5 ms·

Having username+password+sms is strictly safer than having username+password. To require the attacker to know your phone number and do costly and/or time consu

• asiachick 6y ago
  It is? I thought the problem with SMS is you click "forgot password" and they send you a code via SMS to reset your password. Therefore username+password is safer than username+password+sms because username+password+sms = username (no password)
  • hansel_der 6y ago
    i agree that username+sms is not good, but what are the other password reset vectors more secure than sms?
    • caskstrength 6y ago
      Almost anything (with exception of "3 easily googleable questions about you") is safer than sms. For example, emailing password reset link to my gmail account that is protected with real 2fa.
      • lxgr 6y ago
        Yes, and besides being more secure it is also more available: I'm much more likely to be able to receive email when resetting a password than I am to have cell reception and have the correct SIM card in my phone. (Examples for access to email but not SMS include: International travel, airplane Wi-Fi, bad cell signal.) I feel like much of what's wrong with SMS 2FA comes down to a misguided idea of "everyone has exactly one phone number", which is simply not true for a lot of people.
  • wccrawford 6y ago
    I think you mean: username+password+sms = username+sms (no password) But I agree, and would take it a step further: username+password+sms = username+sms || username+password And in the worst scenarios: username+password+sms = sms || username+password And the same goes for email instead of SMS as well, in most scenarios.
    • 33Backpack33 6y ago
      username + unique password would be better than all the other options listed. Adding SMS seems to add new points of attack that either hurt the user or just delays the hurting.
• dataflow 6y ago
  Not quite. It's only safer if your single priority in the world is protecting that one account. But you need to account for the larger blast radius too: it also turns your SMS, phone line, and other things that revolve around them into actual attack targets, when they weren't previously. The increased potential for collateral damage can very well not be worth it.
  • MaxBarraclough 6y ago
    Also, it gains increased security at the cost increased chance of lockout. Water damage to your phone may now be enough to prevent you from signing in.
    • ehnto 6y ago
      It's notoriously difficult to regain access to many types of accounts, but that's in part because of how little we verify ourselves in the first place.
    • alistairSH 6y ago
      Water damage would also prevent access to MFA apps like Google Authenticator. And many/most people (world-wide) are accessing the web through their mobile device anyways - so damaged phone = no web access. That leaves us with physical keys, which the average consumer probably doesn't want to carry around all the time (easy enough to keep on keychain, but most people don't carry keys around their own home).
      • falcolas 6y ago
        Google Auth can be backed up (via a QR code), and it works fine on two devices simultaneously. Most places that offer 2FA auth apps also offer backup codes, which can be stored in any password manager, or offline in a little black book.
      • ghgdynb1 6y ago
        I use 1Password for my mfa; I can access my one time passcodes from any device I’m signed in on, and my passwords and secondary authentication are conveniently managed together. If issues like water damage or losing your device are concerns for you, their service might be worth checking out. Disclaimer: I’m very far from a cybersecurity expert.
• rawfan 6y ago
  Nah. If I know your phone number, I hack you voicemail box in no time and then I can just access your Paypal account and you can do nothing against it. Just because you added a phone number to that account.
  • hutzlibu 6y ago
    Yeah. That would be a targeted attack and not something a script kiddie can do.
• scottmcdot 6y ago
  It's not safer if SMS can be used as a recovery method.
  • HenryBemis 6y ago
    Yes, this. Is SMS used as a login/OTP (additional to your password - e.g. to make a bank transaction), or can be used as a 'trojan'/backdoor to compromise your account?
    • fanf2 6y ago
      And even if SMS starts off being just a second factor, it often gets changed to be used for account resets too, so it becomes a single vulnerable factor.
• gspr 6y ago
  > Having username+password+sms is strictly safer than having username+password. As someone else pointed out: that's not true if the SMS authentication can be used to recover the password. But let's for the sake of discussion rule those cases out. Then yes, SMS verification does perhaps add a tiny bit of "security" to the process for the reason you describe. But that tiny bit of security has to be weighed against the enormous extra burden placed on the users performing the (far more plentiful) legitimate logins. Than burden may well be worth it if a lot of extra security is gained. I think it's definitely not for the "security" provided by SMS.
  • 33Backpack33 6y ago
    When you consider SMS 2FA is often used to fix the poor or reused password problem we see it's not helping much at all but only delaying the problem.
    • ryanlol 6y ago
      That’s bullshit, nobody is going to bother with attacks like this to steal your uber or doordash account. SMS 2fa kills credential stuffing attacks for all but the highest value targets.
      • 33Backpack33 6y ago
        You do know uber and doordash accounts are hacked all the time because of password reuse? There is a huge black market for hacked accounts from doordash and the like.
        • ryanlol 6y ago
          That’s my point. These accounts are worth a couple of dollars, nobody would spend $50 on a hacked uber or doordash account. These accounts are only worth anything as long as they’re cheaper and easier to use than stolen credit cards.
          • 6y ago
• jjav 6y ago
  > Having username+password+sms is strictly safer than having username+password. No, it is unfortunately actually much worse. If the account only has name+password and you use a properly good password, nobody will ever guess it (within the lifetime of the universe and all that). But if the account also has a phone number and the attacker can trigger an SMS challenge to reset the password, now your wonderfully complex password is meaningless. The attackers just intercepts the SMS and done, they own the account. It is equivalent to the problem of allowing "security questions" with trivially discoverable answers. A site may enforce 20+ character passwords (great!) but then forces user to enter the name of their best friend in high school (trivially findable in e.g. facebook for most people) and lets any attacker bypass the password with just the so-called security questions, rendering the strong password meaningless.