4 ms·
Didn’t we just learn you shouldn’t use SMS 2FA?
by tobyhinloopen 7y ago
Didn’t we just learn you shouldn’t use SMS 2FA?
- reaperducer 7y agoA lot of people say that. But SMS 2FA is better than nothing.
- JshWright 7y agoIs it though? Implementing SMS 2FA often means a site will never bother implementing anything better.
- jimbobimbo 7y agoNot implementing SMS 2FA doesn't mean a site would implement anything either.
- JshWright 7y agoNo, but it's increasingly becoming the expectation that 2FA should be available. Going from no 2FA to some 2FA is a more likely transition than going from bad 2FA to good 2FA (since bad 2FA still checks the 2FA box).
- hombre_fatal 7y agoNope, not if it introduces common customer support backdoors.
- zulln 7y agoIf it is enough with access to the phone number, no password needed, then it is no longer 2FA.
- Thorrez 7y agoSure, but 17 websites do this. For those websites you introduce significant weaknesses if you enable SMS 2FA. https://www.issms2fasecure.com/ https://www.issms2fasecure.com/
- robbya 7y agoSure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA? Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option. Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That would be news to me.
- colechristensen 7y agoThe back door is either automatic or human account recovery tools. These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched. Phone numbers are very public and easy to steal in ways which are difficult to defend against. Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how hard would it be for that person to recover and retain access to their accounts and services? With SMS 2FA someone who knows you personally and has control of your phone number is nearly impossible to escape. All the adversary has to do is say "oh this was linked to my old number" and account support is super likely to just give access away. You would have to be somewhat of an opsec expert to escape that hell, and even if you know everything it becomes impossible to defend yourself against the owners of your accounts giving access away. The only real defense is to never associate your phone number with personal accounts which even then is often not possible.
- robbya 7y ago> Imagine someone in a domestic abuse situation Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think all 2FA can be bypassed with that, if not most of modern cryptography. https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis > having their phone taken Keep in mind that other 2FA methods also are phone based, like TOTP / Google Authenticator. Those also fail if your unlocked phone is taken. SMS is even weaker than those, but still better as a second factor versus nothing.
- colechristensen 7y agoNot really, it becomes very difficult to remove a phone number from an account and anyone who gains access can use various account recovery mechanisms which rely heavily on access to that number for authentication.
- Thorrez 7y agoSMS 2FA introduces problems that no 2FA doesn't have. Sites can start spamming my number with notifications, or using my number for ad targeting.
- philnash 7y agoSMS 2FA is still stronger than no 2FA.
- 9HZZRfNlpR 7y agoTaking over accounts is mainly American thing, the rest of the world is using same method to identify yourself to a telecom company - by providing your ID card or passport.
- sneak 7y agoTwilio offers a service to send SMSes via an API. Of course they're going to tell you to use this.
- sansnomme 7y agoFor low-stakes auth or simply duplicate user prevention SMS is sufficient. E.g. dating apps, sharing economy services, e-commerce sites.