4 ms·

SMS TOTP is indeed bad and your suspicion is well warranted. Its a lazy way to implement 2-factor authentication and exposes the user to MITM attacks as well a

SMS TOTP is indeed bad and your suspicion is well warranted. Its a lazy way to implement 2-factor authentication and exposes the user to MITM attacks as well as a host of other nastiness. U2F (stuff like what Google Authenticator does) is way better and less phone dependent. The only reason a team would opt for TOTP if they had the resources to implement U2F is because its a good way to get your phone number. Edit: embarrassingly I've made an error in my use of acronyms. What I refer to as TOTP is in fact plaintext OTP sent via SMS, and what I refer to as U2F is actually app-based TOTP. Apologies!

olliej 4y ago
I disagree here, suspicion is not warranted - I'd prefer that they support additional non-sms 2FA paths, but supporting SMS based 2FA has many benefits for a company beyond being "lazy" SMS is vastly better than nothing, and it has the benefit of not requiring users install random software that they (a) don't know how to install, (b) don't know how to use, (c) don't have a recent enough device to use, (d) you don't need to worry about them deleting the app and then losing their 2f, (e) doesn't require your customers having an account with (and potentially paying) another company just to log in to your site, etc I really do think that tech people over estimate the proportion of people for whom at least one of the above applies. Not everyone runs a one or two year old phone, many of the very cheap phones run very old versions of android, can't be updated, etc Obviously SMS 2FA has a different problem as the sufficiently poor may not have a constant phone number, obviously sim hijacks can happen but the targeting requires much more effort than simply moving on to the next non-2fa account. [edit: updated to make sentence structure not look like a series of wordle guesses]
- nl 4y ago
  TOTP should run on any smartphone, including phones that are much older than 2 years.
  - olliej 4y ago
    Huh, you're correct those apps have much longer support than I expected - but did not check :( - from free apps (though I guess Google Authenticator is backed a small immigrant business :D ), thanks for pointing out my error, I'd fix my comment but can no longer edit things. What I was trying to say there are a _lot_ of very old smart phones in poor communities, and they're still in use. I searched craigslist in very poor parts of the US and I can find quite a few phones that are running android <= 4, and have fingerprints implying they were in use. I would guess that that end of the spectrum has many more offline only transactions. It's also a community who may not have internet access, and may not have library access, which is how people in larger cities can access the internet (from volunteering I discovered sometimes to watch porn :-/). Not intended as a correction to your comment, but just as a backup for my statement that plenty of phones still can't use TOTP apps, the cheapest phones with t-mobile are not smartphones, and the cheapest ones on amazon are not running a recent enough android, and some even run Windows OS?!?!?!
hn_throwaway_99 4y ago
You seem to be mixing and matching acronyms that don't really make sense. "TOTP" means "Time-based one time password". It's where the server and client (like the Google Authenticator app) share a secret and then the one-time password changes every 30 seconds. "SMS TOTP" doesn't make sense because SMS codes can be anything random that is sent out to the user attempting to log in. As I stated above, the Google Authenticator app is a TOTP implementation and is also susceptible to MITM attacks. U2F refers to physical hardware keys (like yubikeys) that cryptographically validate the requesting server is who they say they are, and is not susceptible to phishing.
- plaguepilled 4y ago
  You are completely right, I misspoke (mistyped?) in my previous comment. Apologies for the error. What I referred to as U2F is TOTP as you say, and what I referred to as TOTP is plaintext OTPs. That's an embarrassing mistake. What I had meant to highlight is that SMS based authentication is more vulnerable than an authenticator app because the SMS exposes data that can be intercepted or collected by a third party. A timed algorithm solution does not expose this risk at read time (only when synchronising - unless I've missed something?), which is why I strongly prefer it.
  - UncleMeat 4y ago
    This is a modest but often overblown risk. SIM swapping is easy but scales badly. SMS interception malware exists but isn’t widely installed and you rely on the malware not being able to root your phone or get accessibility access to your screen. But most importantly, both TOTP and SMS are vulnerable to phishing - by far the most common method of stealing second factors.

olliej 4y ago

I disagree here, suspicion is not warranted - I'd prefer that they support additional non-sms 2FA paths, but supporting SMS based 2FA has many benefits for a company beyond being "lazy" SMS is vastly better than nothing, and it has the benefit of not requiring users install random software that they (a) don't know how to install, (b) don't know how to use, (c) don't have a recent enough device to use, (d) you don't need to worry about them deleting the app and then losing their 2f, (e) doesn't require your customers having an account with (and potentially paying) another company just to log in to your site, etc I really do think that tech people over estimate the proportion of people for whom at least one of the above applies. Not everyone runs a one or two year old phone, many of the very cheap phones run very old versions of android, can't be updated, etc Obviously SMS 2FA has a different problem as the sufficiently poor may not have a constant phone number, obviously sim hijacks can happen but the targeting requires much more effort than simply moving on to the next non-2fa account. [edit: updated to make sentence structure not look like a series of wordle guesses]

nl 4y ago
TOTP should run on any smartphone, including phones that are much older than 2 years.
- olliej 4y ago
  Huh, you're correct those apps have much longer support than I expected - but did not check :( - from free apps (though I guess Google Authenticator is backed a small immigrant business :D ), thanks for pointing out my error, I'd fix my comment but can no longer edit things. What I was trying to say there are a _lot_ of very old smart phones in poor communities, and they're still in use. I searched craigslist in very poor parts of the US and I can find quite a few phones that are running android <= 4, and have fingerprints implying they were in use. I would guess that that end of the spectrum has many more offline only transactions. It's also a community who may not have internet access, and may not have library access, which is how people in larger cities can access the internet (from volunteering I discovered sometimes to watch porn :-/). Not intended as a correction to your comment, but just as a backup for my statement that plenty of phones still can't use TOTP apps, the cheapest phones with t-mobile are not smartphones, and the cheapest ones on amazon are not running a recent enough android, and some even run Windows OS?!?!?!

hn_throwaway_99 4y ago

You seem to be mixing and matching acronyms that don't really make sense. "TOTP" means "Time-based one time password". It's where the server and client (like the Google Authenticator app) share a secret and then the one-time password changes every 30 seconds. "SMS TOTP" doesn't make sense because SMS codes can be anything random that is sent out to the user attempting to log in. As I stated above, the Google Authenticator app is a TOTP implementation and is also susceptible to MITM attacks. U2F refers to physical hardware keys (like yubikeys) that cryptographically validate the requesting server is who they say they are, and is not susceptible to phishing.

plaguepilled 4y ago
You are completely right, I misspoke (mistyped?) in my previous comment. Apologies for the error. What I referred to as U2F is TOTP as you say, and what I referred to as TOTP is plaintext OTPs. That's an embarrassing mistake. What I had meant to highlight is that SMS based authentication is more vulnerable than an authenticator app because the SMS exposes data that can be intercepted or collected by a third party. A timed algorithm solution does not expose this risk at read time (only when synchronising - unless I've missed something?), which is why I strongly prefer it.
- UncleMeat 4y ago
  This is a modest but often overblown risk. SIM swapping is easy but scales badly. SMS interception malware exists but isn’t widely installed and you rely on the malware not being able to root your phone or get accessibility access to your screen. But most importantly, both TOTP and SMS are vulnerable to phishing - by far the most common method of stealing second factors.