3 ms·

Could you elaborate what makes it very flawed? To save the rest of us some time?

jiveturkey 4y ago
The one that sticks out to me first and foremost is the assumption that a tech business (they studied the top 120 websites, by what measure they don't say -- Alexa? -- anyway let's assume most are tech companies) is run in a top down fashion. That policies drive all activity and therefore the only hammer for this nail is the policy. When in actuality, many big tech businesses are bottom up. One doesn't need a policy to fix authentication, one needs smart engineers that understand authentication. A policy saying "it must be like this" doesn't make the authentication good, a good implementation makes it good. Sure, we can imagine that this is dictated from the top, but it isn't. I call that one first because it is a basic assumption of the paper as a whole. The next huge glaring flaw is that the authors talk about authentication flaws in the top 120, and that SIM swap is a big factor here because even when 2FA is in place, SMS 2FA is fairly weak. (They don't actually say that -- they studied some OTHER undescribed set of 140 companies that use SMS 1FA or 2FA.) While focusing on the top 120 tech companies' lack of policy that SMS 2FA perhaps be disallowed, are they really insinuating that the phone companies, which are in fact top down and have a vast body of policies and procedures, themselves haven't solved the auth problem by which SIM swaps occur? That SIM swapping occurs because they lack policies saying don't swap SIMs for people that don't properly authenticate? Clearly the phone companies have very strong policies, that agents violate frequently. So much for policies being the fix! The last flaw I would point out in limited time I want to spend here is that they don't consider that the top 120 are the top 120 not in spite of, but perhaps _because of_ (in part) their policies or lack thereof? In the first section, titled _security policies matter_, at least they do contrarily note that a "vanishingly small number of people are actually harmed". So do policies matter or not, at the end of the day?

The one that sticks out to me first and foremost is the assumption that a tech business (they studied the top 120 websites, by what measure they don't say -- Alexa? -- anyway let's assume most are tech companies) is run in a top down fashion. That policies drive all activity and therefore the only hammer for this nail is the policy. When in actuality, many big tech businesses are bottom up. One doesn't need a policy to fix authentication, one needs smart engineers that understand authentication. A policy saying "it must be like this" doesn't make the authentication good, a good implementation makes it good. Sure, we can imagine that this is dictated from the top, but it isn't. I call that one first because it is a basic assumption of the paper as a whole. The next huge glaring flaw is that the authors talk about authentication flaws in the top 120, and that SIM swap is a big factor here because even when 2FA is in place, SMS 2FA is fairly weak. (They don't actually say that -- they studied some OTHER undescribed set of 140 companies that use SMS 1FA or 2FA.) While focusing on the top 120 tech companies' lack of policy that SMS 2FA perhaps be disallowed, are they really insinuating that the phone companies, which are in fact top down and have a vast body of policies and procedures, themselves haven't solved the auth problem by which SIM swaps occur? That SIM swapping occurs because they lack policies saying don't swap SIMs for people that don't properly authenticate? Clearly the phone companies have very strong policies, that agents violate frequently. So much for policies being the fix! The last flaw I would point out in limited time I want to spend here is that they don't consider that the top 120 are the top 120 not in spite of, but perhaps _because of_ (in part) their policies or lack thereof? In the first section, titled _security policies matter_, at least they do contrarily note that a "vanishingly small number of people are actually harmed". So do policies matter or not, at the end of the day?