9 ms·

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have needed the password too, consider how much more vulnerable you are now that they have a significant piece of your auth - could they leverage that to social engineer an account recovery? Phone numbers are terrible at conveying identity, unfortunately, so bringing them into the "who are you" heuristic is kinda just a net loss.

baybal2 5y ago
I want warn people about U2F. U2F is only an authentication tool, not security/encryption one. If you have your smartphone/browser/pc pwned, you are even more screwed than with offline key table/token. For something truly security critical, you need security against MITM on your own device, which only leaves smartcards as an option.
StavrosK 5y ago
> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Not only that, but you can remove the username too: WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.
- withinboredom 5y ago
  But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.
  - StavrosK 5y ago
    Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine. I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p. Just don't get your password manager stolen, I guess, but that's already the case.
Wowfunhappy 5y ago
> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.
- staticassertion 5y ago
  > Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's super shitty. That doesn't mean that SMS 2FA is a good idea - the fact that it can actually reduce your security is very problematic.
  - darkwater 5y ago
    > In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.
    - staticassertion 5y ago
      > Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability. So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.
      - Wowfunhappy 5y ago
        A phone's TPM is the only U2F token that 99% of the world owns, assuming they own one at all.
UncleMeat 5y ago
SMS adds friction to password stuffing. Given that a gazillion people do not use unique passwords, this has some value. It is possible that if we spent more time as a community encouraging the use of password managers that the net improvement in security posture would be greater, but this does remain a nontrivial benefit of SMS.
contravariant 5y ago
You can only use a U2F token at the only factor when it's acceptable for you to temporarily lose control of the account.
ozim 5y ago
If you have strong generated passwords that are different for each system and you use password manager then you would not need 2FA at all. Well maybe if it is for system that stores your password in plain text but who would be stupid to keep user password in plain text and slap 2FA on top of it. U2F and 2FA came to life just because people are bad at making passwords and remembering them. Making non technical people to use password manager with generating passwords for each page is still hard. Making non technical people use SMS as a second factor is easy. Making non technical people use tokens is still hard. There is a lot of value in having SMS 2FA still, yes you can phish it or you can hijack the number. But that is argument like: "there is no point in having any security at all because if you install malware on your computer you will get hacked". Yes SMS alone is not going to save you, but people have phones and understand that they type code that comes via SMS to the phone number they provided when registering. Barrier to entry for it is so trivial that I think it still has value. Barrier to entry to take over someones phone is not high but random kid on the street is not going to do that just like random kid that can find your email + de-hashed password from database dumps. If you have someone who is motivated to get you then probably given enough time they will get you anyway. So take into account what that SMS 2FA prevents and what issues it is solving. Don't just throw it away.
- ozim 5y ago
  Just to add to my comment: It might be confusing but that was account recovery attack. For account recovery there is no "password" as thieves just made their own password while having victim phone number. So phone number as a password recovery option is not secure without any additional checks. Not 2FA because with this attack there was no second factor.
- Termiux 5y ago
  Hahahaha you would be surprised my current employer is thinking of introducing 2FA and yeah every pass is stored in plain text. I've been trying to make them change this for years, also the passwords are limited to 20 chars yeah.... security is shit here
emodendroket 5y ago
Are we comparing it to a token though? Or are we comparing it to nothing?

baybal2 5y ago

I want warn people about U2F. U2F is only an authentication tool, not security/encryption one. If you have your smartphone/browser/pc pwned, you are even more screwed than with offline key table/token. For something truly security critical, you need security against MITM on your own device, which only leaves smartcards as an option.

StavrosK 5y ago

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Not only that, but you can remove the username too: WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.

withinboredom 5y ago
But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.
- StavrosK 5y ago
  Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine. I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p. Just don't get your password manager stolen, I guess, but that's already the case.

Wowfunhappy 5y ago

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

staticassertion 5y ago
> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's super shitty. That doesn't mean that SMS 2FA is a good idea - the fact that it can actually reduce your security is very problematic.
- darkwater 5y ago
  > In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.
  - staticassertion 5y ago
    > Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability. So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.
    - Wowfunhappy 5y ago
      A phone's TPM is the only U2F token that 99% of the world owns, assuming they own one at all.

UncleMeat 5y ago

SMS adds friction to password stuffing. Given that a gazillion people do not use unique passwords, this has some value. It is possible that if we spent more time as a community encouraging the use of password managers that the net improvement in security posture would be greater, but this does remain a nontrivial benefit of SMS.

contravariant 5y ago

You can only use a U2F token at the only factor when it's acceptable for you to temporarily lose control of the account.

ozim 5y ago

If you have strong generated passwords that are different for each system and you use password manager then you would not need 2FA at all. Well maybe if it is for system that stores your password in plain text but who would be stupid to keep user password in plain text and slap 2FA on top of it. U2F and 2FA came to life just because people are bad at making passwords and remembering them. Making non technical people to use password manager with generating passwords for each page is still hard. Making non technical people use SMS as a second factor is easy. Making non technical people use tokens is still hard. There is a lot of value in having SMS 2FA still, yes you can phish it or you can hijack the number. But that is argument like: "there is no point in having any security at all because if you install malware on your computer you will get hacked". Yes SMS alone is not going to save you, but people have phones and understand that they type code that comes via SMS to the phone number they provided when registering. Barrier to entry for it is so trivial that I think it still has value. Barrier to entry to take over someones phone is not high but random kid on the street is not going to do that just like random kid that can find your email + de-hashed password from database dumps. If you have someone who is motivated to get you then probably given enough time they will get you anyway. So take into account what that SMS 2FA prevents and what issues it is solving. Don't just throw it away.

ozim 5y ago
Just to add to my comment: It might be confusing but that was account recovery attack. For account recovery there is no "password" as thieves just made their own password while having victim phone number. So phone number as a password recovery option is not secure without any additional checks. Not 2FA because with this attack there was no second factor.
Termiux 5y ago
Hahahaha you would be surprised my current employer is thinking of introducing 2FA and yeah every pass is stored in plain text. I've been trying to make them change this for years, also the passwords are limited to 20 chars yeah.... security is shit here

emodendroket 5y ago

Are we comparing it to a token though? Or are we comparing it to nothing?