5 ms·

SMS 2FA is an antipattern. Many people know this, but it's not percolated down to everyone just quite yet.

tyleo 5y ago
I don’t know. It is maybe not as secure as possible but it is certainly more secure than a password. I think it’s a baby step. I see other threads under the parent comment recommend banning SMS 2FA altogether. Surely this would be a step back. I suspect most people and companies would think, “well, I guess we won’t do 2FA anymore” rather than, “I guess we will use a proper Authenticator instead”.
- meowster 5y ago
  > it is certainly more secure than a password. I disagree. I can safely store a long, complex, and unique password. I cannot prevent anyone from social engineering my cell phone service provider and doing a SIM swap.
  - johnasmith 5y ago
    2FA is a layer of security on top of your password. Nothing stops you from using a strong password stored in an encrypted place.
    - meowster 5y ago
      In all the cases I've seen, the password can be bypassed with a password reset using SMS, thus SMS becomes 1FA. What if someone stole my phone and I'm unable to instantly get a replacement? I don't want to be locked out of my account either.
- signal11 5y ago
  You're just thinking of security -- and there are many valid concerns around using SMS-based cleartext messages as a 2nd factor. But additionally, a big issue is reliability of the 2FA mechanism. Especially when your service provider is overseas, or you're roaming, the SMSes may simply not arrive in time.
ajsnigrutin 5y ago
It's better than just a password. Not perfect, but works 99% of the time (eg with password reuse, dumb keyloggers, over-the-shoulder spying,...)
- stavros 5y ago
  It is not better than just a password (in fact, it is worse). Providers have been known to reset accounts with just SMS 2FA, and passwords are harder to steal than SIMjacking.
  - ajsnigrutin 5y ago
    > Providers have been known to reset accounts with just SMS 2FA But this turns the 2FA into 1FA, and that "1" is just an SMS. Using SMS as a second factor is great, using it as an only one, is not. If someone hacks eg linkedin (again), and gets all the passwords, they can just hack literally millions of accounts on other services just because of password reuse. SMS 2FA prevents that very effectively. But I agree that companies use things made to deal with "issue A" to deal with "issue B", even if the thing is totally inappropriate for "issue B". I've heard from people that some places in USA use SSN, date of birth, mothers maiden name, etc. to authenticate and verify the user (instead of doing stuff in person with an ID card)... most of those things are (almost) impossible to change, and once someone knows them, you're fscked. Same with fingerprints as means of authentication... once someone makes a mould, you're done, because they can use them, and you can't change them.
    - stavros 5y ago
      > But this turns the 2FA into 1FA, and that "1" is just an SMS. Sure, but the fact that an explanation exists is unlikely to be of help if you get your account compromised by this. > If someone hacks eg linkedin (again), and gets all the passwords, they can just hack literally millions of accounts on other services just because of password reuse. SMS 2FA prevents that very effectively. Hacking a specific service is much harder than simjacking. Use an alternate method of 2FA (a FIDO2 USB key would be best).
donkarma 5y ago
How is 2 factor authentication 2 factor when I can reset my password with just my phone number?
- meepmorp 5y ago
  That's a policy issue, not specific to SMS; it's no different than getting someone to reset your password over the phone with poor ID validation. SMS 2FA is shitty for unrelated reasons.
rsync 5y ago
"SMS 2FA is an antipattern. Many people know this ..." Much SMS 2FA in the world is used not for your security but to solve the difficult problem of spam/scam/sockpuppet accounts. Of course it is labeled as being for your security but it's not about that at all. Bad actors are relentless and forcing them to burn a SIM chip any SIM chip to participate at least slows down the onslaught.
UncleMeat 5y ago
SMS 2FA is equally as resistant as TOTP to phishing (basically not at all). It is also considerably more accessible. Phishing is a much much much bigger concern than SIM-swapping, since it scales easily. Using SMS 2FA instead of TOTP does not change your risk that much. I'd buy these complaints much more easily if people actually mentioned this stuff when TOTP comes up. But they don't. The only meaningful jump in security is when moving to a yubikey or equivalent.

I don’t know. It is maybe not as secure as possible but it is certainly more secure than a password. I think it’s a baby step. I see other threads under the parent comment recommend banning SMS 2FA altogether. Surely this would be a step back. I suspect most people and companies would think, “well, I guess we won’t do 2FA anymore” rather than, “I guess we will use a proper Authenticator instead”.

meowster 5y ago
> it is certainly more secure than a password. I disagree. I can safely store a long, complex, and unique password. I cannot prevent anyone from social engineering my cell phone service provider and doing a SIM swap.
- johnasmith 5y ago
  2FA is a layer of security on top of your password. Nothing stops you from using a strong password stored in an encrypted place.
  - meowster 5y ago
    In all the cases I've seen, the password can be bypassed with a password reset using SMS, thus SMS becomes 1FA. What if someone stole my phone and I'm unable to instantly get a replacement? I don't want to be locked out of my account either.
signal11 5y ago
You're just thinking of security -- and there are many valid concerns around using SMS-based cleartext messages as a 2nd factor. But additionally, a big issue is reliability of the 2FA mechanism. Especially when your service provider is overseas, or you're roaming, the SMSes may simply not arrive in time.

ajsnigrutin 5y ago

It's better than just a password. Not perfect, but works 99% of the time (eg with password reuse, dumb keyloggers, over-the-shoulder spying,...)

stavros 5y ago
It is not better than just a password (in fact, it is worse). Providers have been known to reset accounts with just SMS 2FA, and passwords are harder to steal than SIMjacking.
- ajsnigrutin 5y ago
  > Providers have been known to reset accounts with just SMS 2FA But this turns the 2FA into 1FA, and that "1" is just an SMS. Using SMS as a second factor is great, using it as an only one, is not. If someone hacks eg linkedin (again), and gets all the passwords, they can just hack literally millions of accounts on other services just because of password reuse. SMS 2FA prevents that very effectively. But I agree that companies use things made to deal with "issue A" to deal with "issue B", even if the thing is totally inappropriate for "issue B". I've heard from people that some places in USA use SSN, date of birth, mothers maiden name, etc. to authenticate and verify the user (instead of doing stuff in person with an ID card)... most of those things are (almost) impossible to change, and once someone knows them, you're fscked. Same with fingerprints as means of authentication... once someone makes a mould, you're done, because they can use them, and you can't change them.
  - stavros 5y ago
    > But this turns the 2FA into 1FA, and that "1" is just an SMS. Sure, but the fact that an explanation exists is unlikely to be of help if you get your account compromised by this. > If someone hacks eg linkedin (again), and gets all the passwords, they can just hack literally millions of accounts on other services just because of password reuse. SMS 2FA prevents that very effectively. Hacking a specific service is much harder than simjacking. Use an alternate method of 2FA (a FIDO2 USB key would be best).

donkarma 5y ago

How is 2 factor authentication 2 factor when I can reset my password with just my phone number?

meepmorp 5y ago
That's a policy issue, not specific to SMS; it's no different than getting someone to reset your password over the phone with poor ID validation. SMS 2FA is shitty for unrelated reasons.

rsync 5y ago

"SMS 2FA is an antipattern. Many people know this ..." Much SMS 2FA in the world is used not for your security but to solve the difficult problem of spam/scam/sockpuppet accounts. Of course it is labeled as being for your security but it's not about that at all. Bad actors are relentless and forcing them to burn a SIM chip any SIM chip to participate at least slows down the onslaught.

UncleMeat 5y ago

SMS 2FA is equally as resistant as TOTP to phishing (basically not at all). It is also considerably more accessible. Phishing is a much much much bigger concern than SIM-swapping, since it scales easily. Using SMS 2FA instead of TOTP does not change your risk that much. I'd buy these complaints much more easily if people actually mentioned this stuff when TOTP comes up. But they don't. The only meaningful jump in security is when moving to a yubikey or equivalent.