require SMS and offer no other 2FA are financial institutions. They already have more information on their customers than most other businesses I can think of. Heck, I WANT my bank to have my phone number so they can call me if there's ever a problem. I just want insecure SMS to stop being the only minor hurdle between a fraudster and my life savings.
Companies do SMS because their VP of security compliance demands 2FA and because it's easy and has mature existing third-party vendor support. No tinfoil hat needed for this one.
reginald78 · 1h ago
No, I think he's mostly right but it is a little more complicated. Most services demand a cell number verification on account creation for user tracking and identification under the guise of security for you. The SMS 2FA setup flow just helps push the user into coughing it up and helps sell the security cover story. Theoretically this helps prevent abuse, but there's no reason they have to abuse the data themselves after getting it for that. Its just that they will. They'll even lie to your face that they only use the number for security purposes and then use it for advertising anyway.
SMS 2FA is also quite expensive. In the US it's $0.0083 per SMS, which at bulk is going to add up quickly. Even before the war started, it was $0.70 to send an SMS to Russia. And then there's the premium SMS line fraud that's led to massive bills for some companies.
zkms · 3h ago
"Wi-Fi calling" (LTE over IP over wifi) often allows you to get SMS messages over wifi only, on an ordinary cell plan: https://support.apple.com/en-us/108066 (Android supports it too)
lxgr · 3h ago
The article mentions that they've encountered problems receiving messages from short codes via that.
fersarr · 1h ago
Sms 2fa is also really annoying for travellers that don't use roaming
novia · 3h ago
The part that was interesting to me in this article was that companies could somehow detect that the lady had a cellphone when previously the 2FA thing hadn't been a problem for her. I wonder if this was just poor timing or if places like financial institutions actually get an alert.
moffkalast · 1h ago
Along the same lines, am I the only one who thinks it's weird that when logging in on a desktop PC the average bank requires a:
- username
- password
- one time generated 16 digit number
- SMS confirmation
- email confirmation
- phone call with an associate
- retinal scan
- DNA sample
Whereas to log in on mobile all you potentially need is a 4 digit pin which a passerby could easily observe, then yank the phone from your hand?
johnisgood · 1h ago
And keep in mind you have everything stored on your phone, too.
neilv · 26m ago
Not only SMS 2FA, but in the past maybe couple years, many sites have been making their logins worse in many ways.
For example, I'm actually liking Walmart.com more than Amazon in some ways lately, but logging into Walmart.com takes minutes while I wait for the 2FA after I already password authenticate. So Amazon wins all the casual browsing and impulse sales, and by the time I do log in to Walmart.com, it's only because I know I want to order something from there specifically, and it's already feeling tedious.
Some off-the-cuff suggestions, since the worsening authentication experience really bugs me:
1. Present the email/username and password fields simultaneously, so the browsers like Firefox can fill out both fields. (A lot of site have started showing only the email/username to start, and also making that rely on non-login form field filling. And only after you type in your admin/email, because you don't form autofill in general, does it present
2. After user opts to authenticate with a password rather than SMS/email code, let them in, unless you're something like a bank or a medical provider. (Don't then make them do the SMS/email code anyway.)
3. If your mega online store handles HIPAA-sensitive data for some small percentage of visits, and you need 2FA for that, maybe only do the 2FA to upgrade the authentication confidence for session. (Or maybe the more sensitive data is on a different backend anyway, so as not to encumber all the developers implementing Wheaties logistics, with all the additional protections that are needed for medical records, nor to add additional weak links leading to leaks.)
4. When SMS/email 2FA is really necessary, send it immediately and reliably, and make it copy&pasteable. (Sometimes I wait minutes, and other times it doesn't come through at all. And I've even gotten email ones where competent-user text-selection picks up whitespace somehow, or even a weird unprintable Unicode character, which breaks the code entry when pasted.)
5. Those buttons to authenticate a variety of other sites are needlessly leaking information, and creating additional ways to compromise the account. (That's what you do if you want to reduce friction to first visits to your site, for which people aren't interested enough to create a password to use -- but not for logins from recurring customers.)
6. Don't prompt for "remember this browser?", and don't otherwise rely on the persistent tracking data deposited on the user's browser, across explicit authentication sessions, such as to decide whether to 2FA. For one reason, those persistent data mechanisms are overwhelmingly for shady abuse by the adtech/surveillance industry in shady ways, and are frequently cleared by privacy-conscious users. Any why is a bank, for example, complicating the UI, to ask ordinary users whether to lower their authentication security on this device, and expecting much sense out of that at all. Keep it simpler, more secure, and more responsible or respectable.
7. If you must support 2FA, make TOTP an option. And not TOTP-incompatible codes that requires installing your app, or that depends on some oddball third-party proprietary authenticator app/fob that seemed like a good idea at the time but is not a reason not to support TOTP. (You can still grandparent in the legacy proprietary 2FA, for those long-time users who've been using it, and be clever about not complicating the UI for those those dwindling users, nor for the increasing users using the more current open standard.)
andoando · 19m ago
Can we just go back to having passwords please. I hate this state of authentication on the web.
some_random · 3h ago
This is a really good point, "cell service will always be available" is a classic incorrect assumption that needs to be shattered. I do kinda wonder what the correct way forward is, I think it's silly that ISPs don't support this type of SMS over wifi but I have no clue why. Meanwhile TOTP apps are rightly pointed out to be too numerous with unclear trade offs, I'm surprised ios and android don't have native TOTP apps (afaik).
As an aside, I hate the nuance-less "SMS 2FA is insecure" line. It's the weakest 2FA form for sure, but it's still so much better than not having 2FA. Even if you support multiple options depending on your product it may very well make sense to stick with SMS as the default to reduce friction.
thesuitonym · 3h ago
I'm pretty sure they both do have TOTP but it's not well documented that it even exists, and it's difficult for regular users to use. In iOS it in the Passwords app (née Keychain) and in Android I think it's buried in the settings app of all places. People don't know it exists and don't know how to use it, and even if they did, unless you're already using it for password management, it's difficult to know how to find it. Instructions usually default to a single authenticator app, like Google Authenticator or Microsoft Authenticator, so people end up with multiple apps (Not to mention the garbage adware that always pops up in app store search). And half the time the instructions simply say "Your authenticator app," which doesn't help Joe Schmoe who has no clue where he saved that OTP.
reginald78 · 1h ago
Many of the big companies seem to really want you to use their app so there's this big game of smoke and mirrors to avoid saying it is TOTP or what they're actually doing. And of course they make it as big of a pain to export your codes as they can get away with. Then they hide behind it being complicated and that is why they have to do this to help grandma, but much of complexity is due to their obfuscation.
hocuspocus · 3h ago
> I'm surprised ios and android don't have native TOTP apps (afaik).
They do.
Google's Authenticator is as close as it gets to a native Android app, and your secret keys are sync'ed in Google's cloud for a while now (it's a shame they waited so long).
Apple's Keychain has supported TOTP for ages too.
That said OTPs over RCS instead of SMS are a major improvement if you don't mind your phone number being used as an identifier.
vbezhenar · 3h ago
Google Authenticator is a separate app that you need to download from Google Play. Native android solution is Google Password app which is pre-installed (at least on Pixel) and its functionality is extremely rudimentary even compared to Apple Passwords. No TOTP support there.
I think that Google does not care about security for their users, because their passwords app is clearly some intern work, not something really well thought. They just slapped it to mark a checkbox in their "Chrome password autofill" TODO list and moved on to a more pressing issues like implementing user tracking and extracting more ads revenue. Apple had similar issues for years, but I think that their recent releases significantly improved.
fullstop · 2h ago
Until recently, Google Authenticator codes could not be backed up or transferred to a new phone. When I replaced my Android device, I had to re-register every TOTP code that I had in Google Authenticator. This led me to Authy, and later on to Yubikey since the code is removed from my phone completely.
hocuspocus · 2h ago
I'm pretty sure you could always manually export a QR code for every one of your secret keys.
fullstop · 2h ago
This was around 2016 and that was not an option at the time.
"By design, there are no account backups in any of the apps."
hocuspocus · 2h ago
My bad, that's too far in the past. I've changed Android phones several times between 2017 and 2020, and I remember using the QR codes exports.
hocuspocus · 3h ago
It's not ideal but there's been some progress.
I'm not sure we can blame Google for not pushing their Authenticator more, most services have been dead set on SMS and are now slowly moving to Passkeys, probably for the best.
hedora · 2h ago
Passkeys are going to make these problems much worse.
What do you do if google/ms/apple won’t let you log in, or you lose a device, or you lose your phone?
If the answer is “there’s an account recovery path involving a password”, then just accept passwords!
If the answer is “recover the passkey provider account”, then that forces everyone to have a single password / security question / whatever that grants access to all their accounts.
vbezhenar · 2h ago
I don't want Google to push their Authenticator, I want Google to retire their Authenticator, implement TOTP codes in their Passwords app (it's very trivial to implement) and implement passkeys on Google Chrome Linux (now those are not trivial, but if they push passkeys so hard, they could at least implement them). I also want to be able to store any items in Google Passwords manager, like ssh username/password, my bank cards, software serial codes and other sensitive information (again trivial to implement, just provide me multiline textedit with notes). I also want password generator in their app. I also want to configure multiple domains for entry, like microsoft.com + live.com. Are those big requests? I don't think so.
_hyn3 · 2h ago
Trying removing consent to receive text messages on that number, or that it's only a land line and only phone calls are accepted.
You might even try to block incoming SMS. In fact, you might also try a forward with Twilio or free Google voice number, since a lot of SMS TOTP refuse to with with those numbers :)
I've even had success removing my phone number entirely from certain types of accounts, but sometimes I had to deliberately break the account (eBay) and then it tries to get you to confirm on each login which you can sometimes bypass by changing the URL or clicking the company logo.
Be sure to have strong security in other ways; strong, non repeated passwords.
But this is truly insane. Large banks don't even offer the option of TOTP but instead require far more insecure SMS. Maybe they'll offer RSA dongles, because they never bothered to remember when they all got completely leaked ten years ago or how they accepted $10M to completely compromise their constants.
What can you say, large enterprises are behind the security eight ball, as always! It's a tale as old as time.
I travel constantly and this is a HUGE issue for me. It used to work with VOIP but now everyone wants to make sure they have maximum sellable data so they require mobile numbers. Also, clownworld security, which is totally bunk as an excuse on this.
charcircuit · 1h ago
Why does SMS need a cell tower booster but the internet router doesn't need a cell tower booster? SMS will be much less bandwidth so it should be easier to receive than a whole web page.
KennyBlanken · 2h ago
The point of SMS 2FA is not security and never has been.
The point of SMS 2FA is tracking.
It's to force you to give them your phone number, for their own marketing, but also selling your customer profile to companies like Palantir.
This also makes the government happy, because they can scoop up your SMSs and they get a nice handy list of every service you use which makes warrants easier, but also gives them info about when you log in or do other actions on those accounts.
SMS 2FA costs these companies far more than TOTP would, but they still use SMS 2FA. That tells you everything you need to know...
Joel_Mckay · 2h ago
1. 2FA over SMS is only $23 away from a compromised phone service
2. People love binding individual accounts to specific IP addresses, and large marketing firms especially like websites that use free DNS service to quietly track said users across the session
3. Much like DRM, the account auto constrains a single user to a single IP. Makes sense... unless you run a business account with a dozen people clearing a shared inbox
4. SMS inbox phone numbers are $2.75, and that requirement is bypassed if the company smartphone hardware/emulation is in use for account "recovery"
5. SIM hijacking and email server snooping is far more common than people like to admit
6. People feel safer, but it only increases the CVE difficulty level slightly above third world skill levels
This is why we can't have nice things =3
kawsper · 3h ago
Not only mountain people, try staying in Wales or inner parts of London, good luck receiving your 2FA code.
malcolmgreaves · 2h ago
Why can’t people take the time to use grammar correctly? This post is illegible.
jaoane · 3h ago
When you choose an eccentric lifestyle you should accept the loss of certain features.
pyrale · 3h ago
> When you choose an eccentric lifestyle
Many "eccentric" lifestyles are not chosen.
For instance not owning a smartphone or not having access to power easily is not necessarily limited to well-off tech-savv hipsters who want to make a statement, homeless people, older people in less connected areas or people in developing countries can also be in that situation.
When you make your services depend on specific access, and you give people without it no escape hatch, your service becoming successful usually means worsening access for people that have fewer means to adapt.
modeless · 3h ago
Homeless people get free smartphones and free service in the US. Living in very rural areas is in fact a lifestyle choice. Not all choices need to be subsidized.
arp242 · 35m ago
It just saddens me that you can be so devoid of empathy.
pyrale · 3h ago
> Not all choices need to be subsidized.
Interesting choice of vocabulary.
You could decide not to serve people without also describing them as freeloaders in order to feel morally righteous about your choice.
modeless · 3h ago
People choosing to live in rural areas aren't freeloaders. Until they demand the rest of us subsidize them. The demand for subsidies is what makes a freeloader, not the lifestyle choice.
pyrale · 2h ago
My original message was simply here to remind people that technical decisions we make have consequences on who can use our services.
You were the one introducing this vocabulary (as well as claiming everyone living there does it by choice). Now you try to move the debate again with people "demanding" stuff. None of this vocabulary or framing exists in the original article, or in mine.
Let me clarify the question: why do you insist on framing this debate in a way that makes a moral claim about people's character?
jjulius · 2h ago
>Until they demand the rest of us subsidize them.
I think the discussion is less around "subsidizing" them and more why requiring a cellphone with 2FA to exist and do basic things is kinda stupid.
McGlockenshire · 2h ago
> Homeless people get free smartphones and free service in the US
Recently former homeless person here. The Republicans in Congress refused to renew the Lifeline program in 2023 and the replacement is objectively worse in every single way.
> Not all choices need to be subsidized.
Ah yes, being homeless, a choice. I hope it never happens to you.
dheera · 3h ago
We should support the rural lifestyle choice. For one, the food you eat comes from there.
modeless · 3h ago
Food doesn't come from remote mountainous areas. Farm fields may not have cell service but living way out there isn't required even for farmers. I grew up on a farm so it's funny when people on the internet try to educate me about farms as if I've never heard of them.
jjulius · 2h ago
>Food doesn't come from remote mountainous areas.
I must be imagining the farms that I pass in the mountains in the middle of nowhere when I go backpacking. Surely your argument isn't, "My farm was here, so it's impossible for other farms to be in different locales"?
modeless · 1h ago
Surely you aren't arguing "I once saw a farm in the mountains, therefore small remote mountain farms are critical to our food supply"?
jjulius · 1h ago
The large trucks being loaded with crops for delivery elsewhere should suggest that it contributes to the greater food supply, yes. Further...
>I once...
My phrasing did not suggest "one time" (the phrase was "I pass", suggesting regularity), and it's not just one single farm, it's a few, and I've passed them many times. I have to agree with someone else[1] about your using vocabulary that others haven't introduced - I question whether or not a good faith discussion can be had because of that. Have a good one!
It's rich for you to complain about me "using vocabulary" when your previous comment was trying to put words in my mouth that I did not say...
No comments yet
dheera · 2h ago
We should still be supportive of people who want to live in the mountains. I'd like to think that we as a society enable people to live how they want to live. Given that technology has allowed us to deploy broadband internet access pretty much anywhere, there is no good reason to deny them of e.g. web-based banking just because of some stupid SMS confirmation. Hardware 2FA keys are cryptographically superior AND usable by people in the mountains.
hedora · 2h ago
Exactly! Why should I subsidize sewers in town?
No comments yet
fullstop · 3h ago
I'm pretty sure that their mother lived there before SMS was a thing, it's not exactly eccentric. Especially in the USA. You're not seriously suggesting that she leaves her home because of poorly implemented 2FA?
dingnuts · 3h ago
the article is about a retired woman who lives twenty minutes from Asheville, NC.
The terrain is rugged there, but it is not an "eccentric lifestyle"
It is extremely typical, however, to see the most basic needs of Appalachian people ignored on the grounds of their perceived choice of lifestyle
just this weekend I endured yet another incest joke.. I bet you have one of those ready too
dboreham · 3h ago
There's plenty of locations with houses in Montana that have no cell service too.
dingnuts · 2h ago
the article isn't about them. Montana by and large is a lot less dense than Asheville NC, which is a small city surrounded by normal towns. Asheville would only seem eccentric if normal is San Francisco.
hedora · 2h ago
There’s no cell service in many places that are 20 minutes from Silicon Valley or SF.
Heck, there are places that are a 20 minute walk from Apple and Google HQ without cell service.
> port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi
That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do).
I really wish that were illegal. A phone number is a phone number.
> she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through.
Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised.
I can probably illuminate some things here. This is almost certainly the SMS API they're using. Your phone, and your network by extension, does not care if the phone is technically online - so those messages get received because they're literally sending in the blind (and if the recipient is offline, the message gets temporarily stored by the receiving carrier for around 3-7 days before it is discarded).
These SMS OTP systems validate "reachability" (using APIs like https://developer.vonage.com/en/number-insight/technical-det... and https://www.twilio.com/docs/lookup/v2-api/line-status) and will not send a message if a number is 'not' reachable. Unfortunately, as implied by the air quotes, these methods are not infallible. This is done to reduce the costs of sending the message (carriers charge a lot more for commercial customers) but this is definitely stupid for a already-validated number like in this case.
It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.
I was wondering about that, because I can't get google voice because I have google fi, so clearly it's using the same bank of numbers, but maybe once they are fi, they are ported to T-mobile instead of their own CLEC.
I registered it about 13 years ago. I didn't transfer it from a landline/cell phone, it was picked from a list of Google Voice numbers available in my area code. I've never had Fi.
It's inexcusable.
I really agree with it, but that’s probably their rationale.
Personally I don't put TOTP tokens into my password manager and keep a dedicated app for it, just in case my password manager is pwned.
Yes, a digital OTP generator is more susceptible in theory to theft or duplication than a hardware token.
Yes, the benefits of digital OTP are great compared to password only, more secure than SMS, and trivial to implement.
SMS-OTP, with all its downsides, allows attaching a message of who you're paying how much to the actual code.
*The bands acquired with the Sprint merger have service, but the cheap used phone I bought was pre-Sprint-merger and lacked those bands.
I have such a ported number and have no issues receiving SMS 2FA codes.
It pisses me off to no end. I use a few different banks and some are fine with google voice, others are not. One only allows customer service to send SMS tokens to google voice but not through the regular flow. In all but one case, they will happily robo call my google voice number and have a tts engine read me the same code that they didn’t want to SMS.
Security policy by rng, ffs!
Talk to your provider, explain to them you get poor service at your home or place of work, and they'll send you a free Internet-in cellular-out radio AP. She doesn't need a tower-based booster if she's got fiber/cable/DSL, those only serve to amplify weak signals and she's too many miles and too many mountain ridges away from the nearest tower, she wants something with RJ-45 input, a little GPS antenna so the cell supports e911 location data, and it will broadcast LTE (or now 5g) cellular data.
I work at a shop with metal walls located in a river valley. It's a cellular data black hole. People used to climb the hill up the driveway to make and take calls, but various people called their ATT, Verizon, and T-Mobile providers and all three shipped us femtocells. Mow the users and the contractors/customers who come to visit can't even tell that their phones have switched to data over our ISP instead of a tower, it just works - including 2FA codes and MVNOs.
She may have to switch to first-party Verizon service instead of using an MVNO.
(Fun trivia: Our office paid $XX,000 for AT&T MicroCells which wouldn't activate because they couldn't get GPS signal.)
A lot of office buildings have these in them. I think the personal ones are how they get around some of the issues with government requiring them to build networks to certain coverage. They just don't build it out and when someone complains they offer them one of these.
I have been using this setup for a few years now without any issues. Even when I am not roaming, I still have this setup on my primary phone. So when I am on my computer and need a SMS OTP I don't need to go find my phone, I receive it in email :-).
(Note : This doesn't work with MMS but I don't need them anyway)
Lately though, SMS works over WiFi calling and usually if I need a real SMS where Google Voice won't cut it, it can wait for WiFi...
I roam all the time in Europe and have roamed a lot outside of it, I have never had any trouble receiving any SMS?
SMS codes have been hit or miss, and this explains it well.
You can get service starting at $20 per month. Fi used to have good service in some mountain areas too, with US Cellular. Not sure what's going on with US Cellular right now though. Some kind of half acquisition by T-Mobile.
I always had problems with SMS until I got Google Fi. And that's a problem because, as the article here says, many banks insist on SMS these days. There are various services that give you a virtual number. But they always suffer from one of two problems: (1) VOIP numbers are 'blacklisted' by some banks for security reasons: they want a real cell phone number (2) I simply don't get SMSs in some cases some technical reason
Google Fi works everywhere. Even when there is no cell phone service: it will tunnel over WiFi.
Google shuts off the data on Fi after you've been outside the USA for a month. No problem, I'm happy to pay $25 a month for a 'dataless' connection that gives me SMS and voice.
To be somewhat more specific: while I travel extensively and am in the US often, I am often outside of it for more than a month at a time, and it appears that Google will shut off data outside the US if you use data outside the US for too long. If you are using a different SIM for the primary data connection, it appears that they won't even if you have it enabled as a backup.
* Tello
* Red Pocket
* Good to Go Mobile
If you’re looking for a real local phone number in the location you’re traveling to, then eSIM providers like Airalo can handle that (Airalo has “global plans” that support voice and SMS). Getting such a connection for voice and SMS, as compared to a data SIM alone, would be expensive. So you could get a data eSIM that works locally and use that for “WiFi” calling/SMS with the providers mentioned above.
The last time I checked if you wanted "cellphone is off" texting/voice (basically the old hangouts), you had to enable "fi syncing" which disabled rcs features. Is that still true? What url do you goto to do texts/voice? (i see hangouts.google.com redirects to google chat).
I guess this would be easier in a beighbourhood laundromat with local clients, but in a hotel with many foreigners it becomes a pain with so many dependencies needed to use the washer and dryer.
Requiring Bluetooth and an Internet connection on your phone suggests that that's exactly what they removed on their side. Quite clever, if true – why pay for network connectivity if you can just piggy back on your customers'? (Nevermind those customers without a smart phone and data plan...)
Let's put it like this: The old ones (with a display) definitely do, because they can send email notifications. I would be very much surprised if the new ones didn't. The main reason for requiring the app isn't connectivity to the outside world, it is that they can save money on the terminal screens, which get vandalized frequently in some areas. The internet connection is probably a fraction of the cost of replacing those touch screens every few months.
also was surprised to learn from the article that some carriers don’t support the 2fa 5 digit numbers over wifi calling/sms. when I travelled abroad recently that was such a life saver since my carrier supports it
2. Ask the cell phone company for a femtocell. These used to be called "AT&T Microcells" and they were cheap. I used one before cell service improved because I live in the mountains. But apparently AT&T don't make them any more and now they cost $2500.
https://www.waveform.com/products/verizon-network-extender-f...
3. Subscribe to mightytext.net so you can get SMS on your computer. I don't know if this works if your cell phone can't get signal; I use it because I find it easier to use my laptop keyboard to type SMS messages than to use my thumbs on my phone.
I'm building the opposite, using the modem and a Raspberry Pi to send me metrics from my cabin, but could easily work in reverse.
While prototyping I had it parse SMS messages I sent it.
Obviously not for everyone but we're on HN here...
It can't – how would it?
The only entity that can forward texts is the carrier, and I doubt that that service is integrated with all US carriers to somehow get them forwarded (which is technically quite difficult for various legacy protocol reasons).
Apple's satellite messaging service is the only solution I know of that can somehow hook into carriers' SMS home router (or IMS equivalent) infrastructure to intercept and out-of-band forward SMS.
Are you sure it actually does this?
I thought it was a pseudo-carrier that could speak MAP / Diameter, and just pretended you were roaming with them when you used satellite connectivity, perhaps with the original carrier's knowledge and consent.
As far as I understand, that's how this kind of service usually gets implemented.
Would that approach also allow the extra functionality they seem to be offering, such as only recently messaged numbers and emergency contacts being able to send messages to satellite users, though? I suppose they could just reject all MT-Forward-SM with sender numbers they don't like?
> As far as I understand, that's how this kind of service usually gets implemented.
Do you have any other examples for solutions like this? Are you thinking of (pre-VoWifi) carrier apps or services that could receive texts, sometimes on multiple devices?
Anyway, it’s probably possible to make a service like that. You might need to route through a country with permissive laws.
Allowing SMS interception without the home network's consent seems like a quick way to get offboarded as a roaming partner.
Your carrier is already capable of redirecting your SMS messages to other carriers, that's what they do when you're abroad and roaming with a foreign operator. You could make a fake carrier that speaks the right protocols on the roaming side, but communicates with the customer over the internet (using an API or a proprietary app) instead of LTE or GSM.
This would essentially work like an SS7 redirection attack, but with the full knowledge and consent of the "victim." You could alleviate the security impact here by requiring SIM card authentication, just like a normal carrier does, which could be performed through the internet and an USB reader just fine.
Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. I wonder whether a gray-hat route would be possible here, especially if the company was outside US jurisdiction.
This has been essentially been tried multiple times, e.g. by FreedomPop and Republic Wireless.
This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't.
You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.
SMS needs your number, your data is more valuable if marketers can assign your real name to your data. or aggregating all data about you, phone number helps with that.
This is mostly a red herring because most of the places that require SMS TOP already have your full name/address (eg. financial institutions, healthcare providers) or are in a position to intercept communications that they can infer that information (eg. google). If apps/sites like tiktok wants my phone number for 2fa, they can fuck off, or get a burner number.
"Most"? maybe "a troubling few"?
Phone verification is absolutely a widely exploited data mining opportunity, I don't see how it's a red herring at all. It's one of the worst surveillance mechanisms we live with today, only partially waved away with the 2000's concept of burner numbers.
same problem with signal messenger or facebook messenger building databases of numbers and contacts. neo4j clone from palantir.
"Enter this code only if you want to pay <amount> to <merchant>" is much more secure than "enter your TOTP here", which is a lot like issuing a blank check in comparison (and in fact required by regulation in the EU, for example).
Not even WebAuthN provides that property on a compromised computer; for that, you'd need something like the SPC extension [1] and a hardware authenticator with a small display.
That's unfortunately why we're currently stuck with proprietary bank confirmation apps that can provide it. I really wish there was a vendor-neutral standard for it, but given how push notifications work (or rather don't work) for federated client apps, I'm not holding my breath.
[1] https://www.w3.org/TR/secure-payment-confirmation/
This isn't great, but better then SMS and having to have a separate app for each authenticating service though.
A vendor neutral service would be a lot nicer.
SMS 2FA is terrible though.
> I still think they have a good chance in court
Can you share the law you think was violated?
On what grounds?
Luckily this is starting to change. Apple's Passwords app does TOTP out of the box.
Though I am mystified why Google Authenticator doesn't come pre-installed in Android.
It didn't need bells and whistles and constant security updates, but it took 13 years for it to get cloud-sync support so you could backup your codes.
The 4G router also has the benefit of being able to use externally mounted antennas. Which might help in low signal areas.
Not ideal, but might at least be a solution for some people.
[1]: https://wiki.teltonika-networks.com/view/SMS_Forwarding_Conf...
> she usually doesn't even have service 100 meters down the road.
An outdoor antenna would be better, but yeah more of a pain. I guess it really depends on how badly someone wants SMS.
PUSH approval could be used instead but then you need to download an app for every service you use, which isn't very convenient.
PASSKEYS offer a solution which will work on both web and mobile and don't require you to download an app for every service. But it's a new concept that people need to learn so how fast they will be adopted is yet to be seen.
The server just needs to remember which TOTP codes have been used and to reject after the first use.
The code is no longer sensitive after it has been used, so jam it in a database that can expire tuples after a few minutes or stick it in an login audit table if you have one.
SMS 2FA tied to your mobile number sucks if it doesn’t support Google Voice, especially when traveling internationally and your SIM card isn’t in your phone.
Email 2FA usually works, but I just find it annoying.
App-specific push notifications mostly work, but it’s hard to debug if you don’t get the notification. For example, I recently bought a new phone and all of my apps were reinstalled when I restored from a cloud backup. For some reason app notifications didn’t work until I uninstalled & reinstalled the apps. And reinstalling the apps was a bit confusing because some of the apps were not available in the app store based on my physical location in a different country at the time.
The Secure Payment Confirmation [1] extension to WebAuthN supports using passkeys on third-party sites (think merchant checkouts) and including signed structured messages (think "confirm payment of <amount> at <merchant> on <today>").
It wouldn't be crazy to imagine authenticators with small OLED displays to provide an end-to-end secure channel for displaying that information, similarly to how cryptocurrency hardware wallets already do it.
Of course, this would require a certain popular hardware and software manufacturer with a competing payment solution to implement the extension...
[1] https://www.w3.org/TR/secure-payment-confirmation/
I'm often traveling outside of the US, and my AT&T prepaid line most definitely does not roam outside of CAN/US/MEX. I spend the bulk of my time in WiFi calling mode. I have never had any issues receiving or sending SMS over WiFi, including to short codes.
No comments yet
If I had stayed there longer, I might have found a better solution for my personal situation, but the experience as it was left me pretty uncomfortable with mandatory SMS 2FA as a general security tool. I'm sure there are many other people running into similar edge-cases.
Maybe verizon is incompetent or malicious?
What happens if you’re overseas or in a cell dead spot with wifi? The latter happens to me all the time in the city.
It’s amazing how many hip “use your phone to order!” restaurants are in cell dead spots, and have set up wifi access points as a workaround.
This does not seems plausible. I live in urban area but do not have good cellural connection at home and my mobile phones are usually route calls via home Wifi. All SMS come through. It is just a low-lever transport and I doubt it cares about message size or numbers.
It would require a lot of trust.
Similar and related discussions on this post:
https://news.ycombinator.com/item?id=43976359
https://www.daito.io/2fa-via-sms/
Companies do SMS because their VP of security compliance demands 2FA and because it's easy and has mature existing third-party vendor support. No tinfoil hat needed for this one.
https://www.eff.org/deeplinks/2019/10/twitter-uninentionally...
https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...
- username
- password
- one time generated 16 digit number
- SMS confirmation
- email confirmation
- phone call with an associate
- retinal scan
- DNA sample
Whereas to log in on mobile all you potentially need is a 4 digit pin which a passerby could easily observe, then yank the phone from your hand?
For example, I'm actually liking Walmart.com more than Amazon in some ways lately, but logging into Walmart.com takes minutes while I wait for the 2FA after I already password authenticate. So Amazon wins all the casual browsing and impulse sales, and by the time I do log in to Walmart.com, it's only because I know I want to order something from there specifically, and it's already feeling tedious.
Some off-the-cuff suggestions, since the worsening authentication experience really bugs me:
1. Present the email/username and password fields simultaneously, so the browsers like Firefox can fill out both fields. (A lot of site have started showing only the email/username to start, and also making that rely on non-login form field filling. And only after you type in your admin/email, because you don't form autofill in general, does it present
2. After user opts to authenticate with a password rather than SMS/email code, let them in, unless you're something like a bank or a medical provider. (Don't then make them do the SMS/email code anyway.)
3. If your mega online store handles HIPAA-sensitive data for some small percentage of visits, and you need 2FA for that, maybe only do the 2FA to upgrade the authentication confidence for session. (Or maybe the more sensitive data is on a different backend anyway, so as not to encumber all the developers implementing Wheaties logistics, with all the additional protections that are needed for medical records, nor to add additional weak links leading to leaks.)
4. When SMS/email 2FA is really necessary, send it immediately and reliably, and make it copy&pasteable. (Sometimes I wait minutes, and other times it doesn't come through at all. And I've even gotten email ones where competent-user text-selection picks up whitespace somehow, or even a weird unprintable Unicode character, which breaks the code entry when pasted.)
5. Those buttons to authenticate a variety of other sites are needlessly leaking information, and creating additional ways to compromise the account. (That's what you do if you want to reduce friction to first visits to your site, for which people aren't interested enough to create a password to use -- but not for logins from recurring customers.)
6. Don't prompt for "remember this browser?", and don't otherwise rely on the persistent tracking data deposited on the user's browser, across explicit authentication sessions, such as to decide whether to 2FA. For one reason, those persistent data mechanisms are overwhelmingly for shady abuse by the adtech/surveillance industry in shady ways, and are frequently cleared by privacy-conscious users. Any why is a bank, for example, complicating the UI, to ask ordinary users whether to lower their authentication security on this device, and expecting much sense out of that at all. Keep it simpler, more secure, and more responsible or respectable.
7. If you must support 2FA, make TOTP an option. And not TOTP-incompatible codes that requires installing your app, or that depends on some oddball third-party proprietary authenticator app/fob that seemed like a good idea at the time but is not a reason not to support TOTP. (You can still grandparent in the legacy proprietary 2FA, for those long-time users who've been using it, and be clever about not complicating the UI for those those dwindling users, nor for the increasing users using the more current open standard.)
As an aside, I hate the nuance-less "SMS 2FA is insecure" line. It's the weakest 2FA form for sure, but it's still so much better than not having 2FA. Even if you support multiple options depending on your product it may very well make sense to stick with SMS as the default to reduce friction.
They do.
Google's Authenticator is as close as it gets to a native Android app, and your secret keys are sync'ed in Google's cloud for a while now (it's a shame they waited so long).
Apple's Keychain has supported TOTP for ages too.
That said OTPs over RCS instead of SMS are a major improvement if you don't mind your phone number being used as an identifier.
I think that Google does not care about security for their users, because their passwords app is clearly some intern work, not something really well thought. They just slapped it to mark a checkbox in their "Chrome password autofill" TODO list and moved on to a more pressing issues like implementing user tracking and extracting more ads revenue. Apple had similar issues for years, but I think that their recent releases significantly improved.
edit: the app used to be open source: https://github.com/google/google-authenticator-android/
"By design, there are no account backups in any of the apps."
I'm not sure we can blame Google for not pushing their Authenticator more, most services have been dead set on SMS and are now slowly moving to Passkeys, probably for the best.
What do you do if google/ms/apple won’t let you log in, or you lose a device, or you lose your phone?
If the answer is “there’s an account recovery path involving a password”, then just accept passwords!
If the answer is “recover the passkey provider account”, then that forces everyone to have a single password / security question / whatever that grants access to all their accounts.
You might even try to block incoming SMS. In fact, you might also try a forward with Twilio or free Google voice number, since a lot of SMS TOTP refuse to with with those numbers :)
I've even had success removing my phone number entirely from certain types of accounts, but sometimes I had to deliberately break the account (eBay) and then it tries to get you to confirm on each login which you can sometimes bypass by changing the URL or clicking the company logo.
Be sure to have strong security in other ways; strong, non repeated passwords.
But this is truly insane. Large banks don't even offer the option of TOTP but instead require far more insecure SMS. Maybe they'll offer RSA dongles, because they never bothered to remember when they all got completely leaked ten years ago or how they accepted $10M to completely compromise their constants.
What can you say, large enterprises are behind the security eight ball, as always! It's a tale as old as time.
https://www.wired.com/story/the-full-story-of-the-stunning-r...
https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill...
The point of SMS 2FA is tracking.
It's to force you to give them your phone number, for their own marketing, but also selling your customer profile to companies like Palantir.
This also makes the government happy, because they can scoop up your SMSs and they get a nice handy list of every service you use which makes warrants easier, but also gives them info about when you log in or do other actions on those accounts.
SMS 2FA costs these companies far more than TOTP would, but they still use SMS 2FA. That tells you everything you need to know...
2. People love binding individual accounts to specific IP addresses, and large marketing firms especially like websites that use free DNS service to quietly track said users across the session
3. Much like DRM, the account auto constrains a single user to a single IP. Makes sense... unless you run a business account with a dozen people clearing a shared inbox
4. SMS inbox phone numbers are $2.75, and that requirement is bypassed if the company smartphone hardware/emulation is in use for account "recovery"
5. SIM hijacking and email server snooping is far more common than people like to admit
6. People feel safer, but it only increases the CVE difficulty level slightly above third world skill levels
This is why we can't have nice things =3
Many "eccentric" lifestyles are not chosen.
For instance not owning a smartphone or not having access to power easily is not necessarily limited to well-off tech-savv hipsters who want to make a statement, homeless people, older people in less connected areas or people in developing countries can also be in that situation.
When you make your services depend on specific access, and you give people without it no escape hatch, your service becoming successful usually means worsening access for people that have fewer means to adapt.
Interesting choice of vocabulary.
You could decide not to serve people without also describing them as freeloaders in order to feel morally righteous about your choice.
You were the one introducing this vocabulary (as well as claiming everyone living there does it by choice). Now you try to move the debate again with people "demanding" stuff. None of this vocabulary or framing exists in the original article, or in mine.
Let me clarify the question: why do you insist on framing this debate in a way that makes a moral claim about people's character?
I think the discussion is less around "subsidizing" them and more why requiring a cellphone with 2FA to exist and do basic things is kinda stupid.
Recently former homeless person here. The Republicans in Congress refused to renew the Lifeline program in 2023 and the replacement is objectively worse in every single way.
> Not all choices need to be subsidized.
Ah yes, being homeless, a choice. I hope it never happens to you.
I must be imagining the farms that I pass in the mountains in the middle of nowhere when I go backpacking. Surely your argument isn't, "My farm was here, so it's impossible for other farms to be in different locales"?
>I once...
My phrasing did not suggest "one time" (the phrase was "I pass", suggesting regularity), and it's not just one single farm, it's a few, and I've passed them many times. I have to agree with someone else[1] about your using vocabulary that others haven't introduced - I question whether or not a good faith discussion can be had because of that. Have a good one!
[1]https://news.ycombinator.com/item?id=43985331
No comments yet
No comments yet
The terrain is rugged there, but it is not an "eccentric lifestyle"
It is extremely typical, however, to see the most basic needs of Appalachian people ignored on the grounds of their perceived choice of lifestyle
just this weekend I endured yet another incest joke.. I bet you have one of those ready too
Heck, there are places that are a 20 minute walk from Apple and Google HQ without cell service.