11 ms·

I don't think eliminating SMS authentication is a good idea. While it is vulnerable to social engineering attack (and sniffing if you are near the receiving pho

I don't think eliminating SMS authentication is a good idea. While it is vulnerable to social engineering attack (and sniffing if you are near the receiving phone), SMS authentication has proven to be invaluable for most ordinary users. Those users are everything but eager to use anything more secure then their 6 letter password. With tricking many users into using SMS authentication, companies like Google have improved the overall security of most account by a lot. While it is possible to remove an SMS authentication mechanism, it is a lot harder and probably not worth for most accounts. Most people will not bother to install Google authentication and just not use 2FA (who wants to steal their account anyways /s). Even if they did install it, recovering their authentication codes if they have lost their phone is incredible hard (because too many won't use backups – even if it is as simple as apples iCloud backup). What I think companyies should do is give their users a choice not to use SMS authentication. Power users (and hopefully most high profile users) will make use of that and normal user can just use SMS. In the end it is always a trade off between convenience and security and sadly convenience almost always wins for most users even for easy solutions. So we (the developers) should provide them with the most convenient way they accept which offers the maximum security and SMS does just that.

Khaine 10y ago
But this isn't a guide for everyday users. This is a standard for government agencies to comply with. The very people who those weaknesses in SMS will be used against. It is entirely appropriate that the NIST and Governments lead the way in information security as they have the biggest threat landscape. Therefore they should be the ones to constantly raise the security bar, and lead the way. In many ways that has been the saddest impact of the Snowden leaks is that the Government has abandoned that philosophy. That no longer can government recommendations be accepted in good faith.
dewiz 10y ago
What you're describing is a UX problem that Google and Apple could easild solve, using the phone camera to scana QR and call some URL. I think that for the avg user that would be simpler, and in terms of security it would be better.
_nedR 10y ago
Another advantage of sms over dedicated 2FA apps is that even a 10 dollar phone or decade old phone running palm OS can be supported through it. (provided there is network coverage). A problem with sms though is that you need cell phone coverage. I have been in situations where my transaction has timed out while waiting for the sms text to arrive.
- scrollaway 10y ago
  You don't need a phone at all with TOTP. Just a TOTP client, which could even run on the same machine. Fun story about this: When Blizzard introduced TOTP, I wrote a Blizzard Auth library and client so that I could use their 2fa on my desktop (https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna). Why? Because I was sharing my Blizzard account with someone else, but still wanted to use 2fa. And people kept telling me "2fa must be on a different machine otherwise it's not secure", so I was using 2fa wrong and shouldn't use it at all. Well that's bollocks. Same-machine 2fa is more secure than no 2fa at all. There's another comment below that talks about "perfect being the enemy of good" and that's exactly it. So we absolutely should start promoting the fact that you can use TOTP on desktop, even if it's less secure. A lot of users don't use 2fa because they either don't have a phone, or don't have their phone constantly with them.
  - vog 10y ago
    Can "same-machine 2FA" be still called 2FA? Where is the independent second factor if it all runs on the same machine?
    - scrollaway 10y ago
      Factor 1 is the password, factor 2 is an ephemeral 1-time-use token. If the token's seed is secure (YMMV), it doesn't matter if it's on the same machine.
      - adyus 10y ago
        How does that mitigate against the one machine being stolen? The convention is that the chances of two devices getting stolen together are smaller. That's why offsite backups are a thing.
scrollaway 10y ago
SMS auth is atrociously bad compared to offline 2fa: - Requires a telecom provider in the first place (in some countries, that legally requires a passport/national ID tied to the phone number) - Offers no means of backup - Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that Nevermind Google Authenticator. Android and iOS should have a high quality TOTP app installed by default. One that permits backups. "Users won't install it" should NOT be a factor and if Apple/Google want their users to start using 2FA it's in their own interest to do this anyway.
- theGimp 10y ago
  It's still better than no 2FA, which I imagine is the alternative for the vast majority of people.
  - scrollaway 10y ago
    Meta: Why is it that in one thread, I'm saying "same-machine 2fa is better than no 2fa" and getting "but but it's not secure!" as replies, but when I complain about sms auth being insecure, impractical, nonstandard and more expensive than TOTP I'm getting "it's still better than 2fa" as a reply?
    - raesene6 10y ago
      Different people are responding to those threads, and those different people have different opinions?
    - Ntrails 10y ago
      I agree, it is bizarre to be taking different sides of the argument in different threads...
      - scrollaway 10y ago
        The point I was (clearly too subtly) trying to make is that if you're going to use an imperfect solution in the name of getting it in the hands of more users, you might as well use TOTP and make concessions - it can be more accessible than SMS auth, which has so many problems attached to it, it's hard to understand why it's getting defended on HN anymore.
yuvadam 10y ago
SMS messages are trivially interceptable remotely using SS7 vulnerabilities. These capabilites are sold off-the-shelf. Suggesting that SMS is even remotely secure is a very dangerous idea.
deleted 10y ago
[deleted]
greggman 10y ago
As others have pointed out SMS has issues. You need a phone contract. Forget to pay your bill this month? No logging in for you. Switch providers and forget to change all your services over? Oh well, all your data is lost, make new accounts. Don't have a roaming on and go overseas? Guess you aren't accessing your travel plans. Even if it's on many ISPs charge 0.50+ per SMS. Why should have to pay just to log into unrelated services? Go overseas and get a local sim? Welcome to swapping sims anytime you want to login (have had to do this for certain things that currently require SMS verification)
- Freak_NL 10y ago
  Also, don't like linking all sorts of on-line accounts to a single uniquely identifiable number? Tough luck! It is disheartening that in an area of mass-surveillance by governments and advertisement networks alike, the notion of separate identities for separate purposes is seen as obsolete and suspicious. At least with hard-token 2FA technologies such as FIDO U2F, services you access with that key cannot correlate it with other services accessed with it (by design).
- jandrese 10y ago
  You're missing the biggest vulnerability. SMS means you're tied to a phone company, which has a tech support line staffed with people who's main job is keeping their call times down. It's shockingly easy to socially engineer them into sending a copy of your SIM to some random address and completely defeat the 2FA on your system. And once they have your texts, getting a CSR to reset the password on all of your important accounts is super easy. By far the biggest security vulnerability on major services is the customer support representatives.
rb2k_ 10y ago
I don't think the social engineering/sniffing is the real problem. From what I recall the signaling system they use (SS7) is just a shitshow and everybody with $1000 can buy access somewhere in eastern Europe and send/receive all sorts of SMS. At least that was my impression a while ago. That might be completely wrong though :)
athenot 10y ago
On the mac/iOS platforms, SMS is not really 2FA since text messages land straight in Messages.app, as Apple forwards the SMS onto iMessage. Granted, the phone needs to be nearby but it doesn't need to be unlocked. Should we call that 1.5 Factor Authentication? :)
pigeons 10y ago
> While it is vulnerable to social engineering attack (and sniffing if you are near the receiving phone), And anyone with SS7 access.

Khaine 10y ago

But this isn't a guide for everyday users. This is a standard for government agencies to comply with. The very people who those weaknesses in SMS will be used against. It is entirely appropriate that the NIST and Governments lead the way in information security as they have the biggest threat landscape. Therefore they should be the ones to constantly raise the security bar, and lead the way. In many ways that has been the saddest impact of the Snowden leaks is that the Government has abandoned that philosophy. That no longer can government recommendations be accepted in good faith.

dewiz 10y ago

What you're describing is a UX problem that Google and Apple could easild solve, using the phone camera to scana QR and call some URL. I think that for the avg user that would be simpler, and in terms of security it would be better.

_nedR 10y ago

Another advantage of sms over dedicated 2FA apps is that even a 10 dollar phone or decade old phone running palm OS can be supported through it. (provided there is network coverage). A problem with sms though is that you need cell phone coverage. I have been in situations where my transaction has timed out while waiting for the sms text to arrive.

scrollaway 10y ago
You don't need a phone at all with TOTP. Just a TOTP client, which could even run on the same machine. Fun story about this: When Blizzard introduced TOTP, I wrote a Blizzard Auth library and client so that I could use their 2fa on my desktop (https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna). Why? Because I was sharing my Blizzard account with someone else, but still wanted to use 2fa. And people kept telling me "2fa must be on a different machine otherwise it's not secure", so I was using 2fa wrong and shouldn't use it at all. Well that's bollocks. Same-machine 2fa is more secure than no 2fa at all. There's another comment below that talks about "perfect being the enemy of good" and that's exactly it. So we absolutely should start promoting the fact that you can use TOTP on desktop, even if it's less secure. A lot of users don't use 2fa because they either don't have a phone, or don't have their phone constantly with them.
- vog 10y ago
  Can "same-machine 2FA" be still called 2FA? Where is the independent second factor if it all runs on the same machine?
  - scrollaway 10y ago
    Factor 1 is the password, factor 2 is an ephemeral 1-time-use token. If the token's seed is secure (YMMV), it doesn't matter if it's on the same machine.
    - adyus 10y ago
      How does that mitigate against the one machine being stolen? The convention is that the chances of two devices getting stolen together are smaller. That's why offsite backups are a thing.

scrollaway 10y ago

SMS auth is atrociously bad compared to offline 2fa: - Requires a telecom provider in the first place (in some countries, that legally requires a passport/national ID tied to the phone number) - Offers no means of backup - Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that Nevermind Google Authenticator. Android and iOS should have a high quality TOTP app installed by default. One that permits backups. "Users won't install it" should NOT be a factor and if Apple/Google want their users to start using 2FA it's in their own interest to do this anyway.

theGimp 10y ago
It's still better than no 2FA, which I imagine is the alternative for the vast majority of people.
- scrollaway 10y ago
  Meta: Why is it that in one thread, I'm saying "same-machine 2fa is better than no 2fa" and getting "but but it's not secure!" as replies, but when I complain about sms auth being insecure, impractical, nonstandard and more expensive than TOTP I'm getting "it's still better than 2fa" as a reply?
  - raesene6 10y ago
    Different people are responding to those threads, and those different people have different opinions?
  - Ntrails 10y ago
    I agree, it is bizarre to be taking different sides of the argument in different threads...
    - scrollaway 10y ago
      The point I was (clearly too subtly) trying to make is that if you're going to use an imperfect solution in the name of getting it in the hands of more users, you might as well use TOTP and make concessions - it can be more accessible than SMS auth, which has so many problems attached to it, it's hard to understand why it's getting defended on HN anymore.

yuvadam 10y ago

SMS messages are trivially interceptable remotely using SS7 vulnerabilities. These capabilites are sold off-the-shelf. Suggesting that SMS is even remotely secure is a very dangerous idea.

deleted 10y ago

[deleted]

greggman 10y ago

As others have pointed out SMS has issues. You need a phone contract. Forget to pay your bill this month? No logging in for you. Switch providers and forget to change all your services over? Oh well, all your data is lost, make new accounts. Don't have a roaming on and go overseas? Guess you aren't accessing your travel plans. Even if it's on many ISPs charge 0.50+ per SMS. Why should have to pay just to log into unrelated services? Go overseas and get a local sim? Welcome to swapping sims anytime you want to login (have had to do this for certain things that currently require SMS verification)

Freak_NL 10y ago
Also, don't like linking all sorts of on-line accounts to a single uniquely identifiable number? Tough luck! It is disheartening that in an area of mass-surveillance by governments and advertisement networks alike, the notion of separate identities for separate purposes is seen as obsolete and suspicious. At least with hard-token 2FA technologies such as FIDO U2F, services you access with that key cannot correlate it with other services accessed with it (by design).
jandrese 10y ago
You're missing the biggest vulnerability. SMS means you're tied to a phone company, which has a tech support line staffed with people who's main job is keeping their call times down. It's shockingly easy to socially engineer them into sending a copy of your SIM to some random address and completely defeat the 2FA on your system. And once they have your texts, getting a CSR to reset the password on all of your important accounts is super easy. By far the biggest security vulnerability on major services is the customer support representatives.

rb2k_ 10y ago

I don't think the social engineering/sniffing is the real problem. From what I recall the signaling system they use (SS7) is just a shitshow and everybody with $1000 can buy access somewhere in eastern Europe and send/receive all sorts of SMS. At least that was my impression a while ago. That might be completely wrong though :)

athenot 10y ago

On the mac/iOS platforms, SMS is not really 2FA since text messages land straight in Messages.app, as Apple forwards the SMS onto iMessage. Granted, the phone needs to be nearby but it doesn't need to be unlocked. Should we call that 1.5 Factor Authentication? :)

pigeons 10y ago

> While it is vulnerable to social engineering attack (and sniffing if you are near the receiving phone), And anyone with SS7 access.