13 ms·

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recover

by jsnell 5y ago

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

raesene9 5y ago
FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the account. TOTP or hardware tokens don't generally suffer from the same problem.
- addingnumbers 5y ago
  The problem is with most online services, the only second factor allowed is SMS. If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably. It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use SMS alone for password resets, which isn't MFA, is 1FA with a weaker factor than a password. What would you think if someone took you for a joyride in a classic car and said "shoulder belts would be so much better than these lap-only belts, so don't bother buckling up!"
  - raesene9 5y ago
    I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.
    - iso1210 5y ago
      What's the recovery process when your phone gets stolen, or you drop it?
      - raesene9 5y ago
        For me, for TOTP, I use one that backs up to iCloud. that obviously weakens the security, but increases the availability. With some applications, you can add additional devices, so you can add multiple, if you have 'em.
    - addingnumbers 5y ago
      A bad second factor is better than no second factor. I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.
      - profsnuggles 5y ago
        If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.
        addingnumbers 5y ago
        You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.
        profsnuggles 5y ago
        Except you have no way of knowing if that will be the case ahead of time. Unless the first thing you do after enabling 2FA is to social engineer a password reset for your account? Even then that doesn't guarantee that there isn't a more clueless service rep that will make a mistake. Asking before you sign up, "will you allow my account to be hacked through social engineering?" isn't going to an answer other than no. Even if the answer is possibly yes.
  - VRay 5y ago
    Basically every service I've used that requires SMS will use it as the sole authentication factor for resetting your password.. It's brutal
  - realusername 5y ago
    SMS is the only "second factor" that you can't control at all, your phone number can be changed from the phone company at any point, disabled, or suddenly refuse to work in a foreign country (all of those three happened to me). For those reasons, even as a second factor it's a terrible one. SMS is just not a good method of authentication at all and has no place in a login form. At it's best, SMS is only useful as a read-only notification system for non-sensitive purpose.
- UncleMeat 5y ago
  TOTP is phishable, which is a way way way more common attack than sim swaps.
  - 2rsf 5y ago
    phishable how? "your account has been hacked, please provide us a TOTP code"?
    - UncleMeat 5y ago
      1. Somebody loads fakebank.com. 2. It pops up a username/password screen. The user types in their credentials for realbank.com. 3a. The owners of fakebank.com use your creds to log in to realbank.com and are presented with a TOTP page. 3b. fakebank.com loads another page that asks the user for their TOTP. The user enters it, still thinking they are logging in to realbank.com 4. The owners of fakebank.com use the TOTP to authenticate as the user with realbank.com. Entire SDKs to automate this are sold on the black market.
      - sgerenser 5y ago
        Couldn’t this entire scenario play out exactly the same with SMS codes?
        UncleMeat 5y ago
        Yes. The point is the TOTP is precisely as bad as SMS for the common case (phishing) and only safer in a rare case (SIM-swap). This comes with large downsides (losing access). TOTP is, at best, a very marginal improvement over SMS. This is what makes the online push to complain about services that use SMS 2FA and demand a switch to TOTP very strange.
        dheera 5y ago
        TOTP is far, far better for travellers who need to swap their SIM cards frequently, or need to work out of places with internet access but no cell reception.
- mrweasel 5y ago
  > TOTP or hardware tokens don't generally suffer from the same problem. But how many hardware tokens or TOTP tokens are users willing to deal with? I currently have eight for various clients and systems at work. If each online account required a TOTP token or a custom hardware token it would be a confusing mess of tokens. I don't know if there's a safe and easy way of reusing the same token across sites. Until then SMS really is the only "solution".
  - PeterisP 5y ago
    It is safe to use the same U2F token for many sites, that's not an issue. Having a backup token is very useful, but apart from that, a single hardware token (not custom - standards are good) can easily be used to secure all your accounts.
    - mrweasel 5y ago
      Assuming that the sites allow you to change the token manually?
      - tialaramex 5y ago
        I've never seen a site that didn't have at least this. Usually you get a UI where you can add new ones and remove old ones, and when you add a new one you name it in their UI so that you can tell it apart from any others.
    - dheera 5y ago
      The only thing I wish is that more sites support multiple tokens, since tokens can get lost. If you only support one token but have an easy recovery procedure, that opens up loopholes. If you support multiple tokens, allow the user to de-activate one token from another token, and make recovery difficult, that's much more secure.
      - tialaramex 5y ago
        Again, other than AWS which "more sites"? Dropbox, Facebook, Google, GitHub, GitLab, even Login.gov works fine with multiple tokens. More sites should do WebAuthn (you should not do greenfield deployments of U2F today, WebAuthn is the standard). Yes, AWS should fix their feature but that shouldn't block the next ten would-be Unicorns from doing WebAuthn.
staticassertion 5y ago
If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have needed the password too, consider how much more vulnerable you are now that they have a significant piece of your auth - could they leverage that to social engineer an account recovery? Phone numbers are terrible at conveying identity, unfortunately, so bringing them into the "who are you" heuristic is kinda just a net loss.
- baybal2 5y ago
  I want warn people about U2F. U2F is only an authentication tool, not security/encryption one. If you have your smartphone/browser/pc pwned, you are even more screwed than with offline key table/token. For something truly security critical, you need security against MITM on your own device, which only leaves smartcards as an option.
- StavrosK 5y ago
  > Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Not only that, but you can remove the username too: WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.
  - withinboredom 5y ago
    But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.
    - StavrosK 5y ago
      Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine. I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p. Just don't get your password manager stolen, I guess, but that's already the case.
StavrosK 5y ago
> The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene. No, SMS shouldn't be a single factor, period. It doesn't prove much, and is insecure, as the current post shows.
birktj 5y ago
This. SMS is a great second factor and is perfectly suitable to prevent the main attack that you want second factors to prevent: that is if your password appears in a password list for any reason it should stopp anyone from just running away with your account. Note that if you are targeted directly SMS is not going to help you much but in this case maybe your password can (depending on the capabilities of the attacker). Now is SMS the best second factor? Of course not and a proper U2F token will be a lot more secure in many cases but for most people SMS should be perfectly suitable. All this of course requires the auth provider to be somewhat competent and not use SMS as an only factor in any circumstances.
j45 5y ago
SMS will remain vulnerable as long as the mobile accounts that hold them upstream remain vulnerable. One option I’ve heard might be different is to not your your mobile sms on accounts, but to get a voip based sms number. It might leave things at the mercy of a different system but the footprint might be different.
- LinuxBender 5y ago
  I've tried this, but many companies block VoIP numbers for MFA/2FA. Some don't. This works with LinkedIn, but not any companies I have purchased things from.
1cvmask 5y ago
The option for a delay of is great. The option of adding a custom security question/password etc. is even better. The option of completely turning off recovery is also great. The ability to have your solution on multiple devices without a need for a mobile phone number based recovery is great as well. I hate it that Twitter forces you to enter a mobile phone number even when you set up an authenticator code generator as 2FA. Oftentimes the weakest link in most of these services is the account recovery part. When we set up the self service account recovery in saas pass password manager and authenticator we added all of these customizable options to mitigate against potential SIM Swap attacks.
- 1cvmask 5y ago
  More details of customizable recovery and backup and restore is available here with visuals: https://blog.saaspass.com/saaspass-password-manager-authenticator-e44b51de46c8 https://blog.saaspass.com/saaspass-password-manager-authenti...
- vitaflo 5y ago
  On Twitter you can remove your phone number after the fact tho. In fact most sites that req a phone number to sign up etc allow you to remove the phone number later if you choose.
cik 5y ago
Exactly this. Here in Israel, SMS is used extensively as part of a multi-factor authentication system. I also require my National ID. To move my phone number (consent or not) between any phone companies requires an SMS, my National ID, and verification of my ID, and personal details in the government database. SMS by itself is not secure.
- 2rsf 5y ago
  And still numbers are being hijacked even in Israel [1], and even in Sweden, where I live now, I swept my SIM without my ID being properly checked [1] https://www.gov.il/he/departments/news/sim https://www.gov.il/he/departments/news/sim
  - cik 5y ago
    Absolutely. This is the problem - it's not the ideal method.
- tinus_hn 5y ago
  You can’t control some random guy in a provider store giving out a new sim for your account, whether maliciously or because they were deceived.
fulafel 5y ago
This kind of arrangement is often mockingly, but accurately, called 1/2 factor authentication.
exabrial 5y ago
There is no situation where it is good at anything.
sfteus 5y ago
I've posted before on here about my experience getting SIM swapped and how quickly someone was able to gain access to a bunch of my accounts. If I hadn't been at home and looking at my phone while it was happening, it could have been much worse, but thankfully I was able to get in and terminate most of their login sessions before too much damage was done. The one thing I distinctly remember was two of my GMail accounts starting the recovery process. Thankfully, that process apparently gives either 14 or 30 days to stop the recovery and secure my own account. Had I not been connected, that may have been my only saving grace, as I was able to secure those accounts and subsequently use them to recover other compromised accounts. The larger lesson for me was to always use TOTP tokens where possible over SMS, and to completely disable SMS recovery for accounts that didn't have a delay on SMS-only recovery.
vlovich123 5y ago
I got my Uber account taken over this way and I wasn’t using my cell for recovery of anything. SMS is terrible for all these purposes
dheera 5y ago
SMS is not a good second factor, even as a second factor. I deprecated SMS 10 years ago and the only way I receive SMS codes is via an online interface that is password access. For most people, SMS fails miserably when you need to change your SIM card or fly to another country, or work out of a place with no cell reception but has wired or wi-fi internet access. That's a big part of the reason why I deprecated it in favor of e-mail, which works flawlessly anywhere in the world you have an internet connection. I only support U2F or TOTP based 2FA and it's upto providers to get with the beat if they want me to use real 2FA.
- rsgrn 5y ago
  How do you direct SMS to the online interface?
  - dheera 5y ago
    Twilio
an_opabinia 5y ago
I sympathize with the user. It's a little mind boggling though. Securing money with a $15/mo phone plan. It's an extremely ghetto phone service. If anyone's to blame, it's Boost Mobile. Cricket Wireless. Pay for a major carrier plan.
emodendroket 5y ago
This always bothers me. People say "SMS-based 2FA is bad" and then all the reasons they give have nothing to do with 2FA at all.

by jsnell 5y ago

raesene9 5y ago

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the account. TOTP or hardware tokens don't generally suffer from the same problem.

addingnumbers 5y ago
The problem is with most online services, the only second factor allowed is SMS. If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably. It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use SMS alone for password resets, which isn't MFA, is 1FA with a weaker factor than a password. What would you think if someone took you for a joyride in a classic car and said "shoulder belts would be so much better than these lap-only belts, so don't bother buckling up!"
- raesene9 5y ago
  I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.
  - iso1210 5y ago
    What's the recovery process when your phone gets stolen, or you drop it?
    - raesene9 5y ago
      For me, for TOTP, I use one that backs up to iCloud. that obviously weakens the security, but increases the availability. With some applications, you can add additional devices, so you can add multiple, if you have 'em.
  - addingnumbers 5y ago
    A bad second factor is better than no second factor. I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.
    - profsnuggles 5y ago
      If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.
      - addingnumbers 5y ago
        You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.
        profsnuggles 5y ago
        Except you have no way of knowing if that will be the case ahead of time. Unless the first thing you do after enabling 2FA is to social engineer a password reset for your account? Even then that doesn't guarantee that there isn't a more clueless service rep that will make a mistake. Asking before you sign up, "will you allow my account to be hacked through social engineering?" isn't going to an answer other than no. Even if the answer is possibly yes.
- VRay 5y ago
  Basically every service I've used that requires SMS will use it as the sole authentication factor for resetting your password.. It's brutal
- realusername 5y ago
  SMS is the only "second factor" that you can't control at all, your phone number can be changed from the phone company at any point, disabled, or suddenly refuse to work in a foreign country (all of those three happened to me). For those reasons, even as a second factor it's a terrible one. SMS is just not a good method of authentication at all and has no place in a login form. At it's best, SMS is only useful as a read-only notification system for non-sensitive purpose.
UncleMeat 5y ago
TOTP is phishable, which is a way way way more common attack than sim swaps.
- 2rsf 5y ago
  phishable how? "your account has been hacked, please provide us a TOTP code"?
  - UncleMeat 5y ago
    1. Somebody loads fakebank.com. 2. It pops up a username/password screen. The user types in their credentials for realbank.com. 3a. The owners of fakebank.com use your creds to log in to realbank.com and are presented with a TOTP page. 3b. fakebank.com loads another page that asks the user for their TOTP. The user enters it, still thinking they are logging in to realbank.com 4. The owners of fakebank.com use the TOTP to authenticate as the user with realbank.com. Entire SDKs to automate this are sold on the black market.
    - sgerenser 5y ago
      Couldn’t this entire scenario play out exactly the same with SMS codes?
      - UncleMeat 5y ago
        Yes. The point is the TOTP is precisely as bad as SMS for the common case (phishing) and only safer in a rare case (SIM-swap). This comes with large downsides (losing access). TOTP is, at best, a very marginal improvement over SMS. This is what makes the online push to complain about services that use SMS 2FA and demand a switch to TOTP very strange.
        dheera 5y ago
        TOTP is far, far better for travellers who need to swap their SIM cards frequently, or need to work out of places with internet access but no cell reception.
mrweasel 5y ago
> TOTP or hardware tokens don't generally suffer from the same problem. But how many hardware tokens or TOTP tokens are users willing to deal with? I currently have eight for various clients and systems at work. If each online account required a TOTP token or a custom hardware token it would be a confusing mess of tokens. I don't know if there's a safe and easy way of reusing the same token across sites. Until then SMS really is the only "solution".
- PeterisP 5y ago
  It is safe to use the same U2F token for many sites, that's not an issue. Having a backup token is very useful, but apart from that, a single hardware token (not custom - standards are good) can easily be used to secure all your accounts.
  - mrweasel 5y ago
    Assuming that the sites allow you to change the token manually?
    - tialaramex 5y ago
      I've never seen a site that didn't have at least this. Usually you get a UI where you can add new ones and remove old ones, and when you add a new one you name it in their UI so that you can tell it apart from any others.
  - dheera 5y ago
    The only thing I wish is that more sites support multiple tokens, since tokens can get lost. If you only support one token but have an easy recovery procedure, that opens up loopholes. If you support multiple tokens, allow the user to de-activate one token from another token, and make recovery difficult, that's much more secure.
    - tialaramex 5y ago
      Again, other than AWS which "more sites"? Dropbox, Facebook, Google, GitHub, GitLab, even Login.gov works fine with multiple tokens. More sites should do WebAuthn (you should not do greenfield deployments of U2F today, WebAuthn is the standard). Yes, AWS should fix their feature but that shouldn't block the next ten would-be Unicorns from doing WebAuthn.

staticassertion 5y ago

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have needed the password too, consider how much more vulnerable you are now that they have a significant piece of your auth - could they leverage that to social engineer an account recovery? Phone numbers are terrible at conveying identity, unfortunately, so bringing them into the "who are you" heuristic is kinda just a net loss.

baybal2 5y ago
I want warn people about U2F. U2F is only an authentication tool, not security/encryption one. If you have your smartphone/browser/pc pwned, you are even more screwed than with offline key table/token. For something truly security critical, you need security against MITM on your own device, which only leaves smartcards as an option.
StavrosK 5y ago
> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Not only that, but you can remove the username too: WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.
- withinboredom 5y ago
  But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.
  - StavrosK 5y ago
    Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine. I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p. Just don't get your password manager stolen, I guess, but that's already the case.

StavrosK 5y ago

> The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene. No, SMS shouldn't be a single factor, period. It doesn't prove much, and is insecure, as the current post shows.

birktj 5y ago

This. SMS is a great second factor and is perfectly suitable to prevent the main attack that you want second factors to prevent: that is if your password appears in a password list for any reason it should stopp anyone from just running away with your account. Note that if you are targeted directly SMS is not going to help you much but in this case maybe your password can (depending on the capabilities of the attacker). Now is SMS the best second factor? Of course not and a proper U2F token will be a lot more secure in many cases but for most people SMS should be perfectly suitable. All this of course requires the auth provider to be somewhat competent and not use SMS as an only factor in any circumstances.

j45 5y ago

SMS will remain vulnerable as long as the mobile accounts that hold them upstream remain vulnerable. One option I’ve heard might be different is to not your your mobile sms on accounts, but to get a voip based sms number. It might leave things at the mercy of a different system but the footprint might be different.

LinuxBender 5y ago
I've tried this, but many companies block VoIP numbers for MFA/2FA. Some don't. This works with LinkedIn, but not any companies I have purchased things from.

1cvmask 5y ago

The option for a delay of is great. The option of adding a custom security question/password etc. is even better. The option of completely turning off recovery is also great. The ability to have your solution on multiple devices without a need for a mobile phone number based recovery is great as well. I hate it that Twitter forces you to enter a mobile phone number even when you set up an authenticator code generator as 2FA. Oftentimes the weakest link in most of these services is the account recovery part. When we set up the self service account recovery in saas pass password manager and authenticator we added all of these customizable options to mitigate against potential SIM Swap attacks.

1cvmask 5y ago
More details of customizable recovery and backup and restore is available here with visuals: https://blog.saaspass.com/saaspass-password-manager-authenticator-e44b51de46c8 https://blog.saaspass.com/saaspass-password-manager-authenti...
vitaflo 5y ago
On Twitter you can remove your phone number after the fact tho. In fact most sites that req a phone number to sign up etc allow you to remove the phone number later if you choose.

cik 5y ago

Exactly this. Here in Israel, SMS is used extensively as part of a multi-factor authentication system. I also require my National ID. To move my phone number (consent or not) between any phone companies requires an SMS, my National ID, and verification of my ID, and personal details in the government database. SMS by itself is not secure.

2rsf 5y ago
And still numbers are being hijacked even in Israel [1], and even in Sweden, where I live now, I swept my SIM without my ID being properly checked [1] https://www.gov.il/he/departments/news/sim https://www.gov.il/he/departments/news/sim
- cik 5y ago
  Absolutely. This is the problem - it's not the ideal method.
tinus_hn 5y ago
You can’t control some random guy in a provider store giving out a new sim for your account, whether maliciously or because they were deceived.

fulafel 5y ago

This kind of arrangement is often mockingly, but accurately, called 1/2 factor authentication.

exabrial 5y ago

There is no situation where it is good at anything.

sfteus 5y ago

I've posted before on here about my experience getting SIM swapped and how quickly someone was able to gain access to a bunch of my accounts. If I hadn't been at home and looking at my phone while it was happening, it could have been much worse, but thankfully I was able to get in and terminate most of their login sessions before too much damage was done. The one thing I distinctly remember was two of my GMail accounts starting the recovery process. Thankfully, that process apparently gives either 14 or 30 days to stop the recovery and secure my own account. Had I not been connected, that may have been my only saving grace, as I was able to secure those accounts and subsequently use them to recover other compromised accounts. The larger lesson for me was to always use TOTP tokens where possible over SMS, and to completely disable SMS recovery for accounts that didn't have a delay on SMS-only recovery.

vlovich123 5y ago

I got my Uber account taken over this way and I wasn’t using my cell for recovery of anything. SMS is terrible for all these purposes

dheera 5y ago

SMS is not a good second factor, even as a second factor. I deprecated SMS 10 years ago and the only way I receive SMS codes is via an online interface that is password access. For most people, SMS fails miserably when you need to change your SIM card or fly to another country, or work out of a place with no cell reception but has wired or wi-fi internet access. That's a big part of the reason why I deprecated it in favor of e-mail, which works flawlessly anywhere in the world you have an internet connection. I only support U2F or TOTP based 2FA and it's upto providers to get with the beat if they want me to use real 2FA.

rsgrn 5y ago
How do you direct SMS to the online interface?
- dheera 5y ago
  Twilio

an_opabinia 5y ago

I sympathize with the user. It's a little mind boggling though. Securing money with a $15/mo phone plan. It's an extremely ghetto phone service. If anyone's to blame, it's Boost Mobile. Cricket Wireless. Pay for a major carrier plan.

emodendroket 5y ago

This always bothers me. People say "SMS-based 2FA is bad" and then all the reasons they give have nothing to do with 2FA at all.