4 ms·
The big weak point in the authors argument is credential stuffing. They argue fairly convincingly that 2FA is vulnerable to phishing, but concede it prevents cr
by valuearb 6y ago
The big weak point in the authors argument is credential stuffing. They argue fairly convincingly that 2FA is vulnerable to phishing, but concede it prevents credential stuffing. Then they try to argue that credential stuffing doesn’t matter because it can be prevented by using unique passwords, which is the one thing users have been shown to rarely do. 2FA stops credential stuffing cold, that’s important.
Also 2FA can stop phishing attacks cold as well, simply by using links instead of codes. So really the author should be using their time to advocate for that.
- miohtama 6y agoThe largest benefit of 2FA is that if your computer gets compromised it does not automatically to lead comprising of the online bank accounts and such. There still needs to be user interaction and a bot cannot read SMSes itself. Often this time window before a user is fooled is enough to neutralise the attack. It prevents massive user account compromise in scale.
- electrum 6y agoThat's not true for SMS-2FA, since text messages are often delivered to the device with the browser. Safari on both macOS and iOS will offer to automatically fill in the code received from SMS.
- miohtama 6y agoBut it is true for Windows PCs that represent more than 90% of compromised devices.
- PopeDotNinja 6y agoThat would be consistent with ~90% marketshare, wouldn't it?
- benibela 6y agoMy Windows/Linux laptop has a SIM card slot But I do not use it because of risk of getting 2FA compromised :/
- valuearb 6y agoI am curious as to how Safari connects the 2FA code to the web page. It would seem whatever they are doing could easily implement a database that maps 2FA SMS messages to domains, not only refusing to auto enter them on phishing sites; but warning the user they may be on one.
- ThePowerOfFuet 6y agoIt doesn't; it offers to autofill a received code into a field on the page for a short time, but only actually fills it upon user interaction (so the page can't be sniffing for it via JS the moment it arrives).
- phjesusthatguy3 6y ago2FA can, but SMS-2FA depends on your cell provider being resilient to attacks, which they have proven they aren't.
- toast0 6y agoIf attacking my X account requires also attacking my SMS provider account, it doesn't make it impossible to attack my account. However, telecom hacks are often more involved, and take more effort to pull off. If I'm a high value target, it's not a big hurdle. If I'm a low value target, I might not be worth it.
- jopsen 6y agoTrue, but U2F is still a better choice. While telcos may eventually fix the broken protocols, it's likely to be decades before that has rolled out widely. In the meantime attackers are going to automate telecom hacks.. why not? That said, for simple services sending a single use password by email or SMS is quite easy :) My hairdresser does so for reservations, and it's working out fine.. Nobody cares of that account is hacked anyways.
- toast0 6y ago> In the meantime attackers are going to automate telecom hacks.. why not? A lot of telecom hacks are social engineering, which often leaves an audit trail, and is hard to automate (if they're using the same text to speech engine that makes spam calls, good luck!)
- jopsen 6y agoSMS spoofing is certainly automated today. Stealing SMS messages, maybe less so.. but from what I hear the protocol is largely trust based, so it's unclear that it couldn't be. That said, eventually telcoms will be forced to fix this. I'm just guessing it'll take another decade or two.. it's not like robocalls were trivially fixed when they became annoying.
- 6y ago
- kabes 6y agoAlso this part is very weak: > When a service enables SMS-2FA, an attacker can simply move to a different service. This means that a new attack isn’t necessary, just a new service. If you implement 2FA you do it to protect the user account on your service, not all services.
- FabHK 6y agoYes, that was a weak argument. How is that not analogous to: "Password hashing and salting is useless. When a service enables password hashing and salting, an attacker can simply move to a different service that stores passwords in plain text. This means that a new attack isn’t necessary, just a new service."
- 33Backpack33 6y agoThis article does a better job of explaining how SMS 2FA doesn't solve the credential stuffing problem. https://passwordbits.com/dont-need-sms-2fa/ https://passwordbits.com/dont-need-sms-2fa/