9 ms·

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method com

So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable.

sildur 6y ago
The hatred is because it costs 16 dollars to take over a number: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...
- mysterydip 6y ago
  Even easier are the sites that do this: "Please enter the phone number where we should send your one-time 2FA code: [_______]" I've had that happen on more than one site. Surely anyone who stole my password would just put in their own number?
  - elcomet 6y ago
    They would surely compare the number to the one they have registered, right ?
    - sodality2 6y ago
      You'd think they would make it more clear ("verify your 2fa number"). Maybe they want to bait criminals into entering their own or something.
    - whatastory 6y ago
      Google oftentimes doesn't. One of my accounts requires a phone number to verify every single time I login. I have no clue why, and it accepts absolutely any phone number. I have no clue what the purpose is aside from forcing me to give sensitive information to other people when my phone isn't available or I'm traveling (which I've been forced to do already).
      - alanfranz 6y ago
        You didn’t set a 2fa in that account. So they ask for a phone number to correlate the login.
supermatt 6y ago
I don’t think anyone hates SMS 2FA in general, just that it is susceptible to MITM attacks (snooping/interception) than other solutions (device, key, app) as is made clear in this article. I note, however, that this attack seems to only be possible on VOIP routable numbers, and it’s my experience that banks, etc, will not allow you to use VOIP routable numbers for 2FA. That’s definitely not the case for a naive implementation of sms 2fa as would be done by likely any dev using Twilio, etc.
- zapdrive 6y ago
  I hate sms because most 2FA services don't deliver to VoIP numbers.
- supermatt 6y ago
  Further reading suggests this isn’t just voip numbers!
pabs3 6y ago
Probably the SIM porting attacks, where telco employees are vulnerable to being socially engineered to letting an attacker port your phone number over to another device. Also this new attack, which is more stealthy.
- michael_j_x 6y ago
  But that is not really true for most countries. In my country, to get a sim ported you need to go to the shop and present your identification.
  - baybal2 6y ago
    Well, if somebody can mess with ss7 they wouldn't need even that.
  - bawolff 6y ago
    Social engineering is all about convincing people to do things they aren't supposed to do.
  - flemhans 6y ago
    Same here (Denmark with Hi3G), but they often forget. I've had a new SIM issued for myself just by saying the phone number. Of course that's several orders of magnitudes harder to do than just finding a leaked password somewhere, so it's still nice to have SMS as 2FA compared to nothing. It'll stop the mass bots.
  - jfrunyon 6y ago
    In all countries, you have but to prove to some lowly paid telco employee's satisfaction that you are the owner of the number. That is not a serious impediment.
- eythian 6y ago
  Some countries resolve the porting issue by having a list of numbers that have been ported, so that banks (for example) can check that and not rely on it if the port happened in the past two weeks (also, for example.)
devwastaken 6y ago
SMS is not secure, that's why. Police have used special devices to intercept messages on a broad scale without any warrent, which means individuals can too. Service providers are well known to send "replacement" sim cards out to people who then use it to access 2FA accounts. Happened to H3H3 on YouTube. Phone numbers in general are insecure. There is no enforced verification system - people can receive calls from their own phone number, and people can fake the presented numbers. There is such a significant amount of spam callers as well. The FCC doesnt care. The entire phone system in the U.S. needs to be remade with security, but powers that be really don't want that.
- alickz 6y ago
  > Happened to H3H3 on YouTube Also same attack vector used to get access to Jack Dorsey's Twitter account I believe.
bawolff 6y ago
I dont think this is a one sided debate. Pro: SMS 2FA is better than just passwords. In practise 2FA is primarily a hedge against credential surfing, with its other security properties more theoretical than practical, and it mostly works good enough for that use case. (Perfect is the enemy of good) Con: there's lots of attacks related to social engineering the telecom into transfering your phone number. Real people have been compromised this way albeit this attack is pretty targeted. There is also some concerns about evesdropping/mitm attacks. This is pretty unrealistic in my mind. If you're an on-path attacker for someone's cell phone convo that implies you have direct access to the victim, so the victim is pretty screwed regardless. So in the end its a usability vs security tradeoff. Its a pretty close tradeoff so its not exactly a slam dunk in either direction.
- _trampeltier 6y ago
  No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.
  - ClumsyPilot 6y ago
    So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.
    - hlandau 6y ago
      "Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear. By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is. Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox can only be accessed by me over an SSH tunnel is truly laughable. In fact since sites which demand phone numbers seem to have some completely baseless idea that the phone number is somehow more "secure" than email, often adding a phone number will enable phone number-based recovery methods which therefore actually reduce account security.
colechristensen 6y ago
There are several methods of hard and soft attack which are stupidly easy where ability to temporarily capture your phone number is the only necessary authentication factor. SMS isn’t used as an additional layer but the only necessary layer to “recover” an account.
- unscaled 6y ago
  This is not emphasized enough. Many companies enable SMS both as a second authentication factor AND a single-factor account recovery mechanism. As bad as passwords, savvy users can use a password manager and generate unique high-entropy passwords, but if the web site is forcing SMS on you, you lose all that security and now have to rely on vulnerable telco infra that is out of your control and was never built to facilitate authentication.
quicklime 6y ago
I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to log in to Airbnb to message a host, transfer some cash from my bank account, access my frequent flyer account, etc. Far too many sites don't provide 2FA over email, or through an app like Google Authenticator - they can only do it over SMS. Yeah, I know I could set up roaming. But it's an easy thing to forget, since I change phone numbers every couple of years (for both personal and work phones). And it's not always cheap. It's also just a huge pain to have to go through and change every account I have, any time I change numbers. A lot of accounts that I only use occasionally are configured with one of my many old phone numbers, which don't work anymore. This usually involves a call to tech support to fix it.
- RileyJames 6y ago
  Absolutely this. I currently have a document from my bank, that they emailed me. Which I’m suppose to print, write all my personal info on, plus a copy of my passport and FAX to them!! All because I want to change my phone number, and I’m overseas. Which I only need to change (or even have associated with my account at all) because they refuse to offer any other 2FA option.
- chrismorgan 6y ago
  I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn on and check the old phone I left with them, because roaming for a year is expensive and otherwise pointless (I barely use a phone), but transferring my number to a prepaid Amaysim SIM let me keep it alive and mine for the year for $10. Actually, the myGov thing was a real piece of work. They offer secret questions as a second factor that you can opt to use instead of SMS codes (and yes, secret questions are stupid), but when I did that, it silently unlinked my Australian Tax Office account. I tried to link it up again (a bit of a pain in its own right), and it told me that ATO has decided that it won’t let you link it up if you use secret questions as the second factor technique. Seriously. So I had to switch back. Oh yeah, they do also have a third option, an app of their own that can generate codes (not TOTP), but that app had something like 2 stars on Google Play Store, with many reviews saying it didn’t work at all, so I didn’t even bother trying that. When I’m in Australia with my phone handy, SMS verification seems not too bad, but when out of the country and not roaming, it may vary between very inconvenient and completely debilitating.
Andrew_nenakhov 6y ago
In russia it is common for authorities to temporary switch phone to another sim card, then switch it back without user even noticing it. This method was widely used to target dissidents and access their accounts. To sum it, 2fa via sms gives only an illusion of safety.
- ClumsyPilot 6y ago
  I think thats a different threat level, an app that manages shopping coupons doesnt need to worry about russian government taking their "10% off" code
bigiain 6y ago
You might want to ask some of your greybeard coworkers... https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...
herbst 6y ago
You never own the number. It could anytime go to someone else without notice (most contracts contain that line) and if you do not pay for only a few months its very likely someone else suddenly gets your 2fa. Using phones is honestly a huge security issue
kabdib 6y ago
SMS 2FA costs money per message. It's also subject to telecom rules -- you usually need to buy short codes by geography if you're sending at scale, and that involves dealing with bureaucracies at scale, too. Getting a short code can take weeks and cost thousands of dollars. Of course you can always pay to have other people do that management for you. But you're going to pay, nonetheless. Then you have to worry about fraud, and whether telcos in <random country> have been hacked, or are corrupt, and are leaking messages to bad guys. I've seen entire (small) countries drop out, too. Usually the way you find out about this is that support notices an uptick in users in <smallish country> complaining about not getting messages, or you notice that the entirety of some geography isn't successfully completing the transactions you tried to protect with SMS. Er, you did consult the (changing) prefix database and phone number parser to (semi) reliably determine a geography from a phone number, right? Isn't parsing phone numbers fun? It's fractally terrible and expensive, and I haven't even talked about APIs yet.
- southerntofu 6y ago
  > SMS 2FA costs money per message. This is only because the telephone cartels control the networks. The same is more or less true of Internet. Operators have advocated for anti-open-wifi laws across the globe so they can sell their internet access plans (xDSL/3G), when we could have free networking for all in all places. Seriously though, why couldn't we have FREE privacy-friendly networking as a public service?
  - toopok4k3 6y ago
    Why? Here you have to buy access to certain frequency ranges(big money required). The bidding happens from time to time. Building the network infrastructure is not cheap either and requires specialists to work for you. I'd rather buy that 4G from a company that can deliver it everywhere I go than move backwards in progress to use some random WIFI hosted by Joe that fights over the same frequency as John's across the road. The "cartel" networks work pretty good tbh. They just have stagnated in everything else but networking.
heroprotagonist 6y ago
Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app. Like Microsoft Authenticator. It wanted way too many permissions on my phone, and provided less security than my Yubikey authenticator. My yubikey provides a standard open OTP but requires the device to generate it (phone tap or plugin via USB to computer or phone). Open standards are better. I don't want a different authenticator app for every website. It's so much simpler to use a single app.
- corty 6y ago
  Microsoft Authenticator can be replaced by any app that does standard OTP, e.g. FreeOTP+.
  - heroprotagonist 6y ago
    Oh nice, I just checked my account and it has the option now. It didn't when I last looked a couple years ago. I'm glad they added this. Thanks for the heads up! Still, the principle stands for a number of other sites. eg, Steam (using their app or email), Twitch (authy or bust), etc. I'd rather use an open standard than be limited to a custom or specific authenticator.
- sodality2 6y ago
  TOTP is definitely an open standard. https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
ksec 6y ago
I actually love SMS 2FA ( And the rare few on HN ). It is the simplest form of 2FA that non-tech people will actually understand and use. Unless people want to argue 1FA is better than crappy 2FA. SMS gets hatred especially in US because of how easy it is to socially engineer their way for SIM replacement or other SMS uses. Mostly because for unknown reason US has the absolute worst MNO in the world. In other places SMS replacement requires official forms to be filled as well as physical presence. It doesn't matter whether SMS is a form of 2FA of not, getting my SIM card without decent form of protection from Carrier is wrong in the first place. And RCS doesn't seems / want / willing to replace SMS anytime soon. Carrier have little incentive to do so. It is backed by Google which means not everyone is on board including Apple. And GSMA has no intention to make a better SMS either.
- Mauricebranagh 6y ago
  Having built a system to handle SMS for a previous employer about 10 years ago the US's fractured mobile phone system did not help back then you could not reliably deliver SMS across systems. Unfortunately yet another example of the US's poor regulation of telecoms receiver pays is another example.
corty 6y ago
SMS has no security at all. SMS is not properly encrypted over the air, GSM and UMTS encryption is broken and often misconfigured anyways. There is no way to check and no guarantee that a SMS will be transmitted in a safe encryption protocol, i.e. no way to force LTE. And given the level of brokenness in GSM and UMTS, I wouldn't rely too much on LTE or 5G crypto being worth anything. End-to-end encryption isn't provided anyways. Also, phone numbers are not terribly secure either. The control protocol for mobile networks, SS7, is a steaming heap of excrement without any consideration for security. There are numerous ways to redirect SMS and calls into the hands of criminals, which have been demonstrated over and over by researchers. Also, this is regularly being abused by the police, secret services and criminals. As a customer, you are completely at the mercy of the phone network to do the proper mitigation dance because SS7 is inherently broken and cannot be fixed, just maybe firewalled off (a little, but not too much...): https://attack.mitre.org/techniques/T1449/ https://attack.mitre.org/techniques/T1449/ Then there is a whole lot of social engineering cases to take over numbers and SIM cards which others have described nearby. With 2FA via a proper app or even open protocols like TOTP, I can verify and trust much more of the auth flow. Properly done, I only need to trust the endpoints and (maybe, if used, with TOTP even that is unnecessary) the TLS connection. With SMS, I need to trust a whole lot of telcos between the endpoints, their firewalls, IDSs, (mis-)configurations, all their service providers and their employees not to fiddle with things. And actually, all of the aforementioned have repeatedly proven untrustworthy by using broken, outdated, and known-to-be-insecure technology.
0xbadcafebee 6y ago
SMS is fine for 2FA for Reddit. It's not fine when it protects things that have financial repercussions. But that's when we actually need strong 2FA. It's been proven time and again that cyber criminals frequently target people using SMS 2FA to steal from them. Most implementations of 2FA might as well be 1FA. People might even use worse passwords when they think 2FA protects them. I think the adoption of SMS as a "universal 2FA" was not worth it. We should've just gotten people used to the less easy but more secure methods. U2F bluetooth keyfob on my keychain would be good enough for my phone and PC. Remote access seems like the hardest nut to crack.
tomjen3 6y ago
SMS 2f is only used to collect phone numbers. There is already an open standard called TOTP that people can use, and which requires no special access and isn't locked to any PII.
simonebrunozzi 6y ago
Here's a parable, from personal experience [0]. TL;DR: my mobile phone number (not the phone itself) was hacked, then my Twitter account. The attacker changed my Twitter handle from @simon to @simonsw9kww. I eventually recovered my @simon twitter account, after several MONTHS and several emails and calls to twitter support and friends working at Twitter. Is this enough for you? [0]: https://simon.medium.com/mobile-twitter-hacked-please-help-2f65c691edf8 https://simon.medium.com/mobile-twitter-hacked-please-help-2...
jfrunyon 6y ago
SMS is completely insecure. Not only can it be passively sniffed along the way, not only can malicious actors reroute your number, not only can pretty much any employee at your telco access it, not only can pretty much any employee at your telco get tricked into rerouting it, but by default (and therefore for the vast majority of users), it'll show up while the phone is locked! It's equivalent to taping your key to your back door. Sure, someone has to go to your back door first to see it, but then they're in.
dkersten 6y ago
SMS is not at all secure. My first out-of-uni programming job was working on SMS value-add services for mobile networks (mostly anti-spam, anti-fraud, anti-spoofing type stuff and roam steering, but also parental controls and other stuff). It was crazy what weird things we could bend the network to. Obviously, our services ran on the network itself, so had more access than a typical end user, but the protocols have zero built in security, everything on the network was totally open, spoofing is trivial (we could detect much of it with our software, but definitely not all -- mostly all we could do was consistency checks, but if you carefully crafted a fake packet, there's nothing we could do). As others have stated, the over-the-air encryption is often.. not good.. so getting access SMS like we had seems very possible. And since its not end-to-end encrypted, a bad actor within the network could also trivially access messages (we could! we even intercepted some of our own messages for testing, it would have been a simple regex to read other people's messages). This was ~15 years ago, but I doubt much has changed.
grey-area 6y ago
I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable. The article gives plenty of examples. Here they are as links: https://www.vice.com/en/article/a37epb/t-mobile-alert-victims-sim-card-hack https://www.vice.com/en/article/a37epb/t-mobile-alert-victim... https://www.vice.com/en/article/xyezmn/we-were-warned-about-flaws-in-the-mobile-data-backbone-for-years-now-2fa-is-screwed https://www.vice.com/en/article/xyezmn/we-were-warned-about-... https://www.vice.com/en/article/mg7bd4/how-a-hacker-can-take-over-your-life-by-hijacking-your-phone-number https://www.vice.com/en/article/mg7bd4/how-a-hacker-can-take... https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... The latest is the most severe, in summary - a gaping flaw in SMS lets hackers take over phone numbers in minutes by simply paying a company to reroute text messages. So if you insert SMS 2FA in your security chain as a fallback authentication method, you're leaving it wide open to exploits and none of your other 2FA security like TOTP or tokens matters, because the attacker can just take over a customer/admin account using the SMS authentication to prove they are the user concerned then change those methods. In some cases you'll require an email as well, and in some you'll manage to send an email to that old email address before it can be changed, but many places don't, particularly mobile apps tend to rely on the phone number, and most people don't monitor every email address 24/7, so lots of damage can be done in a short period. SMS really needs to be fixed and it's really debatable whether it adds security or subtracts security in the meantime, even in a layered approach.
mooreds 6y ago
I wrote up a long article on a number of ways to do MFA. https://fusionauth.io/learn/expert-advice/authentication/multi-factor-authentication/ https://fusionauth.io/learn/expert-advice/authentication/mul... In looking around, a few things became clear: * the tech industry hates SMS * there are some common social engineering and a few network level attacks that SMS allows * it's widely deployed and supported * it's a heck of a lot better than nothing I think the title of the original article is a bit absurd. That's like saying "It's time to stop using passwords for security." Sure, you can say that, but your grandma will still have a sticky note of passwords next to her computer. Defense in depth without relying entirely on the user to secure their systems makes a lot of sense to me. Ban SMS if you aren't worried about adoption of MFA (for example, because you are a corporation and can mandate TOTP). Otherwise find ways to work with it.
jjav 6y ago
As the article explains, SMS is just plain insecure. So attempting to rely on it for MFA is worse than nothing (worse, because it allows attackers to lock out legitimate user). Ignoring security (not that we should), it's just a massive pain from a pragmatic point of view. As others note, right when an SMS MFA is triggered is most of the time when I can't receive an SMS, so everything breaks when I actually need access. Much easier solutions exist today at more convenient adoption at scale, like email and TOTP.

sildur 6y ago

The hatred is because it costs 16 dollars to take over a number: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

mysterydip 6y ago
Even easier are the sites that do this: "Please enter the phone number where we should send your one-time 2FA code: [_______]" I've had that happen on more than one site. Surely anyone who stole my password would just put in their own number?
- elcomet 6y ago
  They would surely compare the number to the one they have registered, right ?
  - sodality2 6y ago
    You'd think they would make it more clear ("verify your 2fa number"). Maybe they want to bait criminals into entering their own or something.
  - whatastory 6y ago
    Google oftentimes doesn't. One of my accounts requires a phone number to verify every single time I login. I have no clue why, and it accepts absolutely any phone number. I have no clue what the purpose is aside from forcing me to give sensitive information to other people when my phone isn't available or I'm traveling (which I've been forced to do already).
    - alanfranz 6y ago
      You didn’t set a 2fa in that account. So they ask for a phone number to correlate the login.

supermatt 6y ago

I don’t think anyone hates SMS 2FA in general, just that it is susceptible to MITM attacks (snooping/interception) than other solutions (device, key, app) as is made clear in this article. I note, however, that this attack seems to only be possible on VOIP routable numbers, and it’s my experience that banks, etc, will not allow you to use VOIP routable numbers for 2FA. That’s definitely not the case for a naive implementation of sms 2fa as would be done by likely any dev using Twilio, etc.

zapdrive 6y ago
I hate sms because most 2FA services don't deliver to VoIP numbers.
supermatt 6y ago
Further reading suggests this isn’t just voip numbers!

pabs3 6y ago

Probably the SIM porting attacks, where telco employees are vulnerable to being socially engineered to letting an attacker port your phone number over to another device. Also this new attack, which is more stealthy.

michael_j_x 6y ago
But that is not really true for most countries. In my country, to get a sim ported you need to go to the shop and present your identification.
- baybal2 6y ago
  Well, if somebody can mess with ss7 they wouldn't need even that.
- bawolff 6y ago
  Social engineering is all about convincing people to do things they aren't supposed to do.
- flemhans 6y ago
  Same here (Denmark with Hi3G), but they often forget. I've had a new SIM issued for myself just by saying the phone number. Of course that's several orders of magnitudes harder to do than just finding a leaked password somewhere, so it's still nice to have SMS as 2FA compared to nothing. It'll stop the mass bots.
- jfrunyon 6y ago
  In all countries, you have but to prove to some lowly paid telco employee's satisfaction that you are the owner of the number. That is not a serious impediment.
eythian 6y ago
Some countries resolve the porting issue by having a list of numbers that have been ported, so that banks (for example) can check that and not rely on it if the port happened in the past two weeks (also, for example.)

devwastaken 6y ago

SMS is not secure, that's why. Police have used special devices to intercept messages on a broad scale without any warrent, which means individuals can too. Service providers are well known to send "replacement" sim cards out to people who then use it to access 2FA accounts. Happened to H3H3 on YouTube. Phone numbers in general are insecure. There is no enforced verification system - people can receive calls from their own phone number, and people can fake the presented numbers. There is such a significant amount of spam callers as well. The FCC doesnt care. The entire phone system in the U.S. needs to be remade with security, but powers that be really don't want that.

alickz 6y ago
> Happened to H3H3 on YouTube Also same attack vector used to get access to Jack Dorsey's Twitter account I believe.

bawolff 6y ago

I dont think this is a one sided debate. Pro: SMS 2FA is better than just passwords. In practise 2FA is primarily a hedge against credential surfing, with its other security properties more theoretical than practical, and it mostly works good enough for that use case. (Perfect is the enemy of good) Con: there's lots of attacks related to social engineering the telecom into transfering your phone number. Real people have been compromised this way albeit this attack is pretty targeted. There is also some concerns about evesdropping/mitm attacks. This is pretty unrealistic in my mind. If you're an on-path attacker for someone's cell phone convo that implies you have direct access to the victim, so the victim is pretty screwed regardless. So in the end its a usability vs security tradeoff. Its a pretty close tradeoff so its not exactly a slam dunk in either direction.

_trampeltier 6y ago
No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.
- ClumsyPilot 6y ago
  So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.
  - hlandau 6y ago
    "Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear. By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is. Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox can only be accessed by me over an SSH tunnel is truly laughable. In fact since sites which demand phone numbers seem to have some completely baseless idea that the phone number is somehow more "secure" than email, often adding a phone number will enable phone number-based recovery methods which therefore actually reduce account security.

colechristensen 6y ago

There are several methods of hard and soft attack which are stupidly easy where ability to temporarily capture your phone number is the only necessary authentication factor. SMS isn’t used as an additional layer but the only necessary layer to “recover” an account.

unscaled 6y ago
This is not emphasized enough. Many companies enable SMS both as a second authentication factor AND a single-factor account recovery mechanism. As bad as passwords, savvy users can use a password manager and generate unique high-entropy passwords, but if the web site is forcing SMS on you, you lose all that security and now have to rely on vulnerable telco infra that is out of your control and was never built to facilitate authentication.

quicklime 6y ago

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to log in to Airbnb to message a host, transfer some cash from my bank account, access my frequent flyer account, etc. Far too many sites don't provide 2FA over email, or through an app like Google Authenticator - they can only do it over SMS. Yeah, I know I could set up roaming. But it's an easy thing to forget, since I change phone numbers every couple of years (for both personal and work phones). And it's not always cheap. It's also just a huge pain to have to go through and change every account I have, any time I change numbers. A lot of accounts that I only use occasionally are configured with one of my many old phone numbers, which don't work anymore. This usually involves a call to tech support to fix it.

RileyJames 6y ago
Absolutely this. I currently have a document from my bank, that they emailed me. Which I’m suppose to print, write all my personal info on, plus a copy of my passport and FAX to them!! All because I want to change my phone number, and I’m overseas. Which I only need to change (or even have associated with my account at all) because they refuse to offer any other 2FA option.
chrismorgan 6y ago
I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn on and check the old phone I left with them, because roaming for a year is expensive and otherwise pointless (I barely use a phone), but transferring my number to a prepaid Amaysim SIM let me keep it alive and mine for the year for $10. Actually, the myGov thing was a real piece of work. They offer secret questions as a second factor that you can opt to use instead of SMS codes (and yes, secret questions are stupid), but when I did that, it silently unlinked my Australian Tax Office account. I tried to link it up again (a bit of a pain in its own right), and it told me that ATO has decided that it won’t let you link it up if you use secret questions as the second factor technique. Seriously. So I had to switch back. Oh yeah, they do also have a third option, an app of their own that can generate codes (not TOTP), but that app had something like 2 stars on Google Play Store, with many reviews saying it didn’t work at all, so I didn’t even bother trying that. When I’m in Australia with my phone handy, SMS verification seems not too bad, but when out of the country and not roaming, it may vary between very inconvenient and completely debilitating.

Andrew_nenakhov 6y ago

In russia it is common for authorities to temporary switch phone to another sim card, then switch it back without user even noticing it. This method was widely used to target dissidents and access their accounts. To sum it, 2fa via sms gives only an illusion of safety.

ClumsyPilot 6y ago
I think thats a different threat level, an app that manages shopping coupons doesnt need to worry about russian government taking their "10% off" code

bigiain 6y ago

You might want to ask some of your greybeard coworkers... https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...

herbst 6y ago

You never own the number. It could anytime go to someone else without notice (most contracts contain that line) and if you do not pay for only a few months its very likely someone else suddenly gets your 2fa. Using phones is honestly a huge security issue

kabdib 6y ago

SMS 2FA costs money per message. It's also subject to telecom rules -- you usually need to buy short codes by geography if you're sending at scale, and that involves dealing with bureaucracies at scale, too. Getting a short code can take weeks and cost thousands of dollars. Of course you can always pay to have other people do that management for you. But you're going to pay, nonetheless. Then you have to worry about fraud, and whether telcos in <random country> have been hacked, or are corrupt, and are leaking messages to bad guys. I've seen entire (small) countries drop out, too. Usually the way you find out about this is that support notices an uptick in users in <smallish country> complaining about not getting messages, or you notice that the entirety of some geography isn't successfully completing the transactions you tried to protect with SMS. Er, you did consult the (changing) prefix database and phone number parser to (semi) reliably determine a geography from a phone number, right? Isn't parsing phone numbers fun? It's fractally terrible and expensive, and I haven't even talked about APIs yet.

southerntofu 6y ago
> SMS 2FA costs money per message. This is only because the telephone cartels control the networks. The same is more or less true of Internet. Operators have advocated for anti-open-wifi laws across the globe so they can sell their internet access plans (xDSL/3G), when we could have free networking for all in all places. Seriously though, why couldn't we have FREE privacy-friendly networking as a public service?
- toopok4k3 6y ago
  Why? Here you have to buy access to certain frequency ranges(big money required). The bidding happens from time to time. Building the network infrastructure is not cheap either and requires specialists to work for you. I'd rather buy that 4G from a company that can deliver it everywhere I go than move backwards in progress to use some random WIFI hosted by Joe that fights over the same frequency as John's across the road. The "cartel" networks work pretty good tbh. They just have stagnated in everything else but networking.

heroprotagonist 6y ago

Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app. Like Microsoft Authenticator. It wanted way too many permissions on my phone, and provided less security than my Yubikey authenticator. My yubikey provides a standard open OTP but requires the device to generate it (phone tap or plugin via USB to computer or phone). Open standards are better. I don't want a different authenticator app for every website. It's so much simpler to use a single app.

corty 6y ago
Microsoft Authenticator can be replaced by any app that does standard OTP, e.g. FreeOTP+.
- heroprotagonist 6y ago
  Oh nice, I just checked my account and it has the option now. It didn't when I last looked a couple years ago. I'm glad they added this. Thanks for the heads up! Still, the principle stands for a number of other sites. eg, Steam (using their app or email), Twitch (authy or bust), etc. I'd rather use an open standard than be limited to a custom or specific authenticator.
sodality2 6y ago
TOTP is definitely an open standard. https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238

ksec 6y ago

I actually love SMS 2FA ( And the rare few on HN ). It is the simplest form of 2FA that non-tech people will actually understand and use. Unless people want to argue 1FA is better than crappy 2FA. SMS gets hatred especially in US because of how easy it is to socially engineer their way for SIM replacement or other SMS uses. Mostly because for unknown reason US has the absolute worst MNO in the world. In other places SMS replacement requires official forms to be filled as well as physical presence. It doesn't matter whether SMS is a form of 2FA of not, getting my SIM card without decent form of protection from Carrier is wrong in the first place. And RCS doesn't seems / want / willing to replace SMS anytime soon. Carrier have little incentive to do so. It is backed by Google which means not everyone is on board including Apple. And GSMA has no intention to make a better SMS either.

Mauricebranagh 6y ago
Having built a system to handle SMS for a previous employer about 10 years ago the US's fractured mobile phone system did not help back then you could not reliably deliver SMS across systems. Unfortunately yet another example of the US's poor regulation of telecoms receiver pays is another example.

corty 6y ago

SMS has no security at all. SMS is not properly encrypted over the air, GSM and UMTS encryption is broken and often misconfigured anyways. There is no way to check and no guarantee that a SMS will be transmitted in a safe encryption protocol, i.e. no way to force LTE. And given the level of brokenness in GSM and UMTS, I wouldn't rely too much on LTE or 5G crypto being worth anything. End-to-end encryption isn't provided anyways. Also, phone numbers are not terribly secure either. The control protocol for mobile networks, SS7, is a steaming heap of excrement without any consideration for security. There are numerous ways to redirect SMS and calls into the hands of criminals, which have been demonstrated over and over by researchers. Also, this is regularly being abused by the police, secret services and criminals. As a customer, you are completely at the mercy of the phone network to do the proper mitigation dance because SS7 is inherently broken and cannot be fixed, just maybe firewalled off (a little, but not too much...): https://attack.mitre.org/techniques/T1449/ https://attack.mitre.org/techniques/T1449/ Then there is a whole lot of social engineering cases to take over numbers and SIM cards which others have described nearby. With 2FA via a proper app or even open protocols like TOTP, I can verify and trust much more of the auth flow. Properly done, I only need to trust the endpoints and (maybe, if used, with TOTP even that is unnecessary) the TLS connection. With SMS, I need to trust a whole lot of telcos between the endpoints, their firewalls, IDSs, (mis-)configurations, all their service providers and their employees not to fiddle with things. And actually, all of the aforementioned have repeatedly proven untrustworthy by using broken, outdated, and known-to-be-insecure technology.

0xbadcafebee 6y ago

SMS is fine for 2FA for Reddit. It's not fine when it protects things that have financial repercussions. But that's when we actually need strong 2FA. It's been proven time and again that cyber criminals frequently target people using SMS 2FA to steal from them. Most implementations of 2FA might as well be 1FA. People might even use worse passwords when they think 2FA protects them. I think the adoption of SMS as a "universal 2FA" was not worth it. We should've just gotten people used to the less easy but more secure methods. U2F bluetooth keyfob on my keychain would be good enough for my phone and PC. Remote access seems like the hardest nut to crack.

tomjen3 6y ago

SMS 2f is only used to collect phone numbers. There is already an open standard called TOTP that people can use, and which requires no special access and isn't locked to any PII.

simonebrunozzi 6y ago

Here's a parable, from personal experience [0]. TL;DR: my mobile phone number (not the phone itself) was hacked, then my Twitter account. The attacker changed my Twitter handle from @simon to @simonsw9kww. I eventually recovered my @simon twitter account, after several MONTHS and several emails and calls to twitter support and friends working at Twitter. Is this enough for you? [0]: https://simon.medium.com/mobile-twitter-hacked-please-help-2f65c691edf8 https://simon.medium.com/mobile-twitter-hacked-please-help-2...

jfrunyon 6y ago

SMS is completely insecure. Not only can it be passively sniffed along the way, not only can malicious actors reroute your number, not only can pretty much any employee at your telco access it, not only can pretty much any employee at your telco get tricked into rerouting it, but by default (and therefore for the vast majority of users), it'll show up while the phone is locked! It's equivalent to taping your key to your back door. Sure, someone has to go to your back door first to see it, but then they're in.

dkersten 6y ago

SMS is not at all secure. My first out-of-uni programming job was working on SMS value-add services for mobile networks (mostly anti-spam, anti-fraud, anti-spoofing type stuff and roam steering, but also parental controls and other stuff). It was crazy what weird things we could bend the network to. Obviously, our services ran on the network itself, so had more access than a typical end user, but the protocols have zero built in security, everything on the network was totally open, spoofing is trivial (we could detect much of it with our software, but definitely not all -- mostly all we could do was consistency checks, but if you carefully crafted a fake packet, there's nothing we could do). As others have stated, the over-the-air encryption is often.. not good.. so getting access SMS like we had seems very possible. And since its not end-to-end encrypted, a bad actor within the network could also trivially access messages (we could! we even intercepted some of our own messages for testing, it would have been a simple regex to read other people's messages). This was ~15 years ago, but I doubt much has changed.

grey-area 6y ago

I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable. The article gives plenty of examples. Here they are as links: https://www.vice.com/en/article/a37epb/t-mobile-alert-victims-sim-card-hack https://www.vice.com/en/article/a37epb/t-mobile-alert-victim... https://www.vice.com/en/article/xyezmn/we-were-warned-about-flaws-in-the-mobile-data-backbone-for-years-now-2fa-is-screwed https://www.vice.com/en/article/xyezmn/we-were-warned-about-... https://www.vice.com/en/article/mg7bd4/how-a-hacker-can-take-over-your-life-by-hijacking-your-phone-number https://www.vice.com/en/article/mg7bd4/how-a-hacker-can-take... https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... The latest is the most severe, in summary - a gaping flaw in SMS lets hackers take over phone numbers in minutes by simply paying a company to reroute text messages. So if you insert SMS 2FA in your security chain as a fallback authentication method, you're leaving it wide open to exploits and none of your other 2FA security like TOTP or tokens matters, because the attacker can just take over a customer/admin account using the SMS authentication to prove they are the user concerned then change those methods. In some cases you'll require an email as well, and in some you'll manage to send an email to that old email address before it can be changed, but many places don't, particularly mobile apps tend to rely on the phone number, and most people don't monitor every email address 24/7, so lots of damage can be done in a short period. SMS really needs to be fixed and it's really debatable whether it adds security or subtracts security in the meantime, even in a layered approach.

mooreds 6y ago

I wrote up a long article on a number of ways to do MFA. https://fusionauth.io/learn/expert-advice/authentication/multi-factor-authentication/ https://fusionauth.io/learn/expert-advice/authentication/mul... In looking around, a few things became clear: * the tech industry hates SMS * there are some common social engineering and a few network level attacks that SMS allows * it's widely deployed and supported * it's a heck of a lot better than nothing I think the title of the original article is a bit absurd. That's like saying "It's time to stop using passwords for security." Sure, you can say that, but your grandma will still have a sticky note of passwords next to her computer. Defense in depth without relying entirely on the user to secure their systems makes a lot of sense to me. Ban SMS if you aren't worried about adoption of MFA (for example, because you are a corporation and can mandate TOTP). Otherwise find ways to work with it.

jjav 6y ago

As the article explains, SMS is just plain insecure. So attempting to rely on it for MFA is worse than nothing (worse, because it allows attackers to lock out legitimate user). Ignoring security (not that we should), it's just a massive pain from a pragmatic point of view. As others note, right when an SMS MFA is triggered is most of the time when I can't receive an SMS, so everything breaks when I actually need access. Much easier solutions exist today at more convenient adoption at scale, like email and TOTP.