8 ms·

I am sympathetic to claims that 2FA over SMS is better than nothing, because technically it is completely true. You're right. However, as a user, I go back to

I am sympathetic to claims that 2FA over SMS is better than nothing, because technically it is completely true. You're right. However, as a user, I go back to the idea that I can't think of many companies I trust to only use my phone number as 2FA and not as identity verification. So I'm am skeptical that it is good to train users to trust SMS 2FA, because those same users will probably not be able to distinguish between 2FA and identity verification when they sign up for other services. It is better to teach users a simple rule (never give out your phone number) than a complex rule (only give out your number for this specific use-case). The other big thing I just can't get past is that nearly everyone today has a smartphone that will run a 2FA app, and that even users who don't have a smartphone would be better served by getting codes delivered to their email. So sure, it's better than nothing. But there are even better options that exist that aren't that hard for us to switch to. In practice, even if you know you're only going to use SMS for 2FA, I now lean towards saying you shouldn't use SMS at all. Treat email like the backup SMS option, and just get rid of phone numbers entirely. Maybe the dynamics of that change for some developing countries? But Twitter, Facebook, and Amazon all know what country I live in. If they want to offer an SMS option for India because of some extenuating circumstance I can't think of, they should still have the good sense to at least discourage SMS verification for accounts that are based in the USA or Europe.

beerandt 7y ago
Yeah, this is basically the same thing that happened with social security numbers. Companies promised only to use it to verify they had the correct credit file, but +/- 90 years later it's a defacto ID that no longer has any security value. Edit: I suppose phone numbers can at least be changed, but that doesn't really solve the problem for 2fa as it might for SS numbers.
laughinghan 7y ago
> nearly everyone today has a smartphone that will run a 2FA app What do they do when their smartphone dies? The phone company makes sure your new phone has the same phone number, but you lose 2FA tokens in apps. And I have no idea where the recovery codes that I printed on paper are since I last moved. > even users who don't have a smartphone would be better served by getting codes delivered to their email But then isn't that just one factor instead of two factors, because both their password for the service and their email password are just "something you know"? I'm assuming if they have no cell phone, they don't have a second factor to secure their email either.
- danShumway 7y ago
  This is a reasonable concern, and users should be aware of the risks behind real 2FA. But if you really dig into this, it starts to fall apart. > The phone company makes sure your new phone has the same phone number This is exactly why 2-factor SMS is insecure. You mention later that email is something you know, instead of something you have. In the same way, if a company can transfer my number to a new phone without access to the original phone, then it's not really something I have. The ease of number transfers are the problem. The reason why 2FA tokens aren't stored online and secured with a password is because they are designed to be something you have, not something you know. For comparison, switching your number to Verizon only requires information that you know (account numbers, a SSN)[0], so it's just extra steps around a less secure password that you can't change or set yourself. > But then isn't that just one factor instead of two factors Expanding on the above -- yes, email is often going to be just another account secured with another password. In practice, hacking two accounts is often harder than hacking one, and in practice, I suspect breaking into someone's Gmail account is harder than stealing their phone number. Google offers much more comprehensive 2FA options than most other companies, and their automated security alerts also tend to be better. But there's no reason for us to debate over how secure email is. The situation we have today with companies like Amazon/Facebook/Twitter is one where I can already request a password reset without SMS. Companies are scared of strict 2FA methods because customers get locked out of their accounts. Very, very few of them are willing to take that risk, so email will virtually always be an option. SMS is being added on top of that system -- it's not replacing it. Here's Twitter's account recovery help page[1]: > If you do not receive anything back, get help with Twitter via SMS or use the email password reset option. So if you consider email to be a weak link in identity verification/2FA, adding SMS verification as a secondary option alongside email still doesn't do anything to increase your security. In fact, even if SMS was as secure as email, forcing you to monitor two authentication methods instead of just one would still be less secure. I'm not advocating email is perfect, I'm just advocating that SMS is less secure than email, and that since companies are already comfortable trusting email, they can continue to rely on that. Of course if you really want to set up 2FA to literally be 'something you have', then you need to accept that things you have can be lost. And if you're not willing to make that compromise, at least email accounts are harder to hack than phone numbers, because the most common email providers are probably more resistant than Verizon to social engineering attacks. [0]: https://www.verizonwireless.com/support/local-number-portability-faqs/ https://www.verizonwireless.com/support/local-number-portabi... [1]: https://help.twitter.com/en/managing-your-account/forgotten-or-lost-password-reset https://help.twitter.com/en/managing-your-account/forgotten-...
TheSpiceIsLife 7y ago
> It is better to teach users a simple rule (never give out your phone number) What is this supposed to mean? What is the point of having a phone number if you never give it out? I suppose you can make outbound calls only with own number sending turned off, but that sort of diminishes the purpose of owning a phone number?
- danShumway 7y ago
  Never give out your phone number [for security purposes]. In other words, if a company tells you they need your number for account security, refuse to give it to them. Of course you can give out a phone number for general contact purposes. I think it's easier to teach people phone numbers can't be used for security, period, then to teach them that phone numbers can be used for security in one very specific case -- especially since companies like Facebook/Twitter rarely use terms like 2FA when asking users for their number. They just say stuff like, "you'll use this to gain access to your account" or, "we'll use this to help keep your account secure." It wasn't my intention to make it sound like users should never tell anyone their number for any reason, but I can definitely see how it might read that way.

beerandt 7y ago

Yeah, this is basically the same thing that happened with social security numbers. Companies promised only to use it to verify they had the correct credit file, but +/- 90 years later it's a defacto ID that no longer has any security value. Edit: I suppose phone numbers can at least be changed, but that doesn't really solve the problem for 2fa as it might for SS numbers.

laughinghan 7y ago

> nearly everyone today has a smartphone that will run a 2FA app What do they do when their smartphone dies? The phone company makes sure your new phone has the same phone number, but you lose 2FA tokens in apps. And I have no idea where the recovery codes that I printed on paper are since I last moved. > even users who don't have a smartphone would be better served by getting codes delivered to their email But then isn't that just one factor instead of two factors, because both their password for the service and their email password are just "something you know"? I'm assuming if they have no cell phone, they don't have a second factor to secure their email either.

danShumway 7y ago
This is a reasonable concern, and users should be aware of the risks behind real 2FA. But if you really dig into this, it starts to fall apart. > The phone company makes sure your new phone has the same phone number This is exactly why 2-factor SMS is insecure. You mention later that email is something you know, instead of something you have. In the same way, if a company can transfer my number to a new phone without access to the original phone, then it's not really something I have. The ease of number transfers are the problem. The reason why 2FA tokens aren't stored online and secured with a password is because they are designed to be something you have, not something you know. For comparison, switching your number to Verizon only requires information that you know (account numbers, a SSN)[0], so it's just extra steps around a less secure password that you can't change or set yourself. > But then isn't that just one factor instead of two factors Expanding on the above -- yes, email is often going to be just another account secured with another password. In practice, hacking two accounts is often harder than hacking one, and in practice, I suspect breaking into someone's Gmail account is harder than stealing their phone number. Google offers much more comprehensive 2FA options than most other companies, and their automated security alerts also tend to be better. But there's no reason for us to debate over how secure email is. The situation we have today with companies like Amazon/Facebook/Twitter is one where I can already request a password reset without SMS. Companies are scared of strict 2FA methods because customers get locked out of their accounts. Very, very few of them are willing to take that risk, so email will virtually always be an option. SMS is being added on top of that system -- it's not replacing it. Here's Twitter's account recovery help page[1]: > If you do not receive anything back, get help with Twitter via SMS or use the email password reset option. So if you consider email to be a weak link in identity verification/2FA, adding SMS verification as a secondary option alongside email still doesn't do anything to increase your security. In fact, even if SMS was as secure as email, forcing you to monitor two authentication methods instead of just one would still be less secure. I'm not advocating email is perfect, I'm just advocating that SMS is less secure than email, and that since companies are already comfortable trusting email, they can continue to rely on that. Of course if you really want to set up 2FA to literally be 'something you have', then you need to accept that things you have can be lost. And if you're not willing to make that compromise, at least email accounts are harder to hack than phone numbers, because the most common email providers are probably more resistant than Verizon to social engineering attacks. [0]: https://www.verizonwireless.com/support/local-number-portability-faqs/ https://www.verizonwireless.com/support/local-number-portabi... [1]: https://help.twitter.com/en/managing-your-account/forgotten-or-lost-password-reset https://help.twitter.com/en/managing-your-account/forgotten-...

TheSpiceIsLife 7y ago

> It is better to teach users a simple rule (never give out your phone number) What is this supposed to mean? What is the point of having a phone number if you never give it out? I suppose you can make outbound calls only with own number sending turned off, but that sort of diminishes the purpose of owning a phone number?

danShumway 7y ago
Never give out your phone number [for security purposes]. In other words, if a company tells you they need your number for account security, refuse to give it to them. Of course you can give out a phone number for general contact purposes. I think it's easier to teach people phone numbers can't be used for security, period, then to teach them that phone numbers can be used for security in one very specific case -- especially since companies like Facebook/Twitter rarely use terms like 2FA when asking users for their number. They just say stuff like, "you'll use this to gain access to your account" or, "we'll use this to help keep your account secure." It wasn't my intention to make it sound like users should never tell anyone their number for any reason, but I can definitely see how it might read that way.