5 ms·

https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... NIST has said that 2FA via

https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... NIST has said that 2FA via SMS is bad and awful for at least 3 years now. Can we knock it off, already? This won’t stop SIM swaps, but it will blunt their impact by rather a lot.

dev_dull 7y ago
That’s the problem. Twitter requires you to add a phone number (even if you sign up without one, eventually you’ll be locked out and requires to add one). Then, once you add a number to unlock your account you’re left exposed.
- jshowa3 7y ago
  I never understood this. Tinder is the same way. It makes no sense to me because of how relatively easy is to hijack someones number.
- jandrese 7y ago
  Can't you add a number, verify the account, then delete the number?
  - mceachen 7y ago
    Nope, that disables 2FA.
    - jandrese 7y ago
      You can however uncheck "Text Message" as a viable second factor.
      - mceachen 7y ago
        ...but texting 40404 still doesn't require authentication.
noja 7y ago
As another poster wrote, Twitter uses 1FA for SMS
mikeash 7y ago
2FA over SMS is fine. It’s not a terribly strong second factor, but it’s decent, and far better than nothing. The problem is when companies implement 1FA over SMS and call it “2FA.” That is a catastrophically had idea, and unfortunately it confuses people into thinking that 2FA over SMS is somehow dangerous.
- lotsofpulp 7y ago
  It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.
  - rolltiide 7y ago
    Just one lawsuit away from it never happening anymore
  - crankylinuxuser 7y ago
    So whats the procedure for someone to recover an account if the 2fa is busted/lost ?
    - lotsofpulp 7y ago
      When you setup TOTP 2FA, the application should offer a few one time use codes (google offers 10, for example). These can be copied and stored safely somewhere. If you lose the one time use codes, then you're screwed. But that's the risk you face if you want the most simple and most secure method.
      - WorldMaker 7y ago
        Also, most providers allow you to setup multiple simultaneous TOTP devices (and those that don't, should). On my personal TODO list is setting up a "safe deposit box" TOTP device sometime.
  - 7y ago
dylan-m 7y ago
The worst thing here is there are genuinely people who are afraid of 2FA because they see headlines about how 2FA over SMS is dangerous, and they (as well as the writers in some cases, to be fair) don't understand that the "over SMS" part is the crux of it, not the 2FA part. It doesn't even make sense. You don't even need extra infrastructure to do it properly. It costs you more money to send an SMS. Just don't!

dev_dull 7y ago

That’s the problem. Twitter requires you to add a phone number (even if you sign up without one, eventually you’ll be locked out and requires to add one). Then, once you add a number to unlock your account you’re left exposed.

jshowa3 7y ago
I never understood this. Tinder is the same way. It makes no sense to me because of how relatively easy is to hijack someones number.
jandrese 7y ago
Can't you add a number, verify the account, then delete the number?
- mceachen 7y ago
  Nope, that disables 2FA.
  - jandrese 7y ago
    You can however uncheck "Text Message" as a viable second factor.
    - mceachen 7y ago
      ...but texting 40404 still doesn't require authentication.

noja 7y ago

As another poster wrote, Twitter uses 1FA for SMS

mikeash 7y ago

2FA over SMS is fine. It’s not a terribly strong second factor, but it’s decent, and far better than nothing. The problem is when companies implement 1FA over SMS and call it “2FA.” That is a catastrophically had idea, and unfortunately it confuses people into thinking that 2FA over SMS is somehow dangerous.

lotsofpulp 7y ago
It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.
- rolltiide 7y ago
  Just one lawsuit away from it never happening anymore
- crankylinuxuser 7y ago
  So whats the procedure for someone to recover an account if the 2fa is busted/lost ?
  - lotsofpulp 7y ago
    When you setup TOTP 2FA, the application should offer a few one time use codes (google offers 10, for example). These can be copied and stored safely somewhere. If you lose the one time use codes, then you're screwed. But that's the risk you face if you want the most simple and most secure method.
    - WorldMaker 7y ago
      Also, most providers allow you to setup multiple simultaneous TOTP devices (and those that don't, should). On my personal TODO list is setting up a "safe deposit box" TOTP device sometime.
- 7y ago

dylan-m 7y ago

The worst thing here is there are genuinely people who are afraid of 2FA because they see headlines about how 2FA over SMS is dangerous, and they (as well as the writers in some cases, to be fair) don't understand that the "over SMS" part is the crux of it, not the 2FA part. It doesn't even make sense. You don't even need extra infrastructure to do it properly. It costs you more money to send an SMS. Just don't!