6 ms·

I really want to know, why has everyone moved to SMS 2F"A"? What was wrong with authenticator applications? Were they really THAT user unfriendly?

cultofmetatron 4y ago
my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone
- lotsofpulp 4y ago
  I use Strongbox to backup TOTP in Keepass databases.
  - malfist 4y ago
    That's good for you, is grandma going to do that?
    - yonixw 4y ago
      I'm a programmer and when I was told to store backup codes, I saw the site still has a "Forgot Password?" button so I dismissed it as a QUICK way to recovery, Not the ONLY way! The only one who told me losing backup codes means losing your data forever was my bitcoin wallet. (Ironic)
  - GoblinSlayer 4y ago
    TOTP is only needed if you use very a weak password, which shouldn't be a thing with keepass.
    - lotsofpulp 4y ago
      What if your password is leaked from some website’s database or you have a keylogger or someone somehow sees it? Wouldn’t it help then?
      - GoblinSlayer 4y ago
        Keepass shows passwords as a sequence of masked characters https://keepass.info/screenshots/keepass_2x/main_big.png https://keepass.info/screenshots/keepass_2x/main_big.png If you have a keylogger, it will just steal your TOTP.
- ufmace 4y ago
  Yeah that's the problem - TOTP with a basic app is pretty easy to use, but making sure you're protected from a phone suddenly lost or broken scenario is tougher, and you may not know you need to do it until it's too late. How many people actually store those backup codes properly or go to the trouble to use a third-party app that supports backups and actually do backups?
- Arch-TK 4y ago
  Wouldn't most people just use Google Authenticator and have it automagically back up to google's nigh unlimited storage space? Obviously not something anyone who respects their privacy would subject themselves to, but it seems to me like the easy path leads to these things being backed up. Obviously if google has your 2FA keys and you were using 2FA keys to log into your google account then you would need to recover your account, but you would be stuck in the same situation as if you had damaged/lost your SIM (e.g. if you lose your phone).
  - jsmith99 4y ago
    You would think that. Actually, Google authenticator does NOT backup codes, although there are other apps that do.
  - kentonv 4y ago
    Google Authenticator does not back up TOTP state to Google. In fact, AFAIK, the app does not talk to the internet, at all, much less does it associated with a Google account. You can transfer your Google Authenticator state to another phone. This is accomplished through scanning QR codes -- no data is transferred over a network. This is a relatively new feature; for many years, Google Authenticator refused to provide any way to extract the authenticator state from the phone at all. You literally had to root your phone to get the state out. It's designed this way because if your TOTP state were backed up to your Google account then it would no longer provide any additional security over Chrome's password manager, which is also backed up to Google. The two factors in "two factor" are supposed to be "something you know" (password) and "something you have" (phone, or security key). In order for the authenticator app to really be "something you have", it has to be hard to copy.
    - dalyons 4y ago
      > It's designed this way Its a bad design then :) . I dropped gauthenticator years ago because of the ridiculously user unfriendly inability to transfer/backup auth codes. What a braindead UX assumption. If you pursue security purity too far, people just wont use it.
- 71a54xd 4y ago
  Just store backup codes, using a 2FA app like authy which can be swapped via SMS defeats the entire point of using 2FA authenticators in lieu of SMS.
lotsofpulp 4y ago
Because phone number also provided a universal identifier that can make the data worth more when selling it.
velavar 4y ago
I don't think that folks so much "moved" to SMS 2FA as much as were with it from the start. SMS 2FA is so ingrained in the finance/fintech industry that it's pretty rare for me to see a financial company offer the option to set up an Authenticator 2FA. Also, there is always some part of the consumer population that is still not on a smartphone and even if they are, they may not be "app-savvy" where they know how to install or use an authenticator app. For this reason, I think most finance companies will steer clear of the Authenticator app and go directly for SMS 2FA or worse, email 2FA.
- ilamont 4y ago
  Nobody in my family - parents, kids, spouse - knows what an authenticator app is or would what to do if presented that as an option, although my teen could probably figure it out. For everyone else, it would be a cascading series of installation and password and app switching and immediacy problems. This would create a great deal of frustration, and ultimately a call to family tech support (me) or the service provider if human tech support is an option which is not the case for many companies such as Google and social media firms.
  - brewdad 4y ago
    The biggest hurdle to authenticator app adoption for the masses is the one that only bites you a year or more down the road when you get a new phone. If you didn't transfer your seed info over to the new phone before trading in the old one, you are locked out of all your accounts.
    - slothtrop 4y ago
      for this reason I've kept storage in keepass and backed it up in more than one place, but admittedly it's possible to lose everything. You need to expose yourself to a little more risk just to mitigate that possibility. The other issue is that many smartphone owners don't have a computer they would back things up to. Just "cloud".
- claytongulick 4y ago
chatmasta 4y ago
Have they? It seems the trend is to support Authenticator apps (i.e. one-time scan a QR code to a TOTP URL that I store on my own device). I haven't seen too many products that support TOTP 2FA but require SMS 2FA. Some companies do require a phone number to setup an account (because it's the best proxy we have for "one per real person" or "expensive for one person to get many of"), but if they're competent then you can remove it as a 2FA option if you replace it with a TOTP code. [0] If you ask me, it should be illegal to require SMS 2FA without an opt-out to TOTP. Perhaps relatedly, I'm also curious about the percentage of Twilio revenue from 2FA messages. [0] RANT: Google, in typically creepy fashion, makes it difficult to enable TOTP without first either providing a phone number, or downloading a Google app to "tap to login!" on your phone. But they do allow you to setup a hardware token, so I found a workaround [1] to configure TOTP without providing a phone number, which is (perhaps ironically) to use Chrome DevTools to create a virtualized WebAuthn device and add it as a hardware token 2FA option. Then it's possible to setup TOTP and remove the virtualized device, leaving you with only TOTP 2FA and no com.google apps begging you for entitlements on your phone. [1] https://superuser.com/a/1759306 https://superuser.com/a/1759306
- zootboy 4y ago
  > It seems the trend is to support Authenticator apps Oh, I wish that were true for financial institutions. But for my sample size of 3 credit unions, 1 large bank, and 1 brokerage, only one (small CU) supports TOTP. All the others have SMS as the only, mandatory 2FA. It drives me crazy how backwards that is.
malfist 4y ago
Because lots of us upgrade phones every couple years, or have dropped a phone and had it break, or get water in it or something. It's all too easy to realize after the fact you needed to transfer something between the old phone to the new phone to keep the authenticator working. Sometimes that's not available (phone damaged), or don't realize you need it until after you've already sent the phone in for trade in. So yes, they are user unfriendly.
- Arch-TK 4y ago
  > Because lots of us upgrade phones every couple years, or have dropped a phone and had it break, or get water in it or something. This is just a matter of using one of the many TOTP authenticators which allow backups of the keys. If people drop or lose their phones, do they lose all their contacts, photos, passwords? I bet not. I am pretty sure this is a solved problem by now. Moreover, even if you do lose the keys, that's what account recovery processes are for.
rlpb 4y ago
AIUI, EU regulation requires 2FA in finance now, but the 2FA must also confirm details such as a target account and/or amount. Authenticator apps (at least those that use TOTP/HOTP) can't do that. SMS can. So can card readers but people hate having to carry them around. So we're stuck with SMS.
- jbverschoor 4y ago
  You can use the app as a second factor. But you’ll need to transfer on your pc
crazygringo 4y ago
People lose their phones and then your authenticator app doesn't work anymore, even if you restore from backup. And then the recovery mechanism is often a giant pain. Yes, that's pretty user unfriendly. It's a lot more common to lose your phone than lose your phone number.
- mcherm 4y ago
  There are numerous tools, Google Authenticator and Authy for example, that protect against this by securely storing the keys. In fact, I would venture to say that MOST users of authentication apps are using ones that provide a backup in case the phone is lost.
  - crazygringo 4y ago
    No, Google Authenticator does not securely store keys anywhere but your physical phone. If you lose your phone, they're gone. The only thing it provides is a way to export from one device to another, but that requires having the first device still with you. [1] On the other hand, yes fortunately Authy does provide cloud backups. But your average end user generally doesn't have the slightest idea of why they should use one authenticator app over another. Expecting them to do the research to figure out that they should use Authy over Google Authenticator in case they lose their phone is asking way too much. Again, completely user unfriendly. [1] https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447
    - tzs 4y ago
      Note that the export on the source device doesn't seem to have any way to actually know whether or not you are actually setting up a new phone. It just makes QR codes with the keys for groups of accounts that Google Authenticator on a new device can scan to import those accounts. I can't see any reason you couldn't start the export process without having a new phone and take screenshots of the QR codes, then back those screenshots up to some secure place. You should be able to later use those screenshots to restore those accounts to a new phone without needing to have the old phone. I don't use Google Authenticator so have not tried this. While the above should work, I'd recommend saving the QR code for each site when you sign up for TOTP at that site. That way you can easily transfer to any other TOTP authenticator. The Google Authenticator export seems to make QR codes that combine multiple accounts and I'm not sure any other authenticators would know what to do with those.
autoexec 4y ago
authenticator apps come with privacy concerns. Right now, Microsoft has no means to collect my location data, they don't have any access to my phone, including my phone's camera. The moment I install Microsoft authenticator that situation changes. No thanks.
- kentonv 4y ago
  Most sites that support authenticator apps support the TOTP standard that allows you to use any authenticator app. You don't have to install the app specific to the site, you can find a privacy-respecting one.
  - autoexec 4y ago
    If I can find a privacy respecting one that's a good thing! I worked a job that tried to force us to use Microsoft authenticator but we pushed back after looking at the privacy policy and so instead we ended up with perfectly nice key fobs. It's hard to beat that for privacy.
- alwayslikethis 4y ago
  SMS has even more privacy concerns. To be able to receive SMS, the network must know your location. You are also forced to use proprietary firmware for most radio components. SMS is also subject to attacks against the telecom, such as by tricking their staff into producing a new sim card with your number.
  - autoexec 4y ago
    > To be able to receive SMS, the network must know your location. You are also forced to use proprietary firmware for most radio components. These are risks you have just by owning a cell phone, having an authenticator app doesn't change that. > SMS is also subject to attacks against the telecom, such as by tricking their staff into producing a new sim card with your number. This is absolutely a legitimate concern, and the lack of security in carrier practices in particular honestly makes me want to avoid 2FA entirely. Fortunately, I've never needed it for account recovery. I use a password manager so all accounts get unique logins and I'm savvy enough not to fall for your typical phishing scams which helps. There's no guarantees my luck will hold out though so I'll be looking into privacy preserving options for the most critical things or for cases where I'm not left with any choice.
granshaw 4y ago
For the average user, yes, yes they are
kevin_thibedeau 4y ago
See what happens to your authenticator app after a factory reset. It is extremely risky to use them for 2FA. SMS always works. If this is work related authentication and they expect you to use your personal property to run an app, then you're just playing a role as a puppet in their useless security theater. If your employer was serious about security then you'd be issued a dedicated device for auth.
markdown 4y ago
With authenticator apps, if you lose your phone, you lose access to everything. Your life is fucked. With SMS, you just get a new sim (free in my country). Basically authenticator apps create a much bigger problem than getting hacked, and there's a far greater probability of me losing my phone (has happened before) than getting hacked.
erikerikson 4y ago
Everyone with a cell phone has SMS. It's already set up. And it's recoverable plus someone else's problem to recover. Add that's it's a pretty good universal id. I hate SMS 2FA but it makes sense.

cultofmetatron 4y ago

my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone

lotsofpulp 4y ago
I use Strongbox to backup TOTP in Keepass databases.
- malfist 4y ago
  That's good for you, is grandma going to do that?
  - yonixw 4y ago
    I'm a programmer and when I was told to store backup codes, I saw the site still has a "Forgot Password?" button so I dismissed it as a QUICK way to recovery, Not the ONLY way! The only one who told me losing backup codes means losing your data forever was my bitcoin wallet. (Ironic)
- GoblinSlayer 4y ago
  TOTP is only needed if you use very a weak password, which shouldn't be a thing with keepass.
  - lotsofpulp 4y ago
    What if your password is leaked from some website’s database or you have a keylogger or someone somehow sees it? Wouldn’t it help then?
    - GoblinSlayer 4y ago
      Keepass shows passwords as a sequence of masked characters https://keepass.info/screenshots/keepass_2x/main_big.png https://keepass.info/screenshots/keepass_2x/main_big.png If you have a keylogger, it will just steal your TOTP.
ufmace 4y ago
Yeah that's the problem - TOTP with a basic app is pretty easy to use, but making sure you're protected from a phone suddenly lost or broken scenario is tougher, and you may not know you need to do it until it's too late. How many people actually store those backup codes properly or go to the trouble to use a third-party app that supports backups and actually do backups?
Arch-TK 4y ago
Wouldn't most people just use Google Authenticator and have it automagically back up to google's nigh unlimited storage space? Obviously not something anyone who respects their privacy would subject themselves to, but it seems to me like the easy path leads to these things being backed up. Obviously if google has your 2FA keys and you were using 2FA keys to log into your google account then you would need to recover your account, but you would be stuck in the same situation as if you had damaged/lost your SIM (e.g. if you lose your phone).
- jsmith99 4y ago
  You would think that. Actually, Google authenticator does NOT backup codes, although there are other apps that do.
- kentonv 4y ago
  Google Authenticator does not back up TOTP state to Google. In fact, AFAIK, the app does not talk to the internet, at all, much less does it associated with a Google account. You can transfer your Google Authenticator state to another phone. This is accomplished through scanning QR codes -- no data is transferred over a network. This is a relatively new feature; for many years, Google Authenticator refused to provide any way to extract the authenticator state from the phone at all. You literally had to root your phone to get the state out. It's designed this way because if your TOTP state were backed up to your Google account then it would no longer provide any additional security over Chrome's password manager, which is also backed up to Google. The two factors in "two factor" are supposed to be "something you know" (password) and "something you have" (phone, or security key). In order for the authenticator app to really be "something you have", it has to be hard to copy.
  - dalyons 4y ago
    > It's designed this way Its a bad design then :) . I dropped gauthenticator years ago because of the ridiculously user unfriendly inability to transfer/backup auth codes. What a braindead UX assumption. If you pursue security purity too far, people just wont use it.
71a54xd 4y ago
Just store backup codes, using a 2FA app like authy which can be swapped via SMS defeats the entire point of using 2FA authenticators in lieu of SMS.

lotsofpulp 4y ago

Because phone number also provided a universal identifier that can make the data worth more when selling it.

velavar 4y ago

I don't think that folks so much "moved" to SMS 2FA as much as were with it from the start. SMS 2FA is so ingrained in the finance/fintech industry that it's pretty rare for me to see a financial company offer the option to set up an Authenticator 2FA. Also, there is always some part of the consumer population that is still not on a smartphone and even if they are, they may not be "app-savvy" where they know how to install or use an authenticator app. For this reason, I think most finance companies will steer clear of the Authenticator app and go directly for SMS 2FA or worse, email 2FA.

ilamont 4y ago
Nobody in my family - parents, kids, spouse - knows what an authenticator app is or would what to do if presented that as an option, although my teen could probably figure it out. For everyone else, it would be a cascading series of installation and password and app switching and immediacy problems. This would create a great deal of frustration, and ultimately a call to family tech support (me) or the service provider if human tech support is an option which is not the case for many companies such as Google and social media firms.
- brewdad 4y ago
  The biggest hurdle to authenticator app adoption for the masses is the one that only bites you a year or more down the road when you get a new phone. If you didn't transfer your seed info over to the new phone before trading in the old one, you are locked out of all your accounts.
  - slothtrop 4y ago
    for this reason I've kept storage in keepass and backed it up in more than one place, but admittedly it's possible to lose everything. You need to expose yourself to a little more risk just to mitigate that possibility. The other issue is that many smartphone owners don't have a computer they would back things up to. Just "cloud".
claytongulick 4y ago

chatmasta 4y ago

Have they? It seems the trend is to support Authenticator apps (i.e. one-time scan a QR code to a TOTP URL that I store on my own device). I haven't seen too many products that support TOTP 2FA but require SMS 2FA. Some companies do require a phone number to setup an account (because it's the best proxy we have for "one per real person" or "expensive for one person to get many of"), but if they're competent then you can remove it as a 2FA option if you replace it with a TOTP code. [0] If you ask me, it should be illegal to require SMS 2FA without an opt-out to TOTP. Perhaps relatedly, I'm also curious about the percentage of Twilio revenue from 2FA messages. [0] RANT: Google, in typically creepy fashion, makes it difficult to enable TOTP without first either providing a phone number, or downloading a Google app to "tap to login!" on your phone. But they do allow you to setup a hardware token, so I found a workaround [1] to configure TOTP without providing a phone number, which is (perhaps ironically) to use Chrome DevTools to create a virtualized WebAuthn device and add it as a hardware token 2FA option. Then it's possible to setup TOTP and remove the virtualized device, leaving you with only TOTP 2FA and no com.google apps begging you for entitlements on your phone. [1] https://superuser.com/a/1759306 https://superuser.com/a/1759306

zootboy 4y ago
> It seems the trend is to support Authenticator apps Oh, I wish that were true for financial institutions. But for my sample size of 3 credit unions, 1 large bank, and 1 brokerage, only one (small CU) supports TOTP. All the others have SMS as the only, mandatory 2FA. It drives me crazy how backwards that is.

malfist 4y ago

Because lots of us upgrade phones every couple years, or have dropped a phone and had it break, or get water in it or something. It's all too easy to realize after the fact you needed to transfer something between the old phone to the new phone to keep the authenticator working. Sometimes that's not available (phone damaged), or don't realize you need it until after you've already sent the phone in for trade in. So yes, they are user unfriendly.

Arch-TK 4y ago
> Because lots of us upgrade phones every couple years, or have dropped a phone and had it break, or get water in it or something. This is just a matter of using one of the many TOTP authenticators which allow backups of the keys. If people drop or lose their phones, do they lose all their contacts, photos, passwords? I bet not. I am pretty sure this is a solved problem by now. Moreover, even if you do lose the keys, that's what account recovery processes are for.

rlpb 4y ago

AIUI, EU regulation requires 2FA in finance now, but the 2FA must also confirm details such as a target account and/or amount. Authenticator apps (at least those that use TOTP/HOTP) can't do that. SMS can. So can card readers but people hate having to carry them around. So we're stuck with SMS.

jbverschoor 4y ago
You can use the app as a second factor. But you’ll need to transfer on your pc

crazygringo 4y ago

People lose their phones and then your authenticator app doesn't work anymore, even if you restore from backup. And then the recovery mechanism is often a giant pain. Yes, that's pretty user unfriendly. It's a lot more common to lose your phone than lose your phone number.

mcherm 4y ago
There are numerous tools, Google Authenticator and Authy for example, that protect against this by securely storing the keys. In fact, I would venture to say that MOST users of authentication apps are using ones that provide a backup in case the phone is lost.
- crazygringo 4y ago
  No, Google Authenticator does not securely store keys anywhere but your physical phone. If you lose your phone, they're gone. The only thing it provides is a way to export from one device to another, but that requires having the first device still with you. [1] On the other hand, yes fortunately Authy does provide cloud backups. But your average end user generally doesn't have the slightest idea of why they should use one authenticator app over another. Expecting them to do the research to figure out that they should use Authy over Google Authenticator in case they lose their phone is asking way too much. Again, completely user unfriendly. [1] https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447
  - tzs 4y ago
    Note that the export on the source device doesn't seem to have any way to actually know whether or not you are actually setting up a new phone. It just makes QR codes with the keys for groups of accounts that Google Authenticator on a new device can scan to import those accounts. I can't see any reason you couldn't start the export process without having a new phone and take screenshots of the QR codes, then back those screenshots up to some secure place. You should be able to later use those screenshots to restore those accounts to a new phone without needing to have the old phone. I don't use Google Authenticator so have not tried this. While the above should work, I'd recommend saving the QR code for each site when you sign up for TOTP at that site. That way you can easily transfer to any other TOTP authenticator. The Google Authenticator export seems to make QR codes that combine multiple accounts and I'm not sure any other authenticators would know what to do with those.

autoexec 4y ago

authenticator apps come with privacy concerns. Right now, Microsoft has no means to collect my location data, they don't have any access to my phone, including my phone's camera. The moment I install Microsoft authenticator that situation changes. No thanks.

kentonv 4y ago
Most sites that support authenticator apps support the TOTP standard that allows you to use any authenticator app. You don't have to install the app specific to the site, you can find a privacy-respecting one.
- autoexec 4y ago
  If I can find a privacy respecting one that's a good thing! I worked a job that tried to force us to use Microsoft authenticator but we pushed back after looking at the privacy policy and so instead we ended up with perfectly nice key fobs. It's hard to beat that for privacy.
alwayslikethis 4y ago
SMS has even more privacy concerns. To be able to receive SMS, the network must know your location. You are also forced to use proprietary firmware for most radio components. SMS is also subject to attacks against the telecom, such as by tricking their staff into producing a new sim card with your number.
- autoexec 4y ago
  > To be able to receive SMS, the network must know your location. You are also forced to use proprietary firmware for most radio components. These are risks you have just by owning a cell phone, having an authenticator app doesn't change that. > SMS is also subject to attacks against the telecom, such as by tricking their staff into producing a new sim card with your number. This is absolutely a legitimate concern, and the lack of security in carrier practices in particular honestly makes me want to avoid 2FA entirely. Fortunately, I've never needed it for account recovery. I use a password manager so all accounts get unique logins and I'm savvy enough not to fall for your typical phishing scams which helps. There's no guarantees my luck will hold out though so I'll be looking into privacy preserving options for the most critical things or for cases where I'm not left with any choice.

granshaw 4y ago

For the average user, yes, yes they are

kevin_thibedeau 4y ago

See what happens to your authenticator app after a factory reset. It is extremely risky to use them for 2FA. SMS always works. If this is work related authentication and they expect you to use your personal property to run an app, then you're just playing a role as a puppet in their useless security theater. If your employer was serious about security then you'd be issued a dedicated device for auth.

markdown 4y ago

With authenticator apps, if you lose your phone, you lose access to everything. Your life is fucked. With SMS, you just get a new sim (free in my country). Basically authenticator apps create a much bigger problem than getting hacked, and there's a far greater probability of me losing my phone (has happened before) than getting hacked.

erikerikson 4y ago

Everyone with a cell phone has SMS. It's already set up. And it's recoverable plus someone else's problem to recover. Add that's it's a pretty good universal id. I hate SMS 2FA but it makes sense.