5 ms·
Does it rely on SMS as backup, though?
by mtgx 10y ago
Does it rely on SMS as backup, though?
- tyingq 10y agoIt looks like it gives you a choice: "Security keys for Facebook logins currently only work with certain web browsers and mobile devices, so we'll ask you to also register an additional login approval method, such as your mobile phone or Code Generator"
- mtgx 10y agoThat looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement. Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point. I wish they at least allowed you to opt-out of the SMS back-up before you even had to give them your number. Of course, we're talking about Facebook here, so they won't waste any opportunity to make it seem like you have no choice but to give them your phone number.
- evgen 10y agoYou can use a TOTP code generator (e.g. Authy) as your backup. No need to rely upon SMS.
- tptacek 10y agoYou can, but is there a way to do it such that Facebook won't under any circumstances send an SMS message?
- evgen 10y agoGood question. I am not sSure you can do it without using SMS to bootstrap the process, but if you have TOTP set up and then turn on U2F (with TOTP as the backup) then I think you can disable SMS messages.
- tptacek 10y agoEither I'm dumb, or if that's true it's only true since they added U2F today. (It's very possible that I'm dumb!)
- evgen 10y agoSo digging around a bit on the page the 'Learn More' in the login approvals (https://www.facebook.com/help/148233965247823 https://www.facebook.com/help/148233965247823) claims that you can turn off SMS codes, but I no longer have the advantage of being able to walk over a few desks to get a real verification :) I may try to set up U2F later today and see if this actually works... You would also need to turn off login notifications (section just above login approvals in the security settings page.)
- tyingq 10y ago>That looks like a requirement, not a choice. A requirement to have one backup, which doesn't have to be SMS. It appears to allow a manually pregenerated list of codes, for example. See the ui: https://scontent-dft4-1.xx.fbcdn.net/v/t31.0-8/p720x720/16179456_10154613701556886_7772635162244498937_o.png?oh=df2090f0bfb8c6d8e271cf6dd626a5d2&oe=590F103D https://scontent-dft4-1.xx.fbcdn.net/v/t31.0-8/p720x720/1617...
- ec109685 10y agoHaving something like yubikey is better than just SMS given the phishing attack scenario will have to convince you to type in the SMS code, which should set off alarm bells if you have a functioning yubikey installed on the device you are logging in from.
- tptacek 10y agoNo, that's not the problem with SMS. The problem with SMS is that SMS is itself insecure; in fact, there are large parts of the world where it's overtly and directly state-controlled. You won't have to enter your SMS code; the attacker will do it for you.
- secalex 10y agoYou can configure U2F+Code Generator+Backup Codes and end up with no reliance on the security of SMS for either authentication or account recovery.
- james_pm 10y agoI had SMS as my backup and in testing this morning, FB sends the SMS by default, even before you either tap the key or say you want to use another method (like SMS). That's a big flaw to me. It should only send the SMS if I specifically say, "Use my backup SMS method". I switched to use an authenticator app instead as a result.
- tptacek 10y agoI'm not sure I see the security advantage to opt-in SMS over opt-out SMS (both are bad). If the button exists to override the hardware token with a text message, the attacker will simply push the button after hijacking your phone number.
- james_pm 10y agoTrue that. More of an annoyance then with my phone lighting up with an SMS notification that I didn't need. Reminded me to disable SMS 2FA and stick with the authenticator app.