5 ms·
Reminder: SMS 2FA adds only a negligible amount of security, if your company does 2FA via SMS you're doing nothing more than lulling your users into a false sen
by jfrunyon 6y ago
Reminder: SMS 2FA adds only a negligible amount of security, if your company does 2FA via SMS you're doing nothing more than lulling your users into a false sense of security. Don't do it. Support proper 2FA. (And while you're at it, allow your users to decide how much they care about their account. Don't make the decision for them.)
- fckthisguy 6y agoI completely agree. SMS 2FA is, at best, just adding a little hassle for the hacker. If it's not a targeted attack, there's a chance that the extra effort means they'll move on, but that won't stop any remotely determined hacker.
- anaganisk 6y agoAnd isn't that true for most of the people? Still better than nothing right?
- danmur 6y agoI'm not sure it's better, at least not in all cases. If you can reset your password or login without password using SMS, and you had a strong password, it could be worse.
- bsid 6y agothat would be a veryy incorrect implementation of 2FA. Wouldn't be surprised if some service works that way, but would def. be unfortunate
- efreak 6y agoSome services work in exactly this way; it's like using a magic link to log you into a website in the browser from an app on your phone/computer.
- path411 6y agoI agree it's def better than nothing. But I think most end users think 2FA SMS is the equivalent of hiring an armed security guard at your door, not when it's really the equivalent of putting an ADT sign in your front lawn from amazon.
- caskstrength 6y agoA lot of times SMS 2FA significantly degrade security with services that allows you to "recover" access to your account via SMS.
- mrguyorama 6y agoBut then that's not actually 2FA then, is it?
- albertgoeswoof 6y agoThat’s great until your users lose/break their phone and have no backups for their 2FA codes. “Sorry you’re locked out forever, good luck lol” Is not a response you can give to them.
- neartheplain 6y agoPrinted/saved backup codes are still an option. Can also attach multiple 2FA tokens to one account. That's what Google and many others provide. Their customers seem satisfied.
- zaphirplane 6y agoI disabled some 2fa cause I once replaced my phone without following some script to copy across the 2fa app Luckily I was still signed in on a computer
- freebuju 6y ago> Printed/saved backup codes are still an option Vast majority of users don't bother with such complexities. SMS is the easiest minimum entry barrier to 2FA. It is better than having just passwords.
- jfrunyon 6y ago> It is better than having just passwords. That is false. Many incidents have been widely reported where huge names, who certainly could afford even a $50 hardware token to protect their reputation/brand, were 'hacked' because they thought SMS 2FA protected them - and it didn't. Even with services which do also offer TOTP or U2F etc.
- deleted 6y ago[deleted]
- emit_time 6y agoIt is better. It’s just not perfect.
- zajio1am 6y ago> Reminder: SMS 2FA adds only a negligible amount of security I would disagree. Obviously, there are better approaches, but consider basic password auth on desktop, that is easily exploitable en masse by botnets. if you add 2FA via SMS, you would need to exploit both devices (or attack SS7, transfer number or some other trick) and match infos from these devices. Can be done in targetted attack, but harder in en masse botnet attacks.