3 ms·

> The thing is, SMS 2FA is still way better than no 2FA You describe using the same device as second factor as the device you use to log in. What's the securit

> The thing is, SMS 2FA is still way better than no 2FA You describe using the same device as second factor as the device you use to log in. What's the security benefit in this case compared to a password manager with a strong stored password alone?

hn_throwaway_99 4y ago
> What's the security benefit in this case compared to a password manager with a strong stored password alone? Nothing, except the reason companies use SMS 2FA is the vast majority of people still don't use a password manager with a unique strong stored password.
iso1631 4y ago
If I log onto a webpage my password manager fills in the details on my desktop If I have SMS, I then get a message on my phone which I have to enter Thus something hijacking my machine can't log on silently, even if it pulls the password out of my password manager
jgilias 4y ago
The security advantage is that an attacker using a completely different device doesn’t have your phone.
- ale42 4y ago
  Except that SMS messages can be intercepted, e.g. by having a proper access to the SS7 backbone, by abusing services provided for other reasons, or by SIM swapping attacks. All of this has already been done, so it's not just theory. See e.g. https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at..., https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev..., https://arstechnica.com/information-technology/2016/08/congressman-to-fcc-fix-phone-network-flaw-that-allows-eavesdropping/ https://arstechnica.com/information-technology/2016/08/congr...
  - jgilias 4y ago
    Yes, of course, the Ask:HN is basically about that! The parent comment asserted that having an SMS in addition to a password is functionally no different from having a password only. Which is not the case.
10000truths 4y ago
For me, the bigger risk of SMS-only 2FA is being locked out of my own account. I sometimes travel to Iran to visit relatives. For obvious reasons, there are no roaming deals between US carriers and Iranian carriers, so I am unable to receive SMS messages while there. I’ve been bitten several times by websites that see I’m logging in from a scary IP address, and force me to authenticate via 2FA SMS to proceed. Whoops, guess I can’t check my bank account for a month now!

hn_throwaway_99 4y ago

> What's the security benefit in this case compared to a password manager with a strong stored password alone? Nothing, except the reason companies use SMS 2FA is the vast majority of people still don't use a password manager with a unique strong stored password.

iso1631 4y ago

If I log onto a webpage my password manager fills in the details on my desktop If I have SMS, I then get a message on my phone which I have to enter Thus something hijacking my machine can't log on silently, even if it pulls the password out of my password manager

jgilias 4y ago

The security advantage is that an attacker using a completely different device doesn’t have your phone.

ale42 4y ago
Except that SMS messages can be intercepted, e.g. by having a proper access to the SS7 backbone, by abusing services provided for other reasons, or by SIM swapping attacks. All of this has already been done, so it's not just theory. See e.g. https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at..., https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev..., https://arstechnica.com/information-technology/2016/08/congressman-to-fcc-fix-phone-network-flaw-that-allows-eavesdropping/ https://arstechnica.com/information-technology/2016/08/congr...
- jgilias 4y ago
  Yes, of course, the Ask:HN is basically about that! The parent comment asserted that having an SMS in addition to a password is functionally no different from having a password only. Which is not the case.

10000truths 4y ago

For me, the bigger risk of SMS-only 2FA is being locked out of my own account. I sometimes travel to Iran to visit relatives. For obvious reasons, there are no roaming deals between US carriers and Iranian carriers, so I am unable to receive SMS messages while there. I’ve been bitten several times by websites that see I’m logging in from a scary IP address, and force me to authenticate via 2FA SMS to proceed. Whoops, guess I can’t check my bank account for a month now!