Even the U.S. government is telling Americans to use encrypted apps.
  • randon31415@lemmy.worldEnglish
    281·
    14 hours ago

    Authentication for my work email: Enter 28 character password, receive sms, enter message, log in

    Authentication for my Battle.net account:

    -Enter email made before 2000 because they don’t let you change email

    -Enter password

    -Get rejected

    -Solve CAPTCHA

    -Try backup passwords, get rejected

    -Request new password

    -Send request to 24 year old email

    -Try to log on to 24 year old email, email is suspicious and sends Authentication request to my newer email

    -Open newer email, Authenticate older email

    -open old email, Put in code to battle.net

    -Battle.net requests Authenticator code from Battle.net app

    -Open battle.net app (no requests)

    -Try manual code, doesn’t work

    • Realize Battle.net app Authenticator not connected

    -Try to connect Battle.net app Authenticator to account

    -Realize you cannot connect Authenticator without signing in AND signing in requires Authenticator

    -Close Battle.net app

    -Open Blizzard Authenticator

    -Close warning that this app got depreciated in January

    -Enter manual code

    -it works

    -Attempt to change password to password I first attempted

    -Won’t let me use same password

    -Try logging in using that password

    -Still doesn’t work - Solve one more CAPTCHA

    -Change password to backup password and back to original password - have to solve 2 more Captchas

    -Finally works

    -Log in

  • communism@lemmy.mlEnglish
    231·
    2 days ago

    I wish Signal stopped using it. I know you can set a Signal PIN but a lot of the non-techy friends I speak to on Signal probably wouldn’t think to, or look through the settings (not that you need to be “techy” to set it, but you know the kind of learned helplessness most people have about tech). At least a prompt for all users to set an account PIN so their account can’t just be stolen by anyone with their SIM card.

    • EngineerGaming@feddit.nlEnglish
      5·
      2 days ago

      Another thing is that even if you set a PIN, you’d still have to log into your account relatively regularly so that if you lose access to your number, you wouldn’t lose an account. It’s logical, given that numbers are reused… But that means that if you want to register without effectively tying your account to your ID (KYC when buying numbers is mandatory in a lot of the world, remember!), you’d have to pay for another phone bill (expensive given that the number’s practically doing nothing!) or use a one-time rental… Which guess what, puts your account at constant risk!

      • ChillPill@lemmy.worldEnglish
        22·
        2 days ago

        They abandoned letting you use the Signal app to send and recieve SMS. You still need to get a code via SMS to activate your Signal account. I believe this is what they are referring to.

        • communism@lemmy.mlEnglish
          7·
          2 days ago

          Yep, I was referring to that. You can stick someone else’s SIM in your phone and log into their signal account if they’ve not set a Signal PIN. You don’t see message history but new messages to that person will go to you.

      • ERROR: Earth.exe has crashed@lemmy.dbzer0.comEnglish
        1·
        11 hours ago

        Security against foreign hackers, of course

        (But with the additional purpose of securing the #LandOfTheFree against those pesky #Terrorists, of course. Who’s a terrorist? Why of couse that’s anyone who dares to criticize the government ahem I mean… make threats against the United States of America 🇺🇸🦅)

    • Routhinator@startrek.websiteEnglish
      691·
      2 days ago

      The problem for me is that most Canadian Banks give you the choice of SMS or their shitty adware filled bank app that relies on Google Play Services and wont implement TOTP so I can use a true MFA app. And Im done with being forced to accept user policies I don’t agree with to do shit, and most of all done with Google Play Services on my device 😑

      • oldfart@lemm.eeEnglish
        11·
        2 days ago

        My bank prides itself being the first in the country to support yubikeys for 2fa. I was so happy until i learned it’s just for logging in, transactions are still confirmed by SMS or their app. And security experts all say it’s better this way, using a regular 2fa solution would be insecure because you wouldn’t know what you’re confirming.

        There really is no hope.

          • oldfart@lemm.eeEnglish
            4·
            2 days ago

            I’m not defending that madness, but that device doesn’t show who is the recipient. The argument was that this is protection against phishing sites pretending to be a bank, proxying your connection but sending it to a different recipient.

            Makes one wonder how much the user has to fuck up to end in such a scenario, and of it’s really worth transmitting everyone’s financial data in almost plain text over the air for this

      • john89@lemmy.caEnglish
        7·
        18 hours ago

        Should be illegal to put ads in something as crucial to day-to-day life as a banking app.

        If it’s not illegal, then everyone is going to do it and we won’t have the “choice” that crapitalists love to tout so much.

        • Routhinator@startrek.websiteEnglish
          11·
          14 hours ago

          Its supposed to be illegal for banks to be in “sales” but my wife was working for BMO and they were forcing her to prioritize outbound cold calls ans upselling products the customer didnt need and would clearly be bad for their financials as a Personal Banking Assistant. The conflict of interest was so great it stressed her right the fuck out and she had to take leave and start therapy. Her MS also spiked likely due to the stress levels. She was there to help people, and she made the bank earn loyal customers and they willing got more products from the bank because she helped them. She was the top performer at the bank if she just let her do the job she was there to do, but instead her boss started ragging on her daily about her cold calling numbers and forcing her to cancel necessary appointments and focus time to deal with customer requests and instead prioritize sales.

          In the end her numbers dropped, her customer satisfaction dropped, and her MS got worse from the stress and she’s now on long term leave, uncertain if she’ll recover her focus and able to go back to work. Her neurologist has said she cannot go back for now.

          Not sure how that bullshit helped the bank, but I can sure see how I didn’t, and I may be wrong but I think there are laws against it.

          Also worth noting that this change in tactics happened right at the same time BMO took all their “we’re here to help” signage down. Brings so many memories of Google dropping the “don’t be evil”. Everything that came after in both cases was shit.

      • HellsBelle@sh.itjust.worksEnglish
        21·
        2 days ago

        Adding to this that my Canadian bank just updated their app and it doesn’t work with my older phone. So my only option is to use online services with SMS/call verification.

        It’s such a joy to know that my bank, who made $40.670 billion last year, takes care of every customer equally.

      • sugar_in_your_tea@sh.itjust.worksEnglish
        13·
        2 days ago

        This is the main reason I switched to Fidelity here in the US. It’s a brokerage, but it does basic bank things, like checks, debit card, etc, and they support SymantecVIP, which works w/o Google Play Services. TOTP support really isn’t that hard, I don’t understand why banks are so slow in adopting it…

        • dan@upvote.auEnglish
          1·
          1 day ago

          In case you weren’t aware, Symantec VIP is just TOTP-OATH in a fancy coat. You can extract the secret and use it with any TOTP app. I use Authenticator Pro (now called Stratum) because it’s open-source and has a watch app.

          • dan@upvote.auEnglish
            11·
            1 day ago

            I’ve got one. It’s nice. The cash is automatically invested in a money market account, which is a bit like a high yield savings account.

          • sugar_in_your_tea@sh.itjust.worksEnglish
            4·
            2 days ago

            They’re fantastic. :)

            The only negative stories I’ve heard are from people who really push the boundaries, like people day trading and whatnot. If you’re a regular user looking for a bank alternative, you should be good.

            Just know their branches don’t really have any banking services, so you can’t go there to withdraw or deposit cash, get a cashier’s check, etc. I keep an account w/ a local institution and transfer money as needed for banking services.

            • dan@upvote.auEnglish
              2·
              1 day ago

              I had a negative experience when initially setting up my account, because of TikTok. This group of kids who called themselves “Fidelity Boyz” discovered that you could deposit a fake check and immediately withdraw the money.

              So many people did this that they had to severely lock things down. For most customers, money transferred in either via check or via ACH pull (telling Fidelity to take the money from an account at another bank), was subject to a 16 business day (three weeks and one day) hold. Direct deposits (e.g. paychecks) were not affected, and ACH pushes (when you tell another bank to send the money to Fidelity) were eventually fine too.

              It was a big pain. The money I transferred was in limbo for a long time, after I had already switched all my auto-pays over to Fidelity, so I had to switch them all back until the money cleared.

              Now that that’s over, it’s great. I love that they reimburse ATM fees worldwide, and I’m a big fan of their basket portfolios product since it makes it so easy to rebalance a portfolio. Saves me from having to manually do a bunch of calculations, and I love that it has a fixed monthly price instead of being percentage based like roboadvisors.

        • ipkpjersi@lemmy.mlEnglish
          11·
          2 days ago

          The issue is, banks are only going to do what they’re required to do by law. The government is run by dinosaurs who don’t know what computers are, let alone what TOTP is.

          • sugar_in_your_tea@sh.itjust.worksEnglish
            11·
            2 days ago

            No, they’re only going to do what they’re required to do by their insurance. The law is an option, but if insurance costs go way up if they don’t have proper MFA, they’ll get MFA.

        • Routhinator@startrek.websiteEnglish
          1·
          2 days ago

          Now you’ve got me wondering about this for Canada. Would be a pita to move mortgage and investments, but there must be a better way than the big banks.

  • umbrella@lemmy.mlEnglish
    271·
    2 days ago

    of course it is. forced 2fa BY SMS OF ALL THINGS is one of the stupidest ideas

    • capital@lemmy.worldEnglish
      14·
      2 days ago

      I assume businesses only jumped at the chance to enable SMS 2FA to get their greedy little fingers on our phone numbers.

      • WhatAmLemmy@lemmy.worldEnglish
        2·
        1 day ago

        It was the simplest/cheapest form of 2FA to implement. Grandma will never understand how to setup TOTP.

        Capitalism requires regulations, otherwise it will ALWAYS do what is cheapest or most profitable, regardless of how dangerous or destructive.

    • sugar_in_your_tea@sh.itjust.worksEnglish
      10·
      2 days ago

      Even stupider is supporting hardware keys for MFA, but having SMS fallback which can’t be disabled (looking at you, Vanguard). I’d much rather have email as my second factor than SMS, and I literally abandoned a bank (Ally) for removing email as an alternative to SMS.

  • archchan@lemmy.mlEnglish
    445·
    2 days ago

    I hate forced 2FA that you can’t disable anyway. I don’t want to waste time waiting for an insecure text, I don’t want to input an unencrypted code you sent to my email, I don’t want to click your damn notification that runs through Play Services, and no I’m not enrolling in passwordless auth. I don’t need to be babied into securing my accounts. Any account I do actively and willingly secure is already using TOTP. Let me put in my username and password, then kindly fuck off.

    • Charlatan@lemm.eeEnglish
      191·
      1 day ago

      Yeah. So you, myself, and some others are the exception to the rule. But, you can’t look at it that way because its a ‘lowest common denominator’ problem. The least secure of us means we are all only as secure. Others need to be hand held.

      It’s definitely time to raise all boats and drop SMS 2fa like a hot rock.

      • rottingleaf@lemmy.worldEnglish
        3·
        1 day ago

        The most natural authentication mechanism for humans is a key. That thing you carry with yourself. A physical key containing, well, the actual secret (shouldn’t be retrievable, should be used for decrypting access request and signing the response) that, maybe combined with your password (another natural for humans authentication mechanism) or maybe, yes, TOTP, gives you access.

        Like those “security keys” Imperial officers in Jedi Outcast carry with them. Maybe a bad example.

        Phone numbers are used as identifiers because governments like it, nerds don’t like it, and normies explicitly like what nerds don’t like and also want everything to be insecure, they call it “having nothing to hide”.

        Also “normal and social” people have that idea that their social prowess is more elegant, smarter at ensuring their security that those dumb and boring nerd technical solutions. So them always choosing things logically opposite of sane, like social media instead of forums, and phone numbers instead of any other identifier, is literally a matter of principle. It’s really not that hard to use something else. They do the stupidest possible thing technically to prove a point that you only have to do the smart thing socially. I mean, in Galileo Galilei’s case the other side of the disagreement is generally considered right, but that’s not an argument effective in society.

        I should admit that I’ve been doing the opposite - the stupidest possible thing socially to prove a point that only technical sense matters, which is why nobody would send me encrypted mail except Facebook with its notifications, and nobody would write me in Tox, and nobody would even contact me via XMMP. Which is why I’m now using TG, VK, FB, WA and Signal for communication, of these Signal is secure, and WA is kinda better than the rest of them.

      • Kairos@lemmy.todayEnglish
        32·
        1 day ago

        You can apply this logic to nearly anything with very bad consequences.

    • dan@upvote.auEnglish
      2·
      1 day ago

      is already using TOTP.

      A lot of things are moving to phishing-resistant technologies like FIDO2/WebAuthn or passkeys. All my important accounts, like my password manager, are secured using Yubikeys (one that I keep with me and one as a backup in a secure place).

  • someguy@pleroma.someotherguy.xyz
    2231·
    2 days ago

    @return2ozma @technology
    10 years ago, the Feds wanted backdoors to all of phones so they could read all of our text messages. Now, the Feds want everyone not to use software that has backdoors so the Chinese cannot read our phones. The Feds don’t want competition.

  • Edieto12@lemmy.caEnglish
    141·
    2 days ago

    id take email Authentication over sms Authentication if there was only them 2 let me use my 2facter app for the love of god plz i hate how banks use sms its like come on man

    • Screen_Shatter@lemmy.worldEnglish
      17·
      2 days ago

      SMS spoofing and SIM swapping have been around for ages. It was never secure and that’s always been known. The number of companies that rely on it despite sending me a zillion other fucking useless emails is too damn high! Email, or better yet, an authenticator app, are far more secure. Not perfect, but better.

        • Screen_Shatter@lemmy.worldEnglish
          3·
          1 day ago

          https://en.m.wikipedia.org/wiki/SMS_spoofing

          So, it’s not that the message itself is insecure, but the inability to verify the sender makes phishing attacks possible or similar things. I get a text from a random number saying “click this link to pay your bill!” And I don’t have any way to trust its legit.

          SIM swaps make it so people can take over your phone number temporarily and then generate 2fa requests to gain access to accounts. Doing the swap usually involves bribing someone or gaining access to a providers database by other means, but its been done a lot.

          There are ways to prevent this, but the most straight forward is using a MFA app. Barring that 2FA via email is the next best thing.

          • frostysauce@lemmy.worldEnglish
            1·
            20 hours ago

            Forgive my ignorance, aren’t emails sent in plain text that can be read by any of the networks they are passed between? I’ve always been taught email is the least secure of any communication.

            • Screen_Shatter@lemmy.worldEnglish
              2·
              16 hours ago

              I’m not a security expert so my ability to explain is limited, but no, emails have long used encryption protocols like SSL to prevent such problems. However, your email provider may scan and read your emails. That’s not much different than a text message service reading those messages, but you can choose your provider. From what I can tell proton.me is the way to go for resolving that issue - they provide encryption which prevents their own machines and employees from being able to read your messages and other data. Otherwise, your email is basically as secure as your passwords are.

      • shortwavesurfer@lemmy.zipEnglish
        5·
        2 days ago

        One big reason I’m hesitant to keep my money in banks is because banks think the best form of two-factor authentication is text message based 2FA and I’m like that’s barely any 2FA at all.

        • Screen_Shatter@lemmy.worldEnglish
          5·
          2 days ago

          My banks are like that too. Of course I can’t speak to anyone who might influence that decision. Steam has better security than almost any other account I have. I appreciate them for that but it also seems ludicrous to me that my video games are more secure than my bank accounts.

          • shortwavesurfer@lemmy.zipEnglish
            4·
            2 days ago

            I keep my money in Monero. That way, it’s me who has to be targeted instead of an institution. And if I fuck up and lose it, it’s my own damn fault.

            • Screen_Shatter@lemmy.worldEnglish
              3·
              2 days ago

              I have some crypto, some stocks, etc. For many things I still need standard banking though. Crypto just isn’t there yet. Maybe someday… But having money distributed is still smart either way, so I have many baskets for my eggs.