4 ms·
But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are
by jsnell 5y ago
But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security.
There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch.
For most of the world, SMS is it. The Nordic countries have the bank if system. But the market is too small. Hopefully the EU-wide identity verification systems solve the scale problem.
- staticassertion 5y ago> SMS as a second factor is purely additive. It cannot reduce security. I responded to this in another post. > There is pretty much no form of second factor that users are worse at passing than backup codes. Agreed, I also mentioned backup U2F. At this point modern smart phones package TPMs that can also do attestation, so we're really not too far away from being in a situation where the vast majority of people have a U2F token in their pocket.
- rocqua 5y ago> Some form of trust that can be bootstrapped again from scratch. This is not using it as a second factor. It is using it as the only factor. Having SMS as the only factor is not purely additive. As such it can (and obviously does) reduce security. Account recovery is hard, SMS is quite usable there, but way to insecure to be the only basis for bootstrapping account recovery.
- jsnell 5y agoI don't really understand why you think I'm advocating for SMS as the only factor, when I very clearly wrote the exact opposite. Let's say that you remember your password, but your house just burned down. You cannot replace the U2F keys and backup codes that were lost in flames. But you almost certainly can bootstrap your real life identity far enough to get a replacement SIM. Which, in combination with your password, should be enough to get your digital identity back.
- sgerenser 5y agoExcept in practice, most providers (even those that should know better, like Google) allow use of SMS, ostensibly set up as a “second factor,” to be used for account recovery without knowing the password. Making it, in practice, 1FA.
- rocqua 5y agoConfusion about the word bootstrapping. I read "bootstrapping trust" as regaining trust based solely on SMS. But indeed, sms as a second factor is much easier to recover in catastrophic situations than some other second factors. That is a fair point, and an advantage of sms over other common second factors.
- paulpauper 5y agoIt can reduce security if password can be reset with SMS
- FabHK 5y agoThat's the whole point of GP: SMS is perfectly fine as a second factor, and terrible if it can serve as the only one factor.
- tialaramex 5y ago> SMS as a second factor is purely additive. It cannot reduce security. You are forgetting social engineering. Humans find it reassuring that the security process happened as usual, even if in fact the apparently "usual" process was them being being phished. This can mean they're actually less alert than they would be otherwise. You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course, and then it tells you that you'll get an SMS and to type in the code so you do so. Phew! Disaster averted! Right? This must have been real, you even got an SMS from the bank. Alas the SMS was from your bank, and the bad guys didn't have a way to intercept it, but they didn't need one because you typed it into their phishing website. That unexpected $500 transaction wasn't real, but their emptying of your bank account will be.
- jsnell 5y agoHere's the same story without 2FA: "You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course. It was a phishing website. Your bank account will be emptied." It did not reduce security.
- tialaramex 5y agoBut in your revised story I don't receive reassurance that everything is going as planned. That's what I'm getting at, the SMS step is reassuring even though it actually shouldn't be.
- jsnell 5y agoIf there is no 2FA, not being asked for a confirmation code is things going as normal. Also, it's totally irrelevant whether the user gets cold feet since in the password-only world they've just handed away the keys to the kingdom.
- jjav 5y ago> But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. It most certainly can reduce security, that's the point. If I don't have a phone number on my account (which I almost universally don't) then no amount of SMS hijacking will ever matter. If some provider forces me to put a phone number in, now I may be vulnerable to a weakness I didn't want to be vulnerable to. Maaybe today that particular provider uses SMS in a stricly additive sense. Maybe. Just as likely next month they'll redesign their site to be "easier" and add back the vulnerability. Same with recovery questions. They make the security stricly worse for most people since they are password-equivalents with far lower entropy. Although personally my best friend from high school was named D3ho9WvylJkws1zfAKUxZjdYuCsS.
- chc 5y agoThey specifically said "SMS as a second factor." What you're discussing here is a completely different different use of SMS that nobody is arguing in favor of.
- jjav 5y agoAs I mentioned, there is no guarantee any site is going to never allow use of that phone, once it's on file, to bypass authentication. Even if they don't right now. So adding a phone to an account increases your risk in a way you can't control. The only guaranteed way to avoid it is to never have a phone# on file.