4 ms·
The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part. Having to scan a
by EduardoBautista 4y ago
The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part.
Having to scan a QR code is too much friction compared to just asking for their phone number which will then send a code that a modern phone OS will then be able to autofill all without leaving the app and going into the messages app to retrieve that code.
Edit: I have 4 YubiKeys and a Ledger Nano S that I use for critical services, such as my Google accounts and domain registrar, and I _still_ use SMS 2FA out of laziness for most services.
- deleted 4y ago[deleted]
- leni536 4y ago> The thing is, SMS 2FA is still way better than no 2FA You describe using the same device as second factor as the device you use to log in. What's the security benefit in this case compared to a password manager with a strong stored password alone?
- hn_throwaway_99 4y ago> What's the security benefit in this case compared to a password manager with a strong stored password alone? Nothing, except the reason companies use SMS 2FA is the vast majority of people still don't use a password manager with a unique strong stored password.
- iso1631 4y agoIf I log onto a webpage my password manager fills in the details on my desktop If I have SMS, I then get a message on my phone which I have to enter Thus something hijacking my machine can't log on silently, even if it pulls the password out of my password manager
- jgilias 4y agoThe security advantage is that an attacker using a completely different device doesn’t have your phone.
- ale42 4y agoExcept that SMS messages can be intercepted, e.g. by having a proper access to the SS7 backbone, by abusing services provided for other reasons, or by SIM swapping attacks. All of this has already been done, so it's not just theory. See e.g. https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at..., https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev..., https://arstechnica.com/information-technology/2016/08/congressman-to-fcc-fix-phone-network-flaw-that-allows-eavesdropping/ https://arstechnica.com/information-technology/2016/08/congr...
- jgilias 4y agoYes, of course, the Ask:HN is basically about that! The parent comment asserted that having an SMS in addition to a password is functionally no different from having a password only. Which is not the case.
- 10000truths 4y agoFor me, the bigger risk of SMS-only 2FA is being locked out of my own account. I sometimes travel to Iran to visit relatives. For obvious reasons, there are no roaming deals between US carriers and Iranian carriers, so I am unable to receive SMS messages while there. I’ve been bitten several times by websites that see I’m logging in from a scary IP address, and force me to authenticate via 2FA SMS to proceed. Whoops, guess I can’t check my bank account for a month now!
- lxgr 4y agoSure, by all means, I am happy about companies offering SMS 2FA as an option (as long as they don't block VoIP, that is). What is annoying is making it the only option, or almost as bad, a mandatory recovery option bypassing all other factors.
- joshspankit 4y agoAgreed. If you use a password manager to generate a high-entropy password, come up with similarly-secure answers to the “security questions”, and make sure your email is also secure, then SMS 2FA is a significant downgrade to your overall security.
- lxgr 4y agoNote that using SMS-OTP as a second factor besides the password/security questions, 2FA is never a downgrade, but using SMS-OTP as a single recovery factor (for a forgotten password) definitely is. Only the latter is a problem.
- joshspankit 4y agoIt’s still a downgrade because it’s an avenue for social engineering the customer service/support reps
- stingraycharles 4y agoI think even Google is highly suspect of allowing a bazillion fallbacks to different MFA options. What’s the alternative, if you don’t want people to get completely locked out when they fuck up?
- polyvisual 4y agoAgreed. My day job is in fintech. Our average customer age is > 60. Explaining 2fa via SMS to that age group is hard enough. Adding authenticators or QR codes into the mix would blow their frail minds.
- hocuspocus 4y ago60 is not old. And I don't think age is particularly relevant here. Today millions of people are using PSD2 compliant SCA (that should not rely on SMS tokens only) in Europe. Usually implemented by a push notifications that you need to approve using biometrics on your smartphone.
- Shish2k 4y ago> I don't think age is particularly relevant here. “What technology you grew up with” is definitely a factor (not the only factor, but a big one) in “what technology you feel comfortable using”.
- warner25 4y agoI used to say that I'm determined to not let technology pass me by with age, but now I suspect that it will happen someday anyway, despite being a technologist. I'm recognizing my aversion to newer, trendy things more and more. I often wonder where the line will finally be drawn and when I'll cross it. Maybe if companies start pushing something like video and gesture-based authentication in virtual or augmented reality, I'll be the old guy saying "you can pry passwords and email from my cold, dead hands."
- izacus 4y agoWhy do your other users need to suffer just because you have 60+ people too? How is that for an excuse to not provide better options?
- t-3 4y agoA physical key is much more intuitive than typing a code. It's directly analogous to a locked room.
- cy_hauser 4y ago> users are more likely to use it since it requires very little effort on their part. I use my tablet and laptop way more than my phone. I hate having to walk to another room to pickup my phone from its charger just to get one of these SMS codes. When I'm doing phone support I often hear, "hold on, I have to get my phone" when this step is required.
- tssva 4y agoSetup your laptop and tablet to get SMS messages forwarded to them from your phone.
- cy_hauser 4y agoGood idea but I can't seem to find a built in way to do this. Everything I've found involves third party apps which have all the usual problems that make me not want to use them: permission, ads, in-app purchases, battery drain, etc. Do you know of any way to do this that's already built into Android?
- tssva 4y agoGoogle Messages and Google Messages for the Web.
- insanitybit 4y ago> The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part. (SMS 2FA + Strong Password) is worse than (SMS 2FA + Weak Password). SMS 2FA doesn't solve phishing and it muddies your identity with a weak, transferable identifier. If you've taken the time to set up SMS 2FA for yourself you could have just used a strong password, especially since password manages are now built into browsers. At least with TOTP you aren't adding additional vulnerabilities, but frankly most 2FA is pointless unless it's FIDO2, assuming you just use a password manager and use strong passwords.