4 ms·

My 401k provider recently rolled out 2FA for all accounts. It's mandatory and SMS-only. From the user-side, is there anything I can do short of complaining? Any

My 401k provider recently rolled out 2FA for all accounts. It's mandatory and SMS-only. From the user-side, is there anything I can do short of complaining? Anyway to "convert" to a non-SMS version?

dend 9y ago
Unfortunately, no. If a service is SMS-only, then it will remain SMS-only until the provider implements time-based tokens generated from an app.
gruez 9y ago
use a third party service for sms like google voice, or jmp.chat. yes, it just shifts the problem from your telecom company to a third party, but at least those providers have stronger authentication (google has totp/u2f, and jmp.chat has whatever your xmpp server provides) than what telecoms have.
- djrogers 9y ago
  That solves nothing - the SMS is still subject to all of the same potential issues as one tied directly to a cell phone.
  - gruez 9y ago
    specifically what? i already stated google voice and jmp.chat both have better authentication and 2 factor options than most cell carriers, are they're probably harder to social engineer. since they're internet based, they aren't vulnerable to SS7 exploits. I'm sure if you tried hard enough, you could hack them as well, but at least it raises the difficulty from anyone who read a social engineering guide to nation state or an APT.
    - lmns 9y ago
      > since they're internet based, they aren't vulnerable to SS7 exploits. I think the problem with SS7 is that there's no authentication between providers. At least as far as I know.
      - gruez 9y ago
        afaik the ss7 exploits essentially involve a rogue carrier saying "hey verizon, your client 212-555-1234 is roaming on my network, plz send all his calls/texts to me". i don't think this attack applies to non-mobile providers because there's no roaming. and unlike the internet, there's no bgp-like system[1] for "announcing" phone numbers. it's all centralized, which should reduce your attack surface from every telecom in the world, to the originating telecom, whoever's in charge of the numbering database, and your carrier. [1] https://en.wikipedia.org/wiki/Local_number_portability#Portability_schemes https://en.wikipedia.org/wiki/Local_number_portability#Porta...
awinder 9y ago
Strong password & rotate it. If you're worried about 1 of the 2 factors being less secure than the other, and you can only control 1/2 factors, focus on the 1 you can control ;-). The nice thing is that 2FA over SMS should, at least, degrade to being a possible notification channel that something is amiss. Keep your password strong and at least it will become a ping message that someone has compromised your password.
alain_gilbert 9y ago
Just tell them you don't have a cellphone ? I wonder what they would do about it.

My 401k provider recently rolled out 2FA for all accounts. It's mandatory and SMS-only. From the user-side, is there anything I can do short of complaining? Anyway to "convert" to a non-SMS version?

dend 9y ago

Unfortunately, no. If a service is SMS-only, then it will remain SMS-only until the provider implements time-based tokens generated from an app.

gruez 9y ago

use a third party service for sms like google voice, or jmp.chat. yes, it just shifts the problem from your telecom company to a third party, but at least those providers have stronger authentication (google has totp/u2f, and jmp.chat has whatever your xmpp server provides) than what telecoms have.

djrogers 9y ago
That solves nothing - the SMS is still subject to all of the same potential issues as one tied directly to a cell phone.
- gruez 9y ago
  specifically what? i already stated google voice and jmp.chat both have better authentication and 2 factor options than most cell carriers, are they're probably harder to social engineer. since they're internet based, they aren't vulnerable to SS7 exploits. I'm sure if you tried hard enough, you could hack them as well, but at least it raises the difficulty from anyone who read a social engineering guide to nation state or an APT.
  - lmns 9y ago
    > since they're internet based, they aren't vulnerable to SS7 exploits. I think the problem with SS7 is that there's no authentication between providers. At least as far as I know.
    - gruez 9y ago
      afaik the ss7 exploits essentially involve a rogue carrier saying "hey verizon, your client 212-555-1234 is roaming on my network, plz send all his calls/texts to me". i don't think this attack applies to non-mobile providers because there's no roaming. and unlike the internet, there's no bgp-like system[1] for "announcing" phone numbers. it's all centralized, which should reduce your attack surface from every telecom in the world, to the originating telecom, whoever's in charge of the numbering database, and your carrier. [1] https://en.wikipedia.org/wiki/Local_number_portability#Portability_schemes https://en.wikipedia.org/wiki/Local_number_portability#Porta...

awinder 9y ago

Strong password & rotate it. If you're worried about 1 of the 2 factors being less secure than the other, and you can only control 1/2 factors, focus on the 1 you can control ;-). The nice thing is that 2FA over SMS should, at least, degrade to being a possible notification channel that something is amiss. Keep your password strong and at least it will become a ping message that someone has compromised your password.

alain_gilbert 9y ago

Just tell them you don't have a cellphone ? I wonder what they would do about it.