5 ms·

on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.

ptoomey3 9y ago
Mostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has the best "lost device"/"broken device" story (people tend to not have their backup codes). I think things like Soft U2F can change that equation a bit. An iCloud keychain synced 2FA credential would go a long way toward addressing some of the usability issues with traditional TOTP based 2FA.
stephengillie 9y ago
It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. (And if you've got Hangouts installed on the PC where you're logging into, then it's not 2FA anymore.)
- kbenson 9y ago
  > It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. I think that may be Project Fi specific. To my knowledge, Hangouts doesn't do SMS anymore except for Project Fi customers, and even prior to them forcibly removing SMS handling from Hangouts on my Samsung and telling me to find something else after an update, it never synced SMS messages it to other Hangouts instances.
fitzroy 9y ago
SMS-based 2FA also gives companies a good excuse to collect users' mobile phone numbers — particularly sites for which one might not otherwise feel compelled to provide that information. Not saying it was a good idea for security, but that probably made it easier to justify internally.
w8rbt 9y ago
You have to get people to buy into using 2fa. SMS and cell phones were good for that. They are not secure and are being abused now (SS7 attacks) and one day won't be used for 2fa at all, but the platform was a good start and certainly better than nothing at all. Hopefully, OATH (HOTP and TOTP) and FIDO will take over where SMS leaves off. And the real danger of cell phones and SMS is account recovery processes that SMS a recovery code to your cell. That's way more concerning than 2fa via SMS IMO.

ptoomey3 9y ago

Mostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has the best "lost device"/"broken device" story (people tend to not have their backup codes). I think things like Soft U2F can change that equation a bit. An iCloud keychain synced 2FA credential would go a long way toward addressing some of the usability issues with traditional TOTP based 2FA.

stephengillie 9y ago

It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. (And if you've got Hangouts installed on the PC where you're logging into, then it's not 2FA anymore.)

kbenson 9y ago
> It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. I think that may be Project Fi specific. To my knowledge, Hangouts doesn't do SMS anymore except for Project Fi customers, and even prior to them forcibly removing SMS handling from Hangouts on my Samsung and telling me to find something else after an update, it never synced SMS messages it to other Hangouts instances.

fitzroy 9y ago

SMS-based 2FA also gives companies a good excuse to collect users' mobile phone numbers — particularly sites for which one might not otherwise feel compelled to provide that information. Not saying it was a good idea for security, but that probably made it easier to justify internally.

w8rbt 9y ago

You have to get people to buy into using 2fa. SMS and cell phones were good for that. They are not secure and are being abused now (SS7 attacks) and one day won't be used for 2fa at all, but the platform was a good start and certainly better than nothing at all. Hopefully, OATH (HOTP and TOTP) and FIDO will take over where SMS leaves off. And the real danger of cell phones and SMS is account recovery processes that SMS a recovery code to your cell. That's way more concerning than 2fa via SMS IMO.