3 ms·

SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authenticat

SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authentication.

Spivak 7y ago
It may very well be bad in absolute terms but compared to a single weak password it’s a huge improvement. I would bet on “log in with phone number” being better than “log in with password” across a population any day.
- legohead 7y ago
  It's less secure than even passwords. Beyond SIM card cloning, I could sit behind a target, initiate a SMS auth, and simply wait for the guy to look at his phone. Most of the time it will pop up right on the front screen even if locked. If he misses it, I just wait for him to unlock the phone and look at his SMS. How would you like it if passwords just popped up visible to all on your phone?
  - drewmol 7y ago
    I'm usually the one on my phone, and when I'm not the user I'm almost always aware of who the user is and I've granted them permission to access the device. The level of security cannot be not objectivly measured across all threat surfaces or catagories of potential bad actors. The parent poster said "login with phone number" but that should be understood as login with a one time password by demonstating access to the receiving end of a fairly private and relatively difficult to intercept communication channel (physically controlling the client registered to receive messages destined for your phone number on the SS7 network). The authentication factor effectively becomes something have (your phone) whereas a password is something you know which allows for a much larger pool of potential bad actors (with a realistic means of gainig access). SMS factor works more like a physical key your in possesion of that can be used to set a new combination (secret/password) for future access. In practice, combinations (passwords) are forgotten much more often than keys (phones) are lost or compromised.

SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authentication.

Spivak 7y ago

It may very well be bad in absolute terms but compared to a single weak password it’s a huge improvement. I would bet on “log in with phone number” being better than “log in with password” across a population any day.

legohead 7y ago
It's less secure than even passwords. Beyond SIM card cloning, I could sit behind a target, initiate a SMS auth, and simply wait for the guy to look at his phone. Most of the time it will pop up right on the front screen even if locked. If he misses it, I just wait for him to unlock the phone and look at his SMS. How would you like it if passwords just popped up visible to all on your phone?
- drewmol 7y ago
  I'm usually the one on my phone, and when I'm not the user I'm almost always aware of who the user is and I've granted them permission to access the device. The level of security cannot be not objectivly measured across all threat surfaces or catagories of potential bad actors. The parent poster said "login with phone number" but that should be understood as login with a one time password by demonstating access to the receiving end of a fairly private and relatively difficult to intercept communication channel (physically controlling the client registered to receive messages destined for your phone number on the SS7 network). The authentication factor effectively becomes something have (your phone) whereas a password is something you know which allows for a much larger pool of potential bad actors (with a realistic means of gainig access). SMS factor works more like a physical key your in possesion of that can be used to set a new combination (secret/password) for future access. In practice, combinations (passwords) are forgotten much more often than keys (phones) are lost or compromised.