3 ms·

You can always use SMS 2FA

by ramesh31 5y ago

latchkey 5y ago
Please, no. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
- dazc 5y ago
  SMS 2fa is still multiple times more secure than no 2fa at all though.
  - latchkey 5y ago
    That's not really on the table though. We are not talking about your local tech illiterate bank here. We are talking about securing your Google account which is likely used to SSO authenticate with many other accounts.
  - filmgirlcw 5y ago
    I sort of disagree. With social engineering, it could be easier to reset someone's password with a SIM swap than traditional means. For many years, PayPal refused to do true 2FA and I cringed at having to choose between no 2FA or SMS-based. Phone numbers are much easier to source through public records than many people realize. As someone who has had the same primary cell phone number since I was a teenager, I’m honestly shocked it isn’t in more places (I’ve taken great pains to limit it getting out, but I’m still shocked). That scares me enough to almost get a second number, but that’s such a pain in the ass and not a great solution.
- bduerst 5y ago
  There are services that have safeguards in place against sim swapping, coincidentally one of them is Fi: https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en
  - zrm 5y ago
    Apparently the safeguards consist of using a non-SMS method of 2FA. Maybe just do that in the other case too.
  - latchkey 5y ago
    While I'm sure that Fi and Google Voice are better than almost any other carrier based SMS security, this does nothing to convince me to ever use SMS 2FA. "Your Fi number is tied to your Google Account." -- I'm sure you've seen cases of people's google accounts being randomly locked for no reason. Now you lose access to make a call too! The last thing I'd ever trust security to is SMS. Lots of good technical details here: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
    - bduerst 5y ago
      No matter what cellular service you use, you run a risk of being flagged as a false positive for fraud locks (irrespective of SIM swaps). If a SIM swap scam is happening and your account is locked, it is incredibly unlikely they'll be able to swap it out.
gchucky 5y ago
Here in the US, NIST has deprecated the use of SMS as 2-factor auth[1] on the grounds that "there’s a risk that SMS messages can be intercepted or redirected". [1] https://www.zdnet.com/article/nist-blog-clarifies-sms-deprecation-in-wake-of-media-tailspin/ https://www.zdnet.com/article/nist-blog-clarifies-sms-deprec...

You can always use SMS 2FA

latchkey 5y ago

Please, no. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam

dazc 5y ago
SMS 2fa is still multiple times more secure than no 2fa at all though.
- latchkey 5y ago
  That's not really on the table though. We are not talking about your local tech illiterate bank here. We are talking about securing your Google account which is likely used to SSO authenticate with many other accounts.
- filmgirlcw 5y ago
  I sort of disagree. With social engineering, it could be easier to reset someone's password with a SIM swap than traditional means. For many years, PayPal refused to do true 2FA and I cringed at having to choose between no 2FA or SMS-based. Phone numbers are much easier to source through public records than many people realize. As someone who has had the same primary cell phone number since I was a teenager, I’m honestly shocked it isn’t in more places (I’ve taken great pains to limit it getting out, but I’m still shocked). That scares me enough to almost get a second number, but that’s such a pain in the ass and not a great solution.
bduerst 5y ago
There are services that have safeguards in place against sim swapping, coincidentally one of them is Fi: https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en
- zrm 5y ago
  Apparently the safeguards consist of using a non-SMS method of 2FA. Maybe just do that in the other case too.
- latchkey 5y ago
  While I'm sure that Fi and Google Voice are better than almost any other carrier based SMS security, this does nothing to convince me to ever use SMS 2FA. "Your Fi number is tied to your Google Account." -- I'm sure you've seen cases of people's google accounts being randomly locked for no reason. Now you lose access to make a call too! The last thing I'd ever trust security to is SMS. Lots of good technical details here: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
  - bduerst 5y ago
    No matter what cellular service you use, you run a risk of being flagged as a false positive for fraud locks (irrespective of SIM swaps). If a SIM swap scam is happening and your account is locked, it is incredibly unlikely they'll be able to swap it out.

gchucky 5y ago

Here in the US, NIST has deprecated the use of SMS as 2-factor auth[1] on the grounds that "there’s a risk that SMS messages can be intercepted or redirected". [1] https://www.zdnet.com/article/nist-blog-clarifies-sms-deprecation-in-wake-of-media-tailspin/ https://www.zdnet.com/article/nist-blog-clarifies-sms-deprec...