8 ms·
The best way to avoid this as a company is to not use SMS to implement 2FA!
by yosito 3y ago
The best way to avoid this as a company is to not use SMS to implement 2FA!
- seanthemon 3y agoImpossible if your customers are enterprise.
- pnpnp 3y agoWeird. My fortune 100 company doesn’t use SMS for 2FA.
- kristofferg 3y agoIt is still very common for business clients of all sizes, in all industries (even critical infra) to request 2FA via SMS. Good for the company you work for that they dont :)
- yosito 3y agoWhen they request it, they should receive pushback. SMS 2FA is a bad business decision with potentially severe consequences for customers.
- cbzoiav 3y ago"We recommended you went for X and listed SMS security problems as the reasons - here is the email chain" You need to cover your ass, but you don't want to actively push back and risk losing the sale.
- throwaway2037 3y agoI assume that all of Fortune 500 (minus tech majors) use RSA hard and soft tokens. Ref: https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID
- tinus_hn 3y agoQuite possibly with SMS as the fallback option in case the soft token is lost.
- pnpnp 3y agoWe have a human in the loop as the fallback. It’s just a different attack vector. Brute force becomes a lot harder, but social engineering becomes easier.
- rkeene2 3y agoThe world's largest employer (US Government) uses Smartcards (and no passwords).
- dymk 3y agohttps://duo.com/product/multi-factor-authentication-mfa/duo-mobile-app https://duo.com/product/multi-factor-authentication-mfa/duo-...
- cbzoiav 3y agoThere are a huge number of app based solutions. Enterprises are against them because they can't expect their employees to install 20 different apps for 20 different vendors + the cost of reviewing and onboarding them. So you either need to support SMS or several of the major 2FA app providers including the crappier implementations like Microsoft authenticator.
- dymk 3y agoI work at an "enterprise" company and I'm not expected to install 20 different apps. Duo is just one example, but it supports both push based 2FA and onetime tokens, and those two modalities cover every vendor integration and SSO we have. There's really no excuse to be using SMS nowadays.
- deleted 3y ago[deleted]
- alexcroox 3y agoWe all here live in a tech bubble. None of my friends and family have a 2FA app, or know what one is. They understand SMS, and it's better than no 2FA at all.
- buro9 3y agoEmail is better still. At worst it's no worse than SMS, but at best it's at least secure in transport and effectively free. The downside to email is primarily that data is not a roaming perk for many. But if it's too access an app then a reasonable assumption of internet access even if not on the mobile is valid.
- airtag 3y agoThe other two downsides are: Some people may chose not to have their email account on the phone. Personally I don't want to carry around access to my main email at all times (the same goes for access to my main bank account, BTW.) Also, email delivery sometimes takes a very long time, it can be minutes, if you rely on email forwarding to protect your main email address. Auth apps are better for 2FA, at least for me.
- yosito 3y agoIf it weren't for SMS 2FA, I wouldn't carry around my "phone" number on my phone. I'd just use data-only SIM cards.
- weird-eye-issue 3y agoEmail is absolutely worse than SMS
- rkeene2 3y agoIn what way is email worse than SMS ?
- weird-eye-issue 3y ago
- switch007 3y agoBut what other excuse would they use to harvest your phone number?
- yashap 3y ago2FA is not the main target here, it’s SMS one time password flows. Where you never go through a traditional account setup, you just enter your phone number, it sends you a text with a one time password (generally embedded in a URL you can click), and you’re logged in. With 2FA, you at least have to log into successfully without the cell phone first, it’s harder to exploit. You can pretty easily rate limit 2FA prompts per account, auto-ban malicious accounts, etc. While SMS OTP flows are extremely easy to exploit - the text is sent before any sort of association with and account occurs, making rate limiting, banning, etc. much more difficult.