6 ms·

Security is relative; there is no absolute security. SMS 2FA is not perfect, but it's MUCH better than what it replaced (nothing). ANY system with a human com

Security is relative; there is no absolute security. SMS 2FA is not perfect, but it's MUCH better than what it replaced (nothing). ANY system with a human component will be at risk to social engineering attacks; not just SMS-based methods. And shifting the attack surface to depend on social engineering (SE) adds important rate limiting; it's difficult to automate SE attacks. Friction is also a critical factor: a low-friction B+ security solution may be better than a high-friction A+ solution. Consider total risk, not just point risk. SMS 2FA is like a CFL lightbulb. It's 10x better than what it replaced, it's what we have now, but we know it's not the endgame (LED lighting).

osteele 9y ago
What you say is true of actual 2FA, which only adds security. (Unless, maybe, you take into account risk compensation[1], which is probably magnified when SMS 2FA is less secure than users think.) However, SMS “2FA” is often used to mean SMS-based password reset, where SMS can be used instead of the password. With SMS-based password reset, SMS subtracts a factor (EDIT: or divides by two[2]?), instead of adding a factor as in 2FA. This is the case with the OP article. The text of the article is unclear about whether it means 2FA or password reset, and the title does include the term “SMS-based 2 Factor Auth”. However, the example issues that the article links to are all cases of password reset, not 2FA. [1] https://en.wikipedia.org/wiki/Risk_compensation https://en.wikipedia.org/wiki/Risk_compensation [2] I propose that SMS-based password reset be called “Half-Factor Auth” (HFA or ½FA), to distinguish it from 2FA.
- dend 9y ago
  You are right, it's mostly password reset 2FA (often times it ties into auth SMS 2FA, so not necessarily mutually exclusive) - I will update the article and clarify that.
- tootie 9y ago
  Or SMS one-time password which is basically the same thing.
rraghur 9y ago
Rightly said... Here in india, the central bank had managed sms based otp validation for all online card transactions... Turns out that just doing that has kept card fraud down. It also helps in our country to inspire confidence with older generation that isn't super comfy with online transactions. Now there have been cases of sim cloning etc to try and get around the otp, but all in all its a small percentage. Now I get support nervous when I do any international transaction and it just goes through without an otp SMS
- nothrabannosir 9y ago
  Fwiw: if your card scheme is MasterCard or visa , regardless of (your) acquirer bank or merchant bank , you will be protected against fraud by something called chargebacks. If anyone ever uses your card to fraudulently order something , you have (a few months’) time to contact your bank and issue a “chargeback.” They will, through the MasterCard or visa (or similar) network contact the merchant’s bank, which will then take the money back out of the merchant’s account and give it back to you. E.g. if someone orders an Uber , your bank would ask Uber’s bank for the money back, and they would take it out of Uber’s account, and they have to pay a penalty to MasterCard (a “chargeback fee”). And if it happens often enough, MasterCard will bump Uber’s commission for payments. It’s tragicomic how shamelessly the banks are winning at fraud. Side note: for low margin operations like Uber, this is hell: they can’t ask the money back from drivers, so they lose a lot of money on fraud vs their profit on regular transactions. The driver fee, the original payment, and the chargeback fee, and the potential payment commission bump. The onus is on the merchant to avoid accepting fraudulent transactions, and if you want to contest a chargeback you better have some CSI level proof. This is why most online shops will offer a money-back-no-questions-asked policy: they know you can get the money back one way or another, and it’s cheaper to just give it to you. An insidious consequence of this is the price for this protection is amortised over all customers, in the end. Fraud is BIG business, and the money has to come from somewhere. Customers get angry when a merchant adds a CC surcharge, but they end up paying that surcharge anyway, it’s just not explicitly listed. And if you pay cash, you pay it too, without any of the protections. Cash payers subsidise CC holders.† Long story short: don’t be nervous. Your card is safe. (Unless you’re on a different scheme with different rules, of course) (This assumes regular payments without extra auth, like e.g. PIN or 3D Secure. Those rules differ slightly.) †: to be completely fair: there are costs associated with cash, too.
dpweb 9y ago
Hardware keys are not great. You use a company laptop and they have disabled usb or set off an alarm when you plug something in. It should be based on phone however, since thats the one thing everybody cant live without and usually have on them. It would be nice to see goog and msft make their authenticator apps interoperable, or a global standard all svcs can use, as authenticator apps seem to be the best thing going.
- Rafert 9y ago
  U2F does NOT require a hardware key - only a secure cryptographic processor. It could be built into your laptop. There were some rumours floating around that Chromebooks would receive fingerprint scanner that would enable this. It would make sense since U2F originated from Google. The W3C is working on the Web Authentication spec: https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/ with (among others) Google and Microsoft contributing. Wide support for this would be the endgame OP mentioned.
  - Piskvorrr 9y ago
    How is that "not hardware"? If you meant a separate physical key, I think that's actually a Good Thing: you can have it on you and it's tiny in features - reducing the likelihood it would get tampered with, unnoticed; one integrated into a laptop is a part of a huge blackbox that you just need to blindly trust.
hansjorg 9y ago
> shifting the attack surface to depend on social engineering Other than social engineering, there's also SS7 abuse: https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev...
drdaeman 9y ago
Ditching SMS 2FA normally means replacing it with some other 2FA mechanism (e.g. TOTP and/or U2F). Which is a good idea. I don't think anyone (except for some possible edge cases) are removing SMS 2FA leaving no 2FA options at all. Also, it all depends on threat model. Rarely, but sometimes, when user's anonymity/pseudonimity is at stake - SMS can be a security risk. I think there was at least one service that had only SMS 2FA for which I've decided to not opt in just because I didn't want to provide that service with my contact information beyond what I already gave them. Not like that was a security issue - more like a privacy/spam one in my case, but I can imagine cases where user's identity is actually a security issue.
jandrese 9y ago
SMS 2FA does more than provide extra security for your account. Perhaps more importantly to companies like Facebook and Google it also makes it much harder for spammers and bots to register accounts. At the very least it adds the expense of buying a SIM so you can use the number just once.
- tomcooks 9y ago
  You can have a SIM registered on someone else's name for cheap on dark markets so i doubt price is a problem, especially when buying numbers in bulk
  - jandrese 9y ago
    Risky if you're planning to use that SIM to prove that you're a legitimate person to a data mining company like Facebook or Google. That SIM gets reported stolen and your account could go up in flames, which is a big problem if you've been spending weeks grooming it to look real.
nezzle 9y ago
SMS 2FA replaced nothing for many people, but better solutions such as hard/soft tokens existed already - they're just unpopular.

osteele 9y ago

What you say is true of actual 2FA, which only adds security. (Unless, maybe, you take into account risk compensation[1], which is probably magnified when SMS 2FA is less secure than users think.) However, SMS “2FA” is often used to mean SMS-based password reset, where SMS can be used instead of the password. With SMS-based password reset, SMS subtracts a factor (EDIT: or divides by two[2]?), instead of adding a factor as in 2FA. This is the case with the OP article. The text of the article is unclear about whether it means 2FA or password reset, and the title does include the term “SMS-based 2 Factor Auth”. However, the example issues that the article links to are all cases of password reset, not 2FA. [1] https://en.wikipedia.org/wiki/Risk_compensation https://en.wikipedia.org/wiki/Risk_compensation [2] I propose that SMS-based password reset be called “Half-Factor Auth” (HFA or ½FA), to distinguish it from 2FA.

dend 9y ago
You are right, it's mostly password reset 2FA (often times it ties into auth SMS 2FA, so not necessarily mutually exclusive) - I will update the article and clarify that.
tootie 9y ago
Or SMS one-time password which is basically the same thing.

rraghur 9y ago

Rightly said... Here in india, the central bank had managed sms based otp validation for all online card transactions... Turns out that just doing that has kept card fraud down. It also helps in our country to inspire confidence with older generation that isn't super comfy with online transactions. Now there have been cases of sim cloning etc to try and get around the otp, but all in all its a small percentage. Now I get support nervous when I do any international transaction and it just goes through without an otp SMS

nothrabannosir 9y ago
Fwiw: if your card scheme is MasterCard or visa , regardless of (your) acquirer bank or merchant bank , you will be protected against fraud by something called chargebacks. If anyone ever uses your card to fraudulently order something , you have (a few months’) time to contact your bank and issue a “chargeback.” They will, through the MasterCard or visa (or similar) network contact the merchant’s bank, which will then take the money back out of the merchant’s account and give it back to you. E.g. if someone orders an Uber , your bank would ask Uber’s bank for the money back, and they would take it out of Uber’s account, and they have to pay a penalty to MasterCard (a “chargeback fee”). And if it happens often enough, MasterCard will bump Uber’s commission for payments. It’s tragicomic how shamelessly the banks are winning at fraud. Side note: for low margin operations like Uber, this is hell: they can’t ask the money back from drivers, so they lose a lot of money on fraud vs their profit on regular transactions. The driver fee, the original payment, and the chargeback fee, and the potential payment commission bump. The onus is on the merchant to avoid accepting fraudulent transactions, and if you want to contest a chargeback you better have some CSI level proof. This is why most online shops will offer a money-back-no-questions-asked policy: they know you can get the money back one way or another, and it’s cheaper to just give it to you. An insidious consequence of this is the price for this protection is amortised over all customers, in the end. Fraud is BIG business, and the money has to come from somewhere. Customers get angry when a merchant adds a CC surcharge, but they end up paying that surcharge anyway, it’s just not explicitly listed. And if you pay cash, you pay it too, without any of the protections. Cash payers subsidise CC holders.† Long story short: don’t be nervous. Your card is safe. (Unless you’re on a different scheme with different rules, of course) (This assumes regular payments without extra auth, like e.g. PIN or 3D Secure. Those rules differ slightly.) †: to be completely fair: there are costs associated with cash, too.

dpweb 9y ago

Hardware keys are not great. You use a company laptop and they have disabled usb or set off an alarm when you plug something in. It should be based on phone however, since thats the one thing everybody cant live without and usually have on them. It would be nice to see goog and msft make their authenticator apps interoperable, or a global standard all svcs can use, as authenticator apps seem to be the best thing going.

Rafert 9y ago
U2F does NOT require a hardware key - only a secure cryptographic processor. It could be built into your laptop. There were some rumours floating around that Chromebooks would receive fingerprint scanner that would enable this. It would make sense since U2F originated from Google. The W3C is working on the Web Authentication spec: https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/ with (among others) Google and Microsoft contributing. Wide support for this would be the endgame OP mentioned.
- Piskvorrr 9y ago
  How is that "not hardware"? If you meant a separate physical key, I think that's actually a Good Thing: you can have it on you and it's tiny in features - reducing the likelihood it would get tampered with, unnoticed; one integrated into a laptop is a part of a huge blackbox that you just need to blindly trust.

hansjorg 9y ago

> shifting the attack surface to depend on social engineering Other than social engineering, there's also SS7 abuse: https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev...

drdaeman 9y ago

Ditching SMS 2FA normally means replacing it with some other 2FA mechanism (e.g. TOTP and/or U2F). Which is a good idea. I don't think anyone (except for some possible edge cases) are removing SMS 2FA leaving no 2FA options at all. Also, it all depends on threat model. Rarely, but sometimes, when user's anonymity/pseudonimity is at stake - SMS can be a security risk. I think there was at least one service that had only SMS 2FA for which I've decided to not opt in just because I didn't want to provide that service with my contact information beyond what I already gave them. Not like that was a security issue - more like a privacy/spam one in my case, but I can imagine cases where user's identity is actually a security issue.

jandrese 9y ago

SMS 2FA does more than provide extra security for your account. Perhaps more importantly to companies like Facebook and Google it also makes it much harder for spammers and bots to register accounts. At the very least it adds the expense of buying a SIM so you can use the number just once.

tomcooks 9y ago
You can have a SIM registered on someone else's name for cheap on dark markets so i doubt price is a problem, especially when buying numbers in bulk
- jandrese 9y ago
  Risky if you're planning to use that SIM to prove that you're a legitimate person to a data mining company like Facebook or Google. That SIM gets reported stolen and your account could go up in flames, which is a big problem if you've been spending weeks grooming it to look real.

nezzle 9y ago

SMS 2FA replaced nothing for many people, but better solutions such as hard/soft tokens existed already - they're just unpopular.