This is Jack Dorsey, and in August of 2019, he was the CEO of Twitter.
And on August 30th, around 4PM, he started saying some things, things that CEOs of large
social media companies should definitely not be saying. His account had been compromised, and
hackers were able to access Jack’s Twitter account and start using it to say some suspect things.
This of course is bad. But it does offer us, my fellow YouTube viewers,
two amazing opportunities. First off, we get the chance to reminisce about August of 2019,
and all the things that had yet to happen!
But of course, secondly, it gives us a chance to talk about security once again!
Passwords and Multi Factor and Hashing, yes HASHING! Let’s explore some of the
things that went wrong to cause this disaster, how hackers can take over your phone number,
and some ideas on how to protect yourself and the people you code for.
Okay, let’s start simple: People losing their accounts to random trolls is probably not
a good thing. And so in order to prevent that, we have passwords, a topic we’ve covered a little
bit on this channel! But as we also mentioned, passwords can be a little rough for most people,
because long and secure passwords can be hard to remember. And so people usually resort to the
strategy of “having real bad passwords”. And by bad I mean using the same password across
multiple accounts, having too short a password, and/or having an easily guessable password.
And so, in order to not have our entire security infrastructure reliant on
“password1” there are strategies in place to make sure the wrong people can’t access your account.
Password requirements are the first step, trying to force you to make strong passwords,
and of course, there’s multi-factor authentication. By this point in 2022,
I’d imagine many of you have already encountered multi-factor authentication.
In essence, instead of just having one piece of information to prove you are who you say you are,
aka your password, you also need something else. It can be any series of things,
a fingerprint scan, a swipe of an ID card, but most commonly, your phone.
I’m sure many of you have encountered this. When you try to log into an account,
you first type in your username, then your password, and then a little box pops up
asking you to type in a six digit code that was texted to your phone number. And this is actually
an incredibly simple and elegant solution. Sure, your password might be bad, but now in order to
get into your account, not only do you need to be able to guess the password, you also need to have
your phone where you get your text messages. Sure, it’ll be difficult to get one of these things, but
BOTH of them? Let’s just say that’s extra extra hard. Still possible for sure, but it definitely
makes it much more difficult to get in, and enough to discourage those who might want to try.
The philosophy behind this is simple: we should increase and vary the methods we
use to authenticate an individual, aka, we need you to prove that you’re actually you before we
let you use this account, and you need to be able to prove that you’re really you in multiple ways.
We usually divide these methodologies into separate categories, and the most popular
set of categories are “something you know”, “something you have” and “something you are”.
Passwords, which we’ve talked about a lot, are considered to be something you know, while
something like your fingerprint or a face scan would be considered something you are, some part
of your identity. Something you have could be an ID card of some sort or in this case your phone.
The specific distinctions between these categories never really interested me,
and depending on who you ask, they may give additional categories and
debate their boundaries. The point is, we want a diverse array of ways to authenticate yourself
in case one of them gets compromised. If someone manages to steal your password,
that’s too bad, but if we require both a password and a fingerprint scan, they still
won’t be able to get into your accounts. Multiple factors to authenticate that you’re really you.
Each of these methodologies are deserving of their own video,
but today let’s talk about phones, namely the way we use our phones as a way of proving our
identity. Get a text with 6 digits to make sure that you not only know your password,
but are also in possession of the phone you usually have.
And, sure, it’s a little bit more inconvenient to type in a password and a 6 digit PIN, but you can
be clever about it, like, only requiring the text PIN if you’re logging into a new device,
or a new location or something like that. Overall, not that big of a hassle in my opinion,
but of course, it’s the security/convenience trade-off, so have your own opinions.
Alright! Video over! I mean, unironically this is a pretty good solution, and anything is better
than just having a single password between the world and your account. But there is a weakness
here. Flaws that can be very dangerous. Flaws that can weaken your authentication, and flaws
that may be the deciding point of whether or not some rando is able to Tweet from your CEO’s phone.
Okay, so we established why it might be a good idea to have multiple ways
to prove that you’re you. You might be able to steal a password, but as we’ve discussed,
it’s much harder to steal someone’s phone, much less be able to break into
it. But there’s a slight inaccuracy here that’s going to cause us a lot of trouble,
and that is you don’t actually have to steal a phone to get access to their text messages.
Right? Like, imagine a world where you lost your phone.
Happens all the time to somebody somewhere I’m sure. In this case, your phone number isn’t gone,
it hasn’t disappeared off the face of the earth, no! You can call up
Verizon or AT&T or Sprint or whoever to switch that phone number to a new phone.
Great, okay. Here’s a problem. Someone else could pretend to be you and get them to
switch your phone number to their phone. This process, which we’ll refer to as SIM Swapping,
is becoming increasingly more common and dangerous as more people rely on their phones,
including with logging into other accounts. And in the past,
mobile providers haven’t had the best track record with dealing with this kind of stuff.
There are instances of mobile carrier employees being bribed or tricked into switching numbers,
which of course is really bad, but also as we’ve discussed, people tend to use the same passwords
and PINs and obviously social security numbers and security questions across the same sites.
So if any of this information gets breached on any website, bad actors
can use those pieces of information to try and impersonate you and steal your phone number.
So let’s walk through this: some company has a data breach, hackers get in, steal stuff, and
sell it to their friends. Let’s say for example, it’s the company that owns your apartment complex.
So now all your personal data is leaked, including your name, your email, phone number,
maybe even a PIN or a password you use for your account or even worse your social security number.
Right, like this is a pretty bad scenario, but unfortunately, stuff like this happens way too
often for you to just hope it never happens to you. Okay fine, so now hacker calls into AT&T and
says “hey, my name is [insert your name here], and I lost my phone, calling in from my wife’s phone,
and I need to get my phone number transferred onto this new phone here that I just bought”. And then
the human being on the other end of the line says, “okay fine, but we need to know your PIN you used
for AT&T” or I don’t know, your social security number. AT&T or whoever your mobile carrier is
needs to verify that it’s you, and these methods aren’t usually that sophisticated. And like,
if you used the same PIN across accounts, you’re kinda done at this point, and I mean,
you’re kinda stuck having to use the same social security number, right? So AT&T, if hacker passes
all their tests, switches this number that belongs to you and puts it on their phone!
And now, they go on Twitter, or Gmail, or your bank account, click on the “Forgot my password
button” and it sends a little reset link to your phone! Right, and in the case of these Two Factor
Authentications where they send a little text message to your phone, well now all those text
messages are no longer being sent to you and are being sent to hacker instead, and they didn’t
even have to physically steal your phone! Like the whole point of two factor authentication with your
phone was that someone would have to rip the phone out of your hand, and yet there are clear cases
where they don’t have to. They can remotely find your password and remotely take your phone number,
without ever coming near you at all. And that’s only if you even have two factor authentication,
if you can just use Forgot My Password and get it straight to your phone, then that’s
the end of the game, every account that has your phone number as a backup has now gone bye bye,
And, to state the obvious, this is really bad, and it happens much more often than it should.
So much so that late last year in Fall of 2021, the Federal Communications Commission
proposed a few rules on how companies should treat requests like these to swap SIMs and
phone numbers to try and mitigate this problem, because it very clearly is a dangerous issue.
And it’s EXACTLY what happened to former Twitter CEO Jack Dorsey.
They basically got access to his phone number, and, I didn’t know this, but at the time
Twitter had a way you could Tweet by text? And they just used that.
I mean, they basically owned his phone number at that point, so they could do anything they wanted
with it. I mean, since then, Twitter disabled a lot of this feature alongside, you know,
vamping up any Two Factor authentication that involves SMS text messages. But this is something
that happened to Twitter’s CEO because of a weak link in their authentication: SMS texting.
Also, not to rub salt in the wound here, but this is also not the only way your texts can be
compromised. It’s a bit outside the scope of this video, but the protocol that your SMS messages are
sent on were designed quite a while ago and weren’t really built with security in mind.
So if someone were able to redirect or intercept these text messages,
you’d be in a lot of trouble, and no one would even have to call AT&T.
Point is, texting, specifically texting via SMS, is not the greatest thing to lean your
security against. And also, whenever there’s a human being involved, like with AT&T employees
who can switch over phone numbers and who can be tricked and/or bribed, there’s generally speaking
going to be a vulnerability there too. And your phone is incredibly critical. In a lot of cases,
it’s the backup method for a lot of your accounts, and is very dangerous in the wrong hands.
So the question is, can we think of a way to do this without using texts?
Today we’re going to be talking about a technology that allows us to
authenticate without SMS text messages. You may have already used this before,
but they’re Authenticator Apps. Things like Duo or Google or Microsoft Authenticator.
If you’re unfamiliar with these Authenticators, they basically work like this. When setting up
your two factor authentication, they first ask you to either enter a really long series of random
digits into your app, or much more often, just scan a QR code of the numbers in picture form.
Once that happens, you’ll see the name of your account with a thirty second countdown and a
series of 6 random digits. Every thirty seconds, once the countdown hits zero,
the six numbers change into something else random. Magically, entering that code into your Twitter
account as your second factor is sufficient proof that you are in possession of your phone.
You know your password, you have your phone, it must be you! And so they will let you log in.
Seems simple enough. But the interesting thing here is that the technology these
apps are built on predate the surge in popularity of apps and smartphones. This
kind of technology was designed to be a secure way to authenticate yourself
without an internet connection, an SMS connection, or any kind of connection for that matter.
In fact, if you have one of these apps, you can try this out right now. If you switch your phone
to airplane mode, you’ll find that these six digit codes work just as usual. So long as your device
has a clock and a little bit of computing power, you’d be able to authenticate yourself. Of course
nowadays everything is done over the internet so you might not find this particularly interesting,
but you could imagine using this technology to authenticate yourself in person,
perhaps with a PIN pad to a super secret door to a super secret bunker.
======
So what’s actually going on here? How does this technology work?
In order to understand, we’re going to visit a familiar friend: Hashing! Yes! That thing we
talked about in the context of password storage? Well it makes a return in a different use case!
So here’s the problem we’re trying to solve. Before any of this starts, we’re going to have
to share a randomly generated secret key. This is the long key that you copy and paste in or scan in
with a QR code reader. This super secret key is shared between you and, well whoever the entity
is, let’s say it’s Twitter, and is unique and super secret, so no one else should know about
this. I need to prove to Twitter that I have the key. Easy enough! Just send them the key! This
is actually an okay solution. It’s kinda like a second password, except it’s longer and more
secure because it looks kinda like gibberish, I mean, because it was randomly generated.
I mean, besides the obvious issue that you have to type in this giant super long password every
single time you want to log in, two passwords generally speaking are better than one.
But we want to do a little better than this. Here’s the thing, passcodes that are always
the same and never change can be dangerous. This is true for secret keys, for passwords,
security questions, social security numbers, the list goes on and on. If something doesn’t change,
that means that any attacker only needs to gain that information once and then they will have
access forever. This is why people recommend you change your passwords often, and also one of the
reasons why using security questions like, “What Middle School did you attend?” is a really bad
idea. Things that don’t change, or in some cases, can’t be changed, only need to be stolen once.
Typing things into anywhere could potentially be a vector for attack.
Suppose you’re logging in on a work computer and someone has installed some
bad software that will log every keystroke you make. Hey, maybe it’s your employer,
who knows? Or perhaps less technical, someone is looking over your shoulder as you type,
or there’s a security camera that watches you type something in at school.
Knowing these things are actually possible, how do we make it so that the code that I share
with Twitter changes constantly? Right, like if there was a security camera watching you type
in a passcode, it would be really nice if that code was completely invalidated in 30 seconds.
So let’s find a way to combine the current time with our super secret key. Here’s a trivial idea:
what if we just put the current time at the end of the passcode? Something like this? It
does what we want of course, every minute this passcode changes. At 12:30 it looks like this,
at 12:33 it looks like this, and so all we have to do is send this new combined passcode to Twitter,
they can basically do the same on their end, and if they match, then they’ll let you in.
I mean, okay, this is not going to work, and you might see exactly why.
If a hacker is looking over your shoulder and sees the key “random gibberish with 11:15 at the end”
and they look at the clock and it says, 11:15, I’m pretty sure if they have a
medium sized brain they’re gonna catch on to the pattern and realize that at 11:17
your super secret passcode is just gonna be the same gibberish with 11:17 put at the end.
See, right now we have this function that takes in a super secret key and a timestamp and returns a
new super secret key, but it’s super obvious just by looking at the output, what the inputs were. I
mean, everyone can kinda guess what the timestamp was just by looking at a clock, but you most
certainly should not be able to figure out what the original super secret key is, or else, they
could just pretend to be you by using the secret and just plopping the current time at the end.
We need a function that cannot be reversed, one that we cannot figure out the inputs by
just looking at the output, including this super secret key that only you and Twitter should know.
Sound familiar? It’s hashing! I mean kinda, but mostly yeah! It’s what we’ve been describing a
good hashing function would do! Takes in inputs, outputs gibberish in a way that cannot be reversed
and cannot be forged. Remember: one of the properties of a good hash function is that you
can’t tell what the input was based on the output, because it looks really random, but if two people
both know the input of the hash function, then both of them will always get the same output.
This brings us to a conversation about Message Authentication Codes.
We’ll basically be using hash functions to communicate with Twitter the time of day
in a way that could have only come from us. And we do this by having this super
shared secret between me and Twitter that only the two of us would know. Remember,
I never actually send back this original secret in case someone is looking over my shoulder
watching me type it in. Instead what I do is use the original shared secret and
the time of day to generate a new output by using them as inputs to our hash function.
So let me show you exactly how this works. The idea here is referred to as HMAC,
Hash-Based Message Authentication Codes. Hash-Based we’re using hash functions,
and message authentication codes because we need to know,
we need to authenticate that this message came from you, and not some other rando.
The specifics of how an HMAC is usually implemented depends on the specific hash function
you want to use. See, on this channel we’ve generally spoken about hash functions in theory,
as sorta these magical functions that always produce perfectly random values based on the
inputs. In these cases, it’s sufficient to just have the key, take the timestamp,
plop it at the end, and hash this whole thing. Easy clap. However in the real world, a lot of
common hash functions suffer from a vulnerability to these things called length-extension attacks.
We won’t go into details about what exactly that is, but for many hash functions, you usually
need to do something a little more sophisticated. Nothing too complicated, usually it’s just going
through an extra round of hashing. Instead of just doing this, you can instead do this, and then you
can also go a step further than that too. Again, not the point of this video, maybe another time.
So anyways, we’ll refer to this as the HMAC function. For now, if you want to think of this
as a hash that takes in 2 inputs, feel free to do so as a bit of a theoretical simplification. This
function, like I just said, takes in 2 inputs, the original super secret key that Twitter shared with
you, and the time. Generally speaking, the best way to represent time is to talk about how many
seconds have passed since an agreed upon point. It could be when you created the account, or perhaps
on January 1st 1970, or perhaps a thousand years ago. So long as you agree on what that time is,
you should be good. The other thing, is that you probably want a little more leeway than 1 second?
I mean, it takes some time to read the output, and then it takes time to type it into your computer,
and then it has to go through the internet and be processed by Twitter’s servers,
and anyways it’s incredibly difficult to make sure all computers everywhere are always in
sync in the first place. So generally speaking, instead of counting how many seconds have passed,
usually you count how many 30 second chunks have passed instead. That way you get a
little bit of leeway while still having your output code change quite frequently.
Oh and the final step? Well, who wants to type in an output passcode that’s like a
bajillion characters long. So just take the last 6 digits. Aaand now you have an authenticator.
A passcode that changes every 30 seconds, that’s easy to type in, and will be very
hard to forge unless a hacker physically steals your phone, breaks in, and manages
to retrieve the original shared super secret. And we did it while avoiding SMS text messages!
One more time for everyone: take the original shared secret, take the time, hash em together,
take the last few digits, and send this over. Twitter then does the same thing,
takes their copy of the original shared secret (same as yours), the time, same as yours,
take the last few digits, and if they match they let you in, and otherwise, they don’t.
And there you have it. And you can use this exact technology on Twitter right now if you’d like.
If you take away anything from this video, it’s that SMS text messages can be kinda rough,
just ask Jack, and that two factor authentication can be kind of nice.
Thank you to everyone watching, especially some new Founder MVP Patreon supporters: Amy H, koloml,
Aaron S. And an extra super special thank you to Skrewpz, our new Alpha I Founder. They’re the
ones who help keep this channel alive. Hope you consider doing so as well. Oh and remember: Yeah
it’s bad when the CEO of Twitter gets bamboozled, but it’ll be even worse if it’s you, so stay safe!