24 ms·

> * Require MFA Using some kind of OTP authenticator app or device and NOT SMS!

by tomc1985 5y ago

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

dahfizz 5y ago
SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice has become "Use any one of multiple available factors for authentication", which is awful.
- tomc1985 5y ago
  No it isn't. If you lose your phone you are in for a world of hurt, let alone all the various ways there are to intercept/redirect SMS messages and/or entire mobile accounts. To say nothing of the fact that internet access is not yet globally ubiquitous, or if you forget to pay your bill, or all these other possibilities. A proper OTP app works offline, and more than one of them can exist for any given authentication, so you can have backups if your phone is stolen.
- klhutchins 5y ago
  I think people also worry about the SIM card swap attack. Even if you have multiple ways to authenticate, RSA token, MFA app, and sms auth, the SIM card swap makes it way easier for someone else to have the thing only you should have.
- greggman3 5y ago
  I guess you don't travel much. it's very common to have internet but not cell service (so no SMS). it's also common to buy a local sim so effectively no SMS or at least not the one you have registered. So no, SMS is not perfectly good. it's crap and needs to die in a fire.
  - watwut 5y ago
    I used to travel a lot and the exact combination of no signal and internet was not frequent at all.
    - tomc1985 5y ago
      That heavily depends on where you travel. Even here in Southern California there are populated areas with little to no mobile internet service (like Big Bear Lake, Anza Borrego, or Joshua Tree areas for example)
      - watwut 5y ago
        And they still have internet available to travelers?
        nitrogen 5y ago
        I've had wifi at the hotel/motel/lodge but no cell service before.
        tomc1985 5y ago
        Depends
    - mixmastamyk 5y ago
      The other part was under another mobile system, say in another country. Can calls/texts find your phone today overseas at a reasonable price? I know that frequencies are different in some parts.
- jillesvangurp 5y ago
  The reason companies like Microsoft are basically calling for companies to stop relying on SMS is that it is just way too easy to compromise a phone number or a sim card and there are way too many people that get subjected to identity theft this way. Compared to other second factor options in the market, SMS is probably one of the worst ones precisely because operator security is so flawed. It's better than just having "secret" as your password, but not by nearly enough that you should feel particularly secure with it. The issue with with all multi factor authentication is dealing with the likely situation that one of your users locks themselves out of their account and needs to have the factors reset so they can get back in. The secure way to deal with that would be to go, "Sorry, we don't know you and you've lost all your data. Goodbye!". But of course with important accounts that usually escalates pretty quickly with upset users hogging your helpdesk employees and not giving up that easily. So, most companies have help desks that are easily talked into "helping you". That's what they are incentivized to do. Companies with tight margins are the worst. Like most operators for example.
- stjohnswarts 5y ago
  You absolutely should lock your SIM always. SIM duplication is a thing.
uncletammy 5y ago
Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications. We desperately need to have better MFA options if we're going to require it from users.
- OskarS 5y ago
  > or a binary that runs on my phone is a deal breaker Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation). “MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.
  - mixmastamyk 5y ago
    FYI: https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password
  - NoGravitas 5y ago
    MFA can't require me to run your specific app is a good guideline, though. It still leaves TOTP as fine, as long as I can choose my implementation.
  - Spooky23 5y ago
    TOTP doesn’t meet the security requirements of higher trust level auth. You’re demonstrating why - storing your MFA with your first factor is pretty dumb. Where I work a bunch of people had a cow about having to put a MFA app on their phones, but refused to take a work phone. Our remedy was to issue them PINs to allow after hours access to the building.
jpalomaki 5y ago
For average person there’s also the problem of recovering access in case the phone with OTP app is lost. Every service of course has the option to print backup keys. Maintaining those (in secure offsite location) over years takes some effort.

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice has become "Use any one of multiple available factors for authentication", which is awful.

tomc1985 5y ago
No it isn't. If you lose your phone you are in for a world of hurt, let alone all the various ways there are to intercept/redirect SMS messages and/or entire mobile accounts. To say nothing of the fact that internet access is not yet globally ubiquitous, or if you forget to pay your bill, or all these other possibilities. A proper OTP app works offline, and more than one of them can exist for any given authentication, so you can have backups if your phone is stolen.
klhutchins 5y ago
I think people also worry about the SIM card swap attack. Even if you have multiple ways to authenticate, RSA token, MFA app, and sms auth, the SIM card swap makes it way easier for someone else to have the thing only you should have.
greggman3 5y ago
I guess you don't travel much. it's very common to have internet but not cell service (so no SMS). it's also common to buy a local sim so effectively no SMS or at least not the one you have registered. So no, SMS is not perfectly good. it's crap and needs to die in a fire.
- watwut 5y ago
  I used to travel a lot and the exact combination of no signal and internet was not frequent at all.
  - tomc1985 5y ago
    That heavily depends on where you travel. Even here in Southern California there are populated areas with little to no mobile internet service (like Big Bear Lake, Anza Borrego, or Joshua Tree areas for example)
    - watwut 5y ago
      And they still have internet available to travelers?
      - nitrogen 5y ago
        I've had wifi at the hotel/motel/lodge but no cell service before.
      - tomc1985 5y ago
        Depends
  - mixmastamyk 5y ago
    The other part was under another mobile system, say in another country. Can calls/texts find your phone today overseas at a reasonable price? I know that frequencies are different in some parts.
jillesvangurp 5y ago
The reason companies like Microsoft are basically calling for companies to stop relying on SMS is that it is just way too easy to compromise a phone number or a sim card and there are way too many people that get subjected to identity theft this way. Compared to other second factor options in the market, SMS is probably one of the worst ones precisely because operator security is so flawed. It's better than just having "secret" as your password, but not by nearly enough that you should feel particularly secure with it. The issue with with all multi factor authentication is dealing with the likely situation that one of your users locks themselves out of their account and needs to have the factors reset so they can get back in. The secure way to deal with that would be to go, "Sorry, we don't know you and you've lost all your data. Goodbye!". But of course with important accounts that usually escalates pretty quickly with upset users hogging your helpdesk employees and not giving up that easily. So, most companies have help desks that are easily talked into "helping you". That's what they are incentivized to do. Companies with tight margins are the worst. Like most operators for example.
stjohnswarts 5y ago
You absolutely should lock your SIM always. SIM duplication is a thing.

uncletammy 5y ago

Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications. We desperately need to have better MFA options if we're going to require it from users.

OskarS 5y ago
> or a binary that runs on my phone is a deal breaker Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation). “MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.
- mixmastamyk 5y ago
  FYI: https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password
- NoGravitas 5y ago
  MFA can't require me to run your specific app is a good guideline, though. It still leaves TOTP as fine, as long as I can choose my implementation.
- Spooky23 5y ago
  TOTP doesn’t meet the security requirements of higher trust level auth. You’re demonstrating why - storing your MFA with your first factor is pretty dumb. Where I work a bunch of people had a cow about having to put a MFA app on their phones, but refused to take a work phone. Our remedy was to issue them PINs to allow after hours access to the building.

jpalomaki 5y ago

For average person there’s also the problem of recovering access in case the phone with OTP app is lost. Every service of course has the option to print backup keys. Maintaining those (in secure offsite location) over years takes some effort.