5 ms·
I feel like with the recent hackings done by Lapsus, it shows that 2FA can actually make it easier to break into a system. Since they first break into telecom c
by Decabytes 4y ago
I feel like with the recent hackings done by Lapsus, it shows that 2FA can actually make it easier to break into a system. Since they first break into telecom companies, they can then sim swap and reset peoples passwords.
- Hamuko 4y agoEasier than what? Not having any 2FA at all? I don't really understand how it can be easier to break into a system if you need the username, the password and an SMS code, than if you just need an username and a password. Obviously, SMS two-factor authentication is flawed. But one-time codes and WebAuthn are pretty good two-factor authentication methods to secure important credentials.
- asimops 4y agoUsing phone numbers as a second factor should be in line with using MD5 for password hashing. It doesn't mean that MFA (or hashing) are a bad idea, just that you need to deploy it properly for it to make a difference.
- Apreche 4y agoThat's because SMS is not 2FA. Proper 2FA implementation should require FIDO, TOTP, etc. and not even permit SMS as a valid method.
- MattPalmer1086 4y agoNitpicking, but it absolutely is 2FA. Two factors for authentication. Password (something you know) and phone (something you have). It's not good 2fa, but it is 2fa.
- chrismorgan 4y agoYou’re talking about a completely different thing, SMS for password reset. That’s completely distinct from SMS as a second factor for logging in, which is absolutely fine for almost all people’s threat models, even in places where SIM or telco attacks are feasible, since the SIM alone is insufficient to log in as you. Sure, it’s common for sites to use your phone number both for 2FA and account recovery (whether single- or multi-factor—and single-factor account recovery is obviously a serious problem in a two-factor authentication environment), but the problem you’re complaining about is nothing to do with 2FA. I think Fastmail hits the right balance, and explains it well: https://www.fastmail.help/hc/en-us/articles/360058752374-Using-two-step-verification-2FA- https://www.fastmail.help/hc/en-us/articles/360058752374-Usi..., heading “Why do I have to add a recovery phone number to set up two-step verification?”
- MattPalmer1086 4y agoIf an attacker can get a SIM for your number, SMS 2fa is useless. They will get the second factor by text message just as you would.
- jeromegv 4y agoBut they need your password first. So you’re not in a worse position than if you didn’t have 2FA. Parent was implying 2FA made it worse.
- chrismorgan 4y agoThey still need your password. The SMS alone is insufficient. Supporting SMS as a second factor (whether primary or backup) is perfectly adequate for almost everyone’s threat model, and generally far superior to not supporting it as regards avoiding account lockout. (That’s Fastmail’s position, which I thoroughly agree with.)
- MattPalmer1086 4y agoI agree it's probably better than nothing for many people. It's still pretty much the worst form of 2fa there is, and not nearly as secure as people assume.
- blfr 4y agoIt's not useless. It forces the attacker to expand all the effort to get a SIM for your number. While certainly possible, it's not that easy.
- MattPalmer1086 4y agoI said it's useless if an attacker can get access to a SIM (or hack the SS7 protocol, or whatever). Clearly it's an extra bar for an attacker, no disagreement there.
- tomjen3 4y agoSMS should not be considered a 2fa, TOTP or a youbikey is the minimum that you should be able to advertise as 2fa.