3 ms·

Companies should never require SMS as a 2nd factor. It isn't secure. Let's call out names: * Twitter requires you to enable cell-phone based 2nd factor before

by jwr 7y ago

Companies should never require SMS as a 2nd factor. It isn't secure. Let's call out names: * Twitter requires you to enable cell-phone based 2nd factor before they let you enable any other 2nd factor. Luckily in my case their buggy software determined that my cell phone number is "incorrect", so I was never able to. * Twilio (the authors of Authy!) let you use TOTP codes from Authy in addition to SMS-based 2FA. There is no way to disable the SMS authentication, so your account is never secure. * Many banks assume that SMS is a secure channel, which it isn't, and force its use as 2FA. This should get more publicity and companies should be called out on forcing people to use SMS as a 2nd factor. There are many reasons why this is a bad idea, and the story described in the article is just one of many possible attacks.

013a 7y ago
Its because all of these companies are cheap and don't want to deal with the customer support cost of people who lose a virtual/physical MFA device. Instead, they treat virtual/physical MFA like a convenience feature that their customers keep whining about. But, if you've got that SMS on backup, then who cares if you lose the MFA; just use your phone, security be damned. 1Password is also guilty of this in a different way: They won't let you register a U2F physical security key unless you also have a virtual security key on the account. This is ridiculously simple. I'll spell it out: 1) Offer Virtual, U2F, and SMS-based multi-factor authentication. SMS is still useful for convenience on platforms which pose less of a security risk to your digital life. 2) Don't gatekeep methods of multi-factor authentication behind others. 3) Allow multiple devices for each method of multi-factor authentication, especially physical U2F keys. 4) Offer backup codes. 5) Offer an Enhanced Lockdown option, whereby customer support account recovery is irrevocably impossible in the event of lost multi-factor.
jwr 7y ago
So, I've just realized that Chase online banking, while mandating SMS 2FA, also lets you choose "send code via E-mail". I'll… just leave this here without any further comment.

by jwr 7y ago

013a 7y ago

Its because all of these companies are cheap and don't want to deal with the customer support cost of people who lose a virtual/physical MFA device. Instead, they treat virtual/physical MFA like a convenience feature that their customers keep whining about. But, if you've got that SMS on backup, then who cares if you lose the MFA; just use your phone, security be damned. 1Password is also guilty of this in a different way: They won't let you register a U2F physical security key unless you also have a virtual security key on the account. This is ridiculously simple. I'll spell it out: 1) Offer Virtual, U2F, and SMS-based multi-factor authentication. SMS is still useful for convenience on platforms which pose less of a security risk to your digital life. 2) Don't gatekeep methods of multi-factor authentication behind others. 3) Allow multiple devices for each method of multi-factor authentication, especially physical U2F keys. 4) Offer backup codes. 5) Offer an Enhanced Lockdown option, whereby customer support account recovery is irrevocably impossible in the event of lost multi-factor.

jwr 7y ago

So, I've just realized that Chase online banking, while mandating SMS 2FA, also lets you choose "send code via E-mail". I'll… just leave this here without any further comment.