6 ms·
You don’t need SMS-2FA
- jsnell 6y agohttps://news.ycombinator.com/item?id=23989361 https://news.ycombinator.com/item?id=23989361
- blaser-waffle 6y ago^ Posted yesterday, with more comments. To sum it up: "jasonpeacock 1 day ago [–] He's arguing not just against SMS-2FA, but against 2FA itself, and his simple solution is to "just use a strong password". The author completely misses the point about the value of 2FA itself. I agree SMS-2FA is not good, but that doesn't mean 2FA is worthless. reply"
- thephyber 6y agoYeah, "strong password" is necessary but not sufficient. The knowledge of your password can be leaked but your physical device can't. There are legit arguments against SMS (the cell phone provider's customer support and the SS7 are weak points) and badly implemented 2FA, but 2FA definitely has security value add.
- valuearb 6y agoNot just a string password, but also a unique password. I once ran IT for a small startup (As part of a large portfolio as Ops director), none of the employees put any thought into password security, or cared, no matter whether I set them up with 1password, gave them training sessions, etc.
- hprotagonist 6y agowrong yesterday, wrong today too.
- cxr 6y agoTwo-factor authentication is the "Are you sure you want to X?" pattern applied to logins. While the world has been moving away from that interaction pattern elsewhere, it was simultaneously introducing it in a high-friction way somewhere new. The takeaway from the attempts to eradicate "Are you sure[...]?" has been to just do the thing the user said to do, but make it easy to undo rather than double checking. It would be interesting to see how that philosophy could be applied as an alternative to 2FA. EDIT: Boy, the replies that this comment spawned sure say something about HN. I count one (muxl's) that has any sense of self-awareness. Do you really believe that I don't understand the "purpose of 2FA"? Come on. Be more charitable. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html EDIT2: It's a little weird that folks who start out with the goal of being intellectually lazy are willing to put so much effort into it.
- pythonaut_16 6y agoWait, are you arguing that 2FA is a waste of time/not actually effective? What alternative do you propose then to provide additional security to accounts? Or are you arguing purely in the sense of SMS and Email based 2FA?
- thephyber 6y agoPerhaps, but you're missing the entire purpose of 2FA: the "Are you sure you want to X?" is out of band by definition. The first factor is the things you know: username and password. The second factor is something you have. If a specific 2FA implementation is not out-of-band, that would make it useless as a 2FA and it would be as you describe.
- deleted 6y ago[deleted]
- corin_ 6y agoIt's one thing if I accidentally delete a file without a warning, but can easily undo it. But if someone logs in to access my files without authorisation... they've got them now. I can't click undo on them having read my private emails, or whatever the 2FA/other security was protecting.
- muxl 6y agoOne of the issues ignored here is the nature of cascading failures that happen during a breach due to password reuse. If a user is compromised through an active credential forwarding attack like the one described the user's account could be compromised on that service. Afterward, however, when the user's credentials are re-used by the attacker to access other accounts that attack is made significantly nosier and ineffective as the user would get an SMS for other services using 2FA. TL;DR getting a text message every time someone logs in as you is going mean you're much more aware of what's happening with your accounts. Having that text message contain credentials means if it wasn't you logging in (and hence you weren't expecting an SMS) then the login fails. EDIT: Password managers are great and I'm all for promoting them probably more than 2FA even. The difference between a password manager and 2FA is that a password manager does literally nothing given that your password is known. In that same situation 2FA still does do something and so this appears to be a false dichotomy.
- johnc1 6y agoOne point missed by the article is visibility: even with SMS-2FA, I at least know when my password is being used by someone else (modulo sim-based attacks). For example, if my password manager gets hacked, and a password leaks. I think the overall conclusion is still right: it's a rather minor concern and let's come up with a proper solution and not waste the developers' good will on this one.
- valuearb 6y agoThe big weak point in the authors argument is credential stuffing. They argue fairly convincingly that 2FA is vulnerable to phishing, but concede it prevents credential stuffing. Then they try to argue that credential stuffing doesn’t matter because it can be prevented by using unique passwords, which is the one thing users have been shown to rarely do. 2FA stops credential stuffing cold, that’s important. Also 2FA can stop phishing attacks cold as well, simply by using links instead of codes. So really the author should be using their time to advocate for that.
- miohtama 6y agoThe largest benefit of 2FA is that if your computer gets compromised it does not automatically to lead comprising of the online bank accounts and such. There still needs to be user interaction and a bot cannot read SMSes itself. Often this time window before a user is fooled is enough to neutralise the attack. It prevents massive user account compromise in scale.
- electrum 6y agoThat's not true for SMS-2FA, since text messages are often delivered to the device with the browser. Safari on both macOS and iOS will offer to automatically fill in the code received from SMS.
- miohtama 6y agoBut it is true for Windows PCs that represent more than 90% of compromised devices.
- PopeDotNinja 6y agoThat would be consistent with ~90% marketshare, wouldn't it?
- benibela 6y agoMy Windows/Linux laptop has a SIM card slot But I do not use it because of risk of getting 2FA compromised :/
- ws66 6y agoThis completely ignores the defence in depth principle. Yes it is good that users use strong, unique passwords, but we know the password store can get compromised. A second factor provides additional protection, but it is not foolproof. The network analogy of this post: why use a network firewall, we just need to keep our devices patched and up to date!!
- upofadown 6y ago>Yes it is good that users use strong, unique passwords, but we know the password store can get compromised. The point of the article was that there is no downside if your password is unique. They will have your data on that particular site. The rest of the sites are just as secure as they were. There is no depth here...
- imranhou 6y agoMany valid points, but I would say 2fa does help if malware has your creds buy can't be leveraged by an attacker without also successfully phishing the victim with an identical site.
- nottorp 6y ago"Instead, why not simply randomly generate a good password for them, and instruct them to write it down or save it in their web browser? If they lose it, they can use your existing password reset procedure." Heh. You might as well drop the password and have a 'send the login link to my email" button then. Why is saving the password in your web browser or any application on your machine - that can also be hacked - considered secure? You're just offering an attacker one single attack point that will yield all your passwords if compromised... What about people using multiple machines? Should we sync our password store across all our devices, so there is just one server storing them that can be attacked? And last question, for the SMS-2FA crowd: why would I want my login to depend on my phone number working?
- kabes 6y agoWith your proposed method, the single attack point becomes the email account.
- nottorp 6y agoI know. I was just complaining about generated passwords. Edit: and being forced to depend on a working phone for authentication.
- cordite 6y agoThis is what https://www.fast.co/ https://www.fast.co/ Does
- FabHK 6y ago> Why is saving the password in your web browser or any application on your machine - that can also be hacked - considered secure? So you consider SSH (which normally relies on a private key stored locally) insecure? (Sure, the SSH key can be further protected with a passphrase, but so can the browser database of passwords. On a modern Mac, it requires unlocking with touch ID.)
- nottorp 6y agoSo we have complex secrets that you have to store digitally because you can't memorize. Where? In a secure store. That has access to it protected by a secret you have to store. Digitally because you can't memorize it. And the store where you store the secret for your secure store for your secrets... A touch id protected secret store may be secure, and you lose access to your secrets if your laptop/phone gets stolen or breaks down? Or do you back it up to another store protected by different authentication that you have to store? Looks like you cannot win to me. The only advantage of generated complex passwords is that they'd be harder to brute force if the server has their password database stolen.
- evv 6y agoOrganizations like to identify you by phone number, because it is the easiest way to prevent duplicate identities (Most users have one and only one number to receive SMS messages). Of course it also makes it easier to purchase and sell customer data. For this reason I'd guess that many companies use SMS-2FA as an excuse to collect and confirm your mobile number.
- benibela 6y agoI need SMS-2FA because my bank requires 2FA and their non-SMS crap app does not start on my crap phone And apparently that is the case for all banks in the EU I did my taxes this weekend, and to get to the bank tax statement, I first got 5 SMSs Everything was much better with iTANs. Paper TANs were perfect for me. Someone could hack my Android 4 phone, but no one can hack a piece of paper
- Jnr 6y agoIt is not true that all banks in EU require that. I actually thought that SMS as 2nd factor for Banking is not allowed in EU anymore. All the serious banks that I know of offer asynchronous password tokens (like Digipass), since not everyone trusts those mobile apps, or they simply don't own a smartphone. They don't advertise it too much, since it is easier for the bank to get everyone to use an app, but most of them offer it. If they don't, you should consider changing your bank.
- benibela 6y agoThey offer that, but I do not have a Digipass. So that is something I cannot use just like their app