3 ms·

2FA is only as good as the company that employs it otherwise it just gives people a false sense of security and privacy.

by kanobo 6y ago

war1025 6y ago
I've become pretty convinced that sms-based 2FA is an anti-pattern. I've seen too many articles and anecdotes about sim-swap attacks to feel at all comfortable trusting sms as an authentication method.
- snazz 6y ago
  So long as the UI surrounding the SMS 2FA setup process makes it clear that strong passwords are as important as ever, I think it's still easily a net positive for the vast majority of people. Of course, the better solution is Google's default two-step verification flow, which involves sending a push notification to your phone and tapping Yes in Gmail. That's both easier and more secure, since SMS is taken out of the process. Think about it this way: for an attacker trying to compromise more than one account, SMS-based 2FA makes it significantly more expensive to perform the attack. It certainly isn't much help as the victim of a targeted attack, but it makes account takeovers much more difficult in 99% of cases.
- strictnein 6y ago
  SMS 2FA is still superior to nothing. Most account compromises aren't because of SIM swapping. Phishing, password spraying, and (especially) password reuse are the most common and SMS 2FA completely defeats the latter two and makes the first one harder. Most people/groups who phish are pretty technically inept so they struggle to automate things like OTP capture/use, so they're stuck doing it live, and that obviously doesn't scale well.
  - war1025 6y ago
    > SMS 2FA is still superior to nothing. It's better than nothing, but given that it's trivial to go from that to just an authenticator app, I would personally not have any of my accounts set up to accept sms 2FA. Of course, the best thing would be for people to use actual passwords instead of "Watermelon23", but that's easier said than done.
- mindslight 6y ago
  This is the standard pattern of every new security technique ("2FA" in this case). Once it becomes an industry buzzword, snake oil vendors get busy coming up with ways of technically supplying the buzzword without the difficulties inherent to the actual security. When sites require this crap, I give them a phone number that forwards to my email. If my desktop computer gets owned, I've got much bigger problems than some fraudulent bank transactions.

2FA is only as good as the company that employs it otherwise it just gives people a false sense of security and privacy.

by kanobo 6y ago

2FA is only as good as the company that employs it otherwise it just gives people a false sense of security and privacy.

war1025 6y ago

I've become pretty convinced that sms-based 2FA is an anti-pattern. I've seen too many articles and anecdotes about sim-swap attacks to feel at all comfortable trusting sms as an authentication method.

snazz 6y ago
So long as the UI surrounding the SMS 2FA setup process makes it clear that strong passwords are as important as ever, I think it's still easily a net positive for the vast majority of people. Of course, the better solution is Google's default two-step verification flow, which involves sending a push notification to your phone and tapping Yes in Gmail. That's both easier and more secure, since SMS is taken out of the process. Think about it this way: for an attacker trying to compromise more than one account, SMS-based 2FA makes it significantly more expensive to perform the attack. It certainly isn't much help as the victim of a targeted attack, but it makes account takeovers much more difficult in 99% of cases.
strictnein 6y ago
SMS 2FA is still superior to nothing. Most account compromises aren't because of SIM swapping. Phishing, password spraying, and (especially) password reuse are the most common and SMS 2FA completely defeats the latter two and makes the first one harder. Most people/groups who phish are pretty technically inept so they struggle to automate things like OTP capture/use, so they're stuck doing it live, and that obviously doesn't scale well.
- war1025 6y ago
  > SMS 2FA is still superior to nothing. It's better than nothing, but given that it's trivial to go from that to just an authenticator app, I would personally not have any of my accounts set up to accept sms 2FA. Of course, the best thing would be for people to use actual passwords instead of "Watermelon23", but that's easier said than done.
mindslight 6y ago
This is the standard pattern of every new security technique ("2FA" in this case). Once it becomes an industry buzzword, snake oil vendors get busy coming up with ways of technically supplying the buzzword without the difficulties inherent to the actual security. When sites require this crap, I give them a phone number that forwards to my email. If my desktop computer gets owned, I've got much bigger problems than some fraudulent bank transactions.