10 ms·

SMS auth is atrociously bad compared to offline 2fa: - Requires a telecom provider in the first place (in some countries, that legally requires a passport/nati

SMS auth is atrociously bad compared to offline 2fa: - Requires a telecom provider in the first place (in some countries, that legally requires a passport/national ID tied to the phone number) - Offers no means of backup - Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that Nevermind Google Authenticator. Android and iOS should have a high quality TOTP app installed by default. One that permits backups. "Users won't install it" should NOT be a factor and if Apple/Google want their users to start using 2FA it's in their own interest to do this anyway.

theGimp 10y ago
It's still better than no 2FA, which I imagine is the alternative for the vast majority of people.
- scrollaway 10y ago
  Meta: Why is it that in one thread, I'm saying "same-machine 2fa is better than no 2fa" and getting "but but it's not secure!" as replies, but when I complain about sms auth being insecure, impractical, nonstandard and more expensive than TOTP I'm getting "it's still better than 2fa" as a reply?
  - raesene6 10y ago
    Different people are responding to those threads, and those different people have different opinions?
  - Ntrails 10y ago
    I agree, it is bizarre to be taking different sides of the argument in different threads...
    - scrollaway 10y ago
      The point I was (clearly too subtly) trying to make is that if you're going to use an imperfect solution in the name of getting it in the hands of more users, you might as well use TOTP and make concessions - it can be more accessible than SMS auth, which has so many problems attached to it, it's hard to understand why it's getting defended on HN anymore.
    - ekimekim 10y ago
      I want to call this out, because I feel it's a big issue we have as humans trying to engage in reasoned debate - the idea that an inconsistent or changing view is somehow "weak" or invalidates the argument. If someone is changing their opinion, that's a good thing. It means they are taking on board new information and not blindly following their original opinion. If someone appears to have an inconsistent view, perhaps their position is simply more nuanced than the simple "for or against" buckets the debate actively tries to lump all participants into?
      - Ntrails 10y ago
        Yeah, I was sarcastically pointing out the absurdity of bitching about different people on HN having different responses whilst he himself has slightly different perspectives on subtly different issues... I don't care that his view is inconsistent, I just think the complaint of people disagreeing with him (in a comment format which encourages disagreement more than agreement) was kinda ridiculous :)
- romaniv 10y ago
  I would assume this depends on the nature of your account. On most of my accounts the probability * cost of getting hacked is much smaller than the probability * cost of loosing access.
liotier 10y ago
> legally requires a passport/national ID tied to the phone number Some may consider that a feature rather than a bug.
- gcb0 10y ago
  some also welcome fascism. heck, back home some still say the time with a dictatorship was better because there were no buns on the streets.
robryk 10y ago
OTOH it's much better if you're authorizing single operations. My bank in Poland has a scheme where it sends me a one time password together with some details on every mutating operation I do (e.g. on a transfer it sends the amount and account number of the target account).
- Nullabillity 10y ago
  All banks in Sweden have a similar scheme. It sends a token and a description to your phone on any mutating or authenticating operation, you input your code, and it signs the token and sends it back to the bank.
  - Natanael_L 10y ago
    The BankID app? Most banks also have hardware TOTP tokens.
    - Nullabillity 10y ago
      True, most banks have both. But the hardware tokens seem to be dying, slowly. Personally I consider the transaction description a pretty killer feature of Mobilt BankID compared to the hardware tokens.
- forgotpwtomain 10y ago
  Then you travel to a country where your mobile provider isn't working and all of a sudden you can't buy an airline ticket. SMS verification is also a terrible user experience.
zimbatm 10y ago
> Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that It's even worse because with offline 2fa. Just reinstalling the phone means loosing the secret keys. I know it's possible to back them up but nobody does that.
- scrollaway 10y ago
  > I know it's possible to back them up but nobody does that Yeah that is a problem and that's why I'm arguing a high quality TOTP client should be shipped out of the box with Android/iOS and be synced with the Google/Apple account by default. A lot of the friction and backup issues would disappear.
  - roblabla 10y ago
    but if TOTP is sync'd on with your google account, and you reinstall your phone... How do you do the first android login after reinstall, when you lost the TOTP ? Chicken and egg problem inbound ^^.
    - scrollaway 10y ago
      Permanent backup codes are a thing. You can generate those at any time. It's a UX problem, not a technical one.
      - taeric 10y ago
        I'm intrigued. The problem: you want to secure your access codes. The solution you appear to be proposing: permanent backup of your security codes somewhere. But... how do you authenticate to this backup of your codes? It can't be through the same method that these codes unlock for you. Right?
        Spooky23 10y ago
        Print them on paper and store them in a drawer in your house. That way it's legally protected more strongly and is immune to hacking.
noinsight 10y ago
> Nevermind Google Authenticator. Android and iOS should have a high quality TOTP app installed by default. True, Red Hat has made FreeOTP which is available for Android and iOS and works really well.
- WorldMaker 10y ago
  Also, Microsoft Authenticator is already on every platform and getting even better on every platform soon. I know it would freak a lot of people out to have an app with the M-word in the name, but it's a good, solid TOTP app.
  - nickpsecurity 10y ago
    Is it open-source under GPL and immune to patent suits? Lock-in, EOL's, and lawsuits are biggest risk Microsoft poses. If they GPL'd it, then Microsoft being the source probably doesn't matter.
    - WorldMaker 10y ago
      It's OATH/IETF standards compliant, which mitigates (if not removes) risk from lock-in and EOL's, thanks to industry standards. [1] I don't think Microsoft is patent suit immune, but they are certainly capable of handling patent suits without disrupting user capabilities/security. Unless you are suggesting Microsoft owns patents in using the standards and somehow might sue users over that, but both OATH and IETF have patent grants in place regarding the standards. Open source under any particular license (esp. and inc. the GPL) is orthogonal to it being immune to patent suits and/or lock-in/EOL. It's also orthogonal to security and/or privacy you can have secure apps both with and without open source. Certainly there are reasons where technically inclined users would prefer to have access to the source, but within the larger context of this discussion where the question is if there is an app available in any app store that matters that you could point a non-technically inclined friend/relative to, Microsoft Authenticator is one option and whether or not it is open source, it's still a better cross-platform option than SMS (and Google Authenticator which isn't as cross-platform, but has as many risks as you mention here as Microsoft's option). [1] https://openauthentication.org/specifications-technical-resources/ https://openauthentication.org/specifications-technical-reso...
Natanael_L 10y ago
I want ubiquitous support for U2F / UAF, which would probably be the easiest solution.
- Rafert 10y ago
  That will probably in the form of Web Authentication API (https://w3c.github.io/webauthn/ https://w3c.github.io/webauthn/) which started out as version 2.0 of the FIDO specifications. Microsoft will release prefixed support of the draft spec in Edge in the upcoming Windows 10 Anniversary update on August 2: https://blogs.windows.com/msedgedev/2016/04/12/a-world-without-passwords-windows-hello-in-microsoft-edge/ https://blogs.windows.com/msedgedev/2016/04/12/a-world-witho...
  - Osiris 10y ago
    How would that work with multiple devices? If the private key is stored in a TPM on the machine you used to register, then you can only ever use that device, or you have to go through some process to add additional devices.
coldtea 10y ago
>in some countries, that legally requires a passport/national ID tied to the phone number Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account? >-Offers no means of backup* That has nothing to do with SMS for 2FA. There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone. - Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that
- scrollaway 10y ago
  > Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account? Huh? Are we talking about the same thing? > There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone. A backup is not the same thing as a master key (even if we call those "backup codes"). I'll grant you that those are usually enough.
  - coldtea 10y ago
    >Huh? Are we talking about the same thing? What I'm saying is that a potential attacker that might divert PINs to their mobile phone, would at least have to be registered to get that phone account in the first place.
vmateixeira 10y ago
How does backing up your keys in a server somewhere is better than SMS auth?
- aianus 10y ago
  You can encrypt them. I have no control over the idiots at my telecom who will reroute my number for anyone who provides the correct answer to some easy 'security questions'.
  - vmateixeira 10y ago
    I see what you mean but if you encrypt them you will end up with an extra encryption key... that you'll need to store somewhere else.. otherwise, holding just an encryption passphrase is pointless as it's just the same as having two login passwords.
- JohnStrange 10y ago
  It's not, most likely. A working 2-factor scheme needs two devices and communication channels to the end user that are completely independent of each other. If your mobile phone links to an account somewhere (e.g. Google account) that you can also access from the other device (e.g. a PC), and security-related settings can be changed from the other device, too, then that's insecure out-of-the-box.
JohnStrange 10y ago
I don't get it. Many people don't use a smartphone at all, and anyway smartphones are much less secure than ordinary mobile phones (w.r.t. criminals), so this seems even less reasonable than requiring the SMS-based method for sensitive operations like confirming money transfers when online banking. In fact, you should use a dumb phone for SMS-tokens if you want be on the safe side. (It would make more sense if the vast majority of Android phones wasn't insecure due to running an old OS with no updates, but that's not the case.)
dtemp 10y ago
I know I can backup the contents of Google Authenticator on iOS if I perform iTunes backups with the "Encrypt backup" option checked. I'd wager that many who are backing up their phones don't have this checked, and don't realize if they have to restore their phone that the gAuth app will pretend you just installed it from scratch with no codes. I'm not sure what the backup situation is with Android. I've started backing up the actual strings that the app uses to generate the codes in an encrypted vault. You usually have to manually have these strings shown to you in lieu of a QR code. While creating another avenue for someone to hack you, at least I have a backup as well as a way to add a second device go show me codes. This is definitely beyond the capacity of the average user. I think there might be online services that handle keeping codes for you? Like you can install an app on your phone, log into an account, and it presents you with all of your codes. Anyone have a recommendation for one of these that works well for them?
- nucleardog 10y ago
  A lot of services also provide backup codes when you perform first setup. If you actually take those and put them in a safe place (maybe offline) like they say, that should mitigate a lot of the problems. Let's pretend I'm a dummy user and I print all my backup codes out and throw them in a drawer somewhere. Now the only situation that locks me out of my account is both my home becoming damaged/unavailable AND my phone at the same time. While a house fire or something could reasonably accomplish both (although I imagine most people would grab their phone before running out!), I think this reduces the risk to a point well below the "I dropped my phone in the toilet." level of not having backup codes.

theGimp 10y ago

It's still better than no 2FA, which I imagine is the alternative for the vast majority of people.

scrollaway 10y ago
Meta: Why is it that in one thread, I'm saying "same-machine 2fa is better than no 2fa" and getting "but but it's not secure!" as replies, but when I complain about sms auth being insecure, impractical, nonstandard and more expensive than TOTP I'm getting "it's still better than 2fa" as a reply?
- raesene6 10y ago
  Different people are responding to those threads, and those different people have different opinions?
- Ntrails 10y ago
  I agree, it is bizarre to be taking different sides of the argument in different threads...
  - scrollaway 10y ago
    The point I was (clearly too subtly) trying to make is that if you're going to use an imperfect solution in the name of getting it in the hands of more users, you might as well use TOTP and make concessions - it can be more accessible than SMS auth, which has so many problems attached to it, it's hard to understand why it's getting defended on HN anymore.
  - ekimekim 10y ago
    I want to call this out, because I feel it's a big issue we have as humans trying to engage in reasoned debate - the idea that an inconsistent or changing view is somehow "weak" or invalidates the argument. If someone is changing their opinion, that's a good thing. It means they are taking on board new information and not blindly following their original opinion. If someone appears to have an inconsistent view, perhaps their position is simply more nuanced than the simple "for or against" buckets the debate actively tries to lump all participants into?
    - Ntrails 10y ago
      Yeah, I was sarcastically pointing out the absurdity of bitching about different people on HN having different responses whilst he himself has slightly different perspectives on subtly different issues... I don't care that his view is inconsistent, I just think the complaint of people disagreeing with him (in a comment format which encourages disagreement more than agreement) was kinda ridiculous :)
romaniv 10y ago
I would assume this depends on the nature of your account. On most of my accounts the probability * cost of getting hacked is much smaller than the probability * cost of loosing access.

liotier 10y ago

> legally requires a passport/national ID tied to the phone number Some may consider that a feature rather than a bug.

gcb0 10y ago
some also welcome fascism. heck, back home some still say the time with a dictatorship was better because there were no buns on the streets.

robryk 10y ago

OTOH it's much better if you're authorizing single operations. My bank in Poland has a scheme where it sends me a one time password together with some details on every mutating operation I do (e.g. on a transfer it sends the amount and account number of the target account).

Nullabillity 10y ago
All banks in Sweden have a similar scheme. It sends a token and a description to your phone on any mutating or authenticating operation, you input your code, and it signs the token and sends it back to the bank.
- Natanael_L 10y ago
  The BankID app? Most banks also have hardware TOTP tokens.
  - Nullabillity 10y ago
    True, most banks have both. But the hardware tokens seem to be dying, slowly. Personally I consider the transaction description a pretty killer feature of Mobilt BankID compared to the hardware tokens.
forgotpwtomain 10y ago
Then you travel to a country where your mobile provider isn't working and all of a sudden you can't buy an airline ticket. SMS verification is also a terrible user experience.

zimbatm 10y ago

> Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that It's even worse because with offline 2fa. Just reinstalling the phone means loosing the secret keys. I know it's possible to back them up but nobody does that.

scrollaway 10y ago
> I know it's possible to back them up but nobody does that Yeah that is a problem and that's why I'm arguing a high quality TOTP client should be shipped out of the box with Android/iOS and be synced with the Google/Apple account by default. A lot of the friction and backup issues would disappear.
- roblabla 10y ago
  but if TOTP is sync'd on with your google account, and you reinstall your phone... How do you do the first android login after reinstall, when you lost the TOTP ? Chicken and egg problem inbound ^^.
  - scrollaway 10y ago
    Permanent backup codes are a thing. You can generate those at any time. It's a UX problem, not a technical one.
    - taeric 10y ago
      I'm intrigued. The problem: you want to secure your access codes. The solution you appear to be proposing: permanent backup of your security codes somewhere. But... how do you authenticate to this backup of your codes? It can't be through the same method that these codes unlock for you. Right?
      - Spooky23 10y ago
        Print them on paper and store them in a drawer in your house. That way it's legally protected more strongly and is immune to hacking.

noinsight 10y ago

> Nevermind Google Authenticator. Android and iOS should have a high quality TOTP app installed by default. True, Red Hat has made FreeOTP which is available for Android and iOS and works really well.

WorldMaker 10y ago
Also, Microsoft Authenticator is already on every platform and getting even better on every platform soon. I know it would freak a lot of people out to have an app with the M-word in the name, but it's a good, solid TOTP app.
- nickpsecurity 10y ago
  Is it open-source under GPL and immune to patent suits? Lock-in, EOL's, and lawsuits are biggest risk Microsoft poses. If they GPL'd it, then Microsoft being the source probably doesn't matter.
  - WorldMaker 10y ago
    It's OATH/IETF standards compliant, which mitigates (if not removes) risk from lock-in and EOL's, thanks to industry standards. [1] I don't think Microsoft is patent suit immune, but they are certainly capable of handling patent suits without disrupting user capabilities/security. Unless you are suggesting Microsoft owns patents in using the standards and somehow might sue users over that, but both OATH and IETF have patent grants in place regarding the standards. Open source under any particular license (esp. and inc. the GPL) is orthogonal to it being immune to patent suits and/or lock-in/EOL. It's also orthogonal to security and/or privacy you can have secure apps both with and without open source. Certainly there are reasons where technically inclined users would prefer to have access to the source, but within the larger context of this discussion where the question is if there is an app available in any app store that matters that you could point a non-technically inclined friend/relative to, Microsoft Authenticator is one option and whether or not it is open source, it's still a better cross-platform option than SMS (and Google Authenticator which isn't as cross-platform, but has as many risks as you mention here as Microsoft's option). [1] https://openauthentication.org/specifications-technical-resources/ https://openauthentication.org/specifications-technical-reso...

Natanael_L 10y ago

I want ubiquitous support for U2F / UAF, which would probably be the easiest solution.

Rafert 10y ago
That will probably in the form of Web Authentication API (https://w3c.github.io/webauthn/ https://w3c.github.io/webauthn/) which started out as version 2.0 of the FIDO specifications. Microsoft will release prefixed support of the draft spec in Edge in the upcoming Windows 10 Anniversary update on August 2: https://blogs.windows.com/msedgedev/2016/04/12/a-world-without-passwords-windows-hello-in-microsoft-edge/ https://blogs.windows.com/msedgedev/2016/04/12/a-world-witho...
- Osiris 10y ago
  How would that work with multiple devices? If the private key is stored in a TPM on the machine you used to register, then you can only ever use that device, or you have to go through some process to add additional devices.

coldtea 10y ago

>in some countries, that legally requires a passport/national ID tied to the phone number Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account? >-Offers no means of backup* That has nothing to do with SMS for 2FA. There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone. - Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that

scrollaway 10y ago
> Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account? Huh? Are we talking about the same thing? > There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone. A backup is not the same thing as a master key (even if we call those "backup codes"). I'll grant you that those are usually enough.
- coldtea 10y ago
  >Huh? Are we talking about the same thing? What I'm saying is that a potential attacker that might divert PINs to their mobile phone, would at least have to be registered to get that phone account in the first place.

vmateixeira 10y ago

How does backing up your keys in a server somewhere is better than SMS auth?

aianus 10y ago
You can encrypt them. I have no control over the idiots at my telecom who will reroute my number for anyone who provides the correct answer to some easy 'security questions'.
- vmateixeira 10y ago
  I see what you mean but if you encrypt them you will end up with an extra encryption key... that you'll need to store somewhere else.. otherwise, holding just an encryption passphrase is pointless as it's just the same as having two login passwords.
JohnStrange 10y ago
It's not, most likely. A working 2-factor scheme needs two devices and communication channels to the end user that are completely independent of each other. If your mobile phone links to an account somewhere (e.g. Google account) that you can also access from the other device (e.g. a PC), and security-related settings can be changed from the other device, too, then that's insecure out-of-the-box.

JohnStrange 10y ago

I don't get it. Many people don't use a smartphone at all, and anyway smartphones are much less secure than ordinary mobile phones (w.r.t. criminals), so this seems even less reasonable than requiring the SMS-based method for sensitive operations like confirming money transfers when online banking. In fact, you should use a dumb phone for SMS-tokens if you want be on the safe side. (It would make more sense if the vast majority of Android phones wasn't insecure due to running an old OS with no updates, but that's not the case.)

dtemp 10y ago

I know I can backup the contents of Google Authenticator on iOS if I perform iTunes backups with the "Encrypt backup" option checked. I'd wager that many who are backing up their phones don't have this checked, and don't realize if they have to restore their phone that the gAuth app will pretend you just installed it from scratch with no codes. I'm not sure what the backup situation is with Android. I've started backing up the actual strings that the app uses to generate the codes in an encrypted vault. You usually have to manually have these strings shown to you in lieu of a QR code. While creating another avenue for someone to hack you, at least I have a backup as well as a way to add a second device go show me codes. This is definitely beyond the capacity of the average user. I think there might be online services that handle keeping codes for you? Like you can install an app on your phone, log into an account, and it presents you with all of your codes. Anyone have a recommendation for one of these that works well for them?

nucleardog 10y ago
A lot of services also provide backup codes when you perform first setup. If you actually take those and put them in a safe place (maybe offline) like they say, that should mitigate a lot of the problems. Let's pretend I'm a dummy user and I print all my backup codes out and throw them in a drawer somewhere. Now the only situation that locks me out of my account is both my home becoming damaged/unavailable AND my phone at the same time. While a house fire or something could reasonably accomplish both (although I imagine most people would grab their phone before running out!), I think this reduces the risk to a point well below the "I dropped my phone in the toilet." level of not having backup codes.