3 ms·

I avoided to setup Two-Factor Authentication (2FA) with mobile phones anywhere because i had the distinct impression I was making the surface of attack bigger i

by kome 5y ago

I avoided to setup Two-Factor Authentication (2FA) with mobile phones anywhere because i had the distinct impression I was making the surface of attack bigger instead of smaller.

BugsJustFindMe 5y ago
SMS 2FA always makes an attack harder than no 2FA at all because an attacker needs to also intercept your SMS messages in addition to getting your password instead of just getting your password. Given that getting your password is required for both attacks, the addition of needing to intercept your SMS messages is an additional hurdle. It's just potentially not as good as physical token 2FA where the additional requirement is physically finding you and beating you up. I think you must be confusing SMS 2FA with an SMS 1FA override, which is not the same.
- hlandau 5y ago
  The trouble is there appear to be many services purporting to provide SMS "2FA" which make the bizarre assumption that SMS is more secure than email and allow you to recover access to your account purely via access to that phone number. For these services adding a phone number may indeed actually reduce account security. There have been real incidents, including in the last few years, of high-value accounts of people being successfully hijacked via the hijacking of their phone numbers.
  - BugsJustFindMe 5y ago
    Maybe but that's a problem with those services, not a problem with SMS. If they cared about security they also wouldn't allow password recovery by email, because history has proven that email is also not inherently secure. Peoples' email accounts get hacked literally all the time. Every single practical problem that your post ascribes to SMS also applies to email. Approaching 100% of all email addresses in the world are not permanently attached to individual people and are entirely subject to the whims of entities like Google.
    - hlandau 5y ago
      This is a defect with the email service provider or user's security practices, not the email system. A well-run email system provides far greater security than SMS. "Approaching 100%" is not "the email system". This is not a systemic issue with the design of the system itself and the system remains open. Personally I run my own email, yet it is not practically feasible for me to "run" my own telephone number in the same sense.
      - BugsJustFindMe 5y ago
        > A well-run email system provides far greater security than SMS. A well-run SMS system provides far greater security than SMS. Instead of comparing a well-run email system against a poorly-run SMS system, comparing well-run versions of both would feel like less of a straw man.
        hlandau 5y ago
        No it doesn't. The architecture of SMS more or less precludes this (which I have been meaning to write about, maybe soon). Moreover, people can choose their email provider to a far greater extent than they can choose their phone number provider, where they're likely to be limited to choosing from a limited number of carriers in their country, probably all of which have poor security practice; whereas email providers with good security practice exist and can be employed by people in any country.
        BugsJustFindMe 5y ago
        > The architecture of SMS more or less precludes this Maybe a particular technical representation does, but that's not a strong expression of whatever case you're trying to make. Nothing about sending text messages using phone numbers as identifiers necessitates or demands insecurity. Signal uses phone numbers as target identifiers for text messages too. Nothing about the phone number has any bearing on the rest of the chain. Nothing about sending messages necessitates sending them insecurely. Nothing about sending messages to phone numbers necessitates it being easy to steal phone numbers. You could write three separate articles titled "I think all text messages should use encryption" and "I think I should be able to have my own identifier/namespace" and "I think it should be harder for someone to steal my identifier", but those issues have nothing to do with each other. And not only is only the most pointless one (choosing your own identifier/namespace) addressed by using email addresses, you're still living on borrowed time at the whims of domain registrars and DNS.

by kome 5y ago

I avoided to setup Two-Factor Authentication (2FA) with mobile phones anywhere because i had the distinct impression I was making the surface of attack bigger instead of smaller.

BugsJustFindMe 5y ago

SMS 2FA always makes an attack harder than no 2FA at all because an attacker needs to also intercept your SMS messages in addition to getting your password instead of just getting your password. Given that getting your password is required for both attacks, the addition of needing to intercept your SMS messages is an additional hurdle. It's just potentially not as good as physical token 2FA where the additional requirement is physically finding you and beating you up. I think you must be confusing SMS 2FA with an SMS 1FA override, which is not the same.

hlandau 5y ago
The trouble is there appear to be many services purporting to provide SMS "2FA" which make the bizarre assumption that SMS is more secure than email and allow you to recover access to your account purely via access to that phone number. For these services adding a phone number may indeed actually reduce account security. There have been real incidents, including in the last few years, of high-value accounts of people being successfully hijacked via the hijacking of their phone numbers.
- BugsJustFindMe 5y ago
  Maybe but that's a problem with those services, not a problem with SMS. If they cared about security they also wouldn't allow password recovery by email, because history has proven that email is also not inherently secure. Peoples' email accounts get hacked literally all the time. Every single practical problem that your post ascribes to SMS also applies to email. Approaching 100% of all email addresses in the world are not permanently attached to individual people and are entirely subject to the whims of entities like Google.
  - hlandau 5y ago
    This is a defect with the email service provider or user's security practices, not the email system. A well-run email system provides far greater security than SMS. "Approaching 100%" is not "the email system". This is not a systemic issue with the design of the system itself and the system remains open. Personally I run my own email, yet it is not practically feasible for me to "run" my own telephone number in the same sense.
    - BugsJustFindMe 5y ago
      > A well-run email system provides far greater security than SMS. A well-run SMS system provides far greater security than SMS. Instead of comparing a well-run email system against a poorly-run SMS system, comparing well-run versions of both would feel like less of a straw man.
      - hlandau 5y ago
        No it doesn't. The architecture of SMS more or less precludes this (which I have been meaning to write about, maybe soon). Moreover, people can choose their email provider to a far greater extent than they can choose their phone number provider, where they're likely to be limited to choosing from a limited number of carriers in their country, probably all of which have poor security practice; whereas email providers with good security practice exist and can be employed by people in any country.
        BugsJustFindMe 5y ago
        > The architecture of SMS more or less precludes this Maybe a particular technical representation does, but that's not a strong expression of whatever case you're trying to make. Nothing about sending text messages using phone numbers as identifiers necessitates or demands insecurity. Signal uses phone numbers as target identifiers for text messages too. Nothing about the phone number has any bearing on the rest of the chain. Nothing about sending messages necessitates sending them insecurely. Nothing about sending messages to phone numbers necessitates it being easy to steal phone numbers. You could write three separate articles titled "I think all text messages should use encryption" and "I think I should be able to have my own identifier/namespace" and "I think it should be harder for someone to steal my identifier", but those issues have nothing to do with each other. And not only is only the most pointless one (choosing your own identifier/namespace) addressed by using email addresses, you're still living on borrowed time at the whims of domain registrars and DNS.