5 ms·
TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused. SMS 2FA, on the other hand, has real security issues[0]
by antsar 7y ago
TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused.
SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary.
SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider.
[0] https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_good_for_authentication https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_go...
[1] https://duo.com/decipher/reddit-breach-illustrates-dangers-of-2fa-over-sms https://duo.com/decipher/reddit-breach-illustrates-dangers-o...
- yborg 7y agoThe other thing driving SMS 2FA is that this is a clean way for the site/org to get their hands on a real phone number for you with no extra effort. SMS 2FA has been repeatedly proven to be trivial to break with a simple phone call to a mobile provider, since there so far is no downside at all that I am aware of to the providers. If someone jacks your SMS and drains your bank account, at least in the US your mobile provider just goes "oops". Until there is some penalty for them allowing your number to be ported without your consent, SMS is essentially useless for real 2FA security. Even if the account security was foolproof, though, it still is vulnerable to SS7 routing attacks.
- srathi 7y agoUsing Authy may be a good idea. There is a slight risk of exposing the TOTP key to the cloud, but having it available on all devices (current and future) is very convenient. Authy has an option to encrypt the key using a user specified passphrase, so it is at least better than storing the raw TOTP key in the cloud.