A number of companies make use of mobile "2FA" via SMS which is inherently insecure and easily bypassed by porting out of mobile numbers or sim swap attacks.
There are a number of options to prevent this:
- Go to a better Bank that has more secure 2FA support (OTP, U2F, Yubikeys or a mobile push to the app)
- Get a burner phone and hope no one finds your number and tries a sim attack
- Use this tool to setup a proxy number and stack in AWS for your mobile 2FA
- Copy
config.yml.exampletoconfig.ymland update email, number and public key npm installAWS_PROFILE=profile npm run deploywhereprofileis your AWS profile- Run local lambda connecting to AWS by:
AWS_PROFILE=profile TOPIC_ARN=arn npm run test:e2ewhereTOPIC_ARNis the receiving topic of used by the Lambda - Register long code in AWS Pinpoint and setup SNS topic to the forwarding topic
- Make use of your new mobile number in Pinpoint and wait for encrypted payloads!
- Register your proxy number (long code) via AWS Pinpoint
- Proxy number resides in AWS Pinpoint
- Messages received on AWS Pinpoint forwarded to SNS then AWS Lambda function for processing
- The Lambda encrypts the message with
openpgpand forwards these messages via SNS securely to their destination - Current solution makes use of encrypted SMS or Email (other options could be Signal, Slack or Telegram)
- AWS will secure your registered number and porting out or control of this number will not give visibility of 2FA codes
- The communication within AWS is secure and much more difficult to break if your AWS account is secured by 2FA and locked down according to AWS security best practices
Be sure to select the receiver topic
