3 ms·

Ironically SMS 2fa is less safer than just using a password

hospitalJail 3y ago
I'm ready for this future. Heck, I don't even like that email can be used to recover basically every account. Someone gets your computer unlocked? They have access to email and everything.
MichaelZuo 3y ago
That's what really bothers me, especially when very complex passwords are already enforced, it's like cargo cult security.
achandlerwhite 3y ago
I think the real issue is phone based account recovery rather than 2FA. It effectively turns 2FA into 1FA.
mr_mitm 3y ago
That's not true. SMS 2FA may be the weakest form of 2FA, but it cannot be weaker than just using a password, because you always also need the password. As someone else pointed out, SMS based account recovery is the culprit.
- lxgr 3y ago
  Going strictly by the definition that's correct, but if you take a look at the number of services that allow you to reset your password using only an SMS-OTP you'll quickly realize that reality doesn't live up to that ideal. I mean, at least SMS-OTPs are one-time use, i.e. they don't facilitate a compromise if done correctly, but the "done correctly" part here is once again very load-bearing.
- trompetenaccoun 3y ago
  He did not use phone/SMS as his 2FA it seems, because he knew it's insecure, per his tweet. But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. There is nothing the user can do. Since these incompetent telecom employees get social engineered again and again, it's simply bad practice to have anything phone number related for security. Twitter and other companies need to change this, it's not safe.
  - mr_mitm 3y ago
    > But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. Sure, but that is not 2FA. It's 1FA. They could have used e-mail as the recovery mechanism to send a password reset link, then it still would have been SMS 2FA if they then required the SMS factor upon authentication and it would have been secure. This wasn't a problem of SMS 2FA, it was a problem of SMS based account recovery.
- mindslight 3y ago
  "SMS 2FA" makes bank account balances strictly less secure. The main thing you need to do to keep your bank balance secure is verify your transactions every statement period. Increasing login friction discourages the checking of transactions.
  - mr_mitm 3y ago
    How does SMS 2FA make bank account balances (what do you even mean by that?) strictly less secure than having password 1FA? In both cases the attacker needs the password (or the client cert, whatever the other factor is), but only in the SMS 2FA case the attacker has to perform SIM swapping.
    - mindslight 3y ago
      After the first sentence, there were two more sentences explaining that. "Bank balance" meaning the money in your bank account, as opposed to information about your transactions. I did forget to include that my comment was US-centric.
      - mr_mitm 3y ago
        Sorry, I still don't follow. With SMS 2FA the attacker needs strictly more information as compared to just a password. It doesn't matter if you log into your bank account or twitter. Did you mean a TAN for protecting individual transactions? I file this under authorization instead of authentication. But even then a SMS TAN is better than no TAN. I cannot see a scenario where adding SMS authentication makes things less secure.
        mindslight 3y ago
        You're focusing on an imagined attacker performing a single type of attack, and losing sight of more significant avenues for damage. When talking about the possibility of losing money, the main thing you need to do is check your account transactions within 30 days of being issued a statement. This is required so that you can report unauthorized transactions in a timely manner, so that they can be reversed. Transaction authentication essentially doesn't matter, especially in the consumer market - remember banks are still happily chugging along printing a withdrawal key on the front of every check. Any impediment to verifying your transactions in a timely manner, including for example discontinuing OFX Direct Connect access in the name of "2FA", increases the chance that you might miss the dispute period and actually lose money.
- delfinom 3y ago
  Not to worry, great companies like Google harass you to set a recovery phone number /s No seriously, it is aggravating how much SMS account recovery is a thing. Google even displays banners of "You are missing recovery information" because you set a recovery email but not a recovery phone.
  - yomlica8 3y ago
    Recovery phone numbers are much more useful for user tracking than emails though.

I'm ready for this future. Heck, I don't even like that email can be used to recover basically every account. Someone gets your computer unlocked? They have access to email and everything.

MichaelZuo 3y ago

That's what really bothers me, especially when very complex passwords are already enforced, it's like cargo cult security.

achandlerwhite 3y ago

I think the real issue is phone based account recovery rather than 2FA. It effectively turns 2FA into 1FA.

mr_mitm 3y ago

That's not true. SMS 2FA may be the weakest form of 2FA, but it cannot be weaker than just using a password, because you always also need the password. As someone else pointed out, SMS based account recovery is the culprit.

lxgr 3y ago
Going strictly by the definition that's correct, but if you take a look at the number of services that allow you to reset your password using only an SMS-OTP you'll quickly realize that reality doesn't live up to that ideal. I mean, at least SMS-OTPs are one-time use, i.e. they don't facilitate a compromise if done correctly, but the "done correctly" part here is once again very load-bearing.
trompetenaccoun 3y ago
He did not use phone/SMS as his 2FA it seems, because he knew it's insecure, per his tweet. But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. There is nothing the user can do. Since these incompetent telecom employees get social engineered again and again, it's simply bad practice to have anything phone number related for security. Twitter and other companies need to change this, it's not safe.
- mr_mitm 3y ago
  > But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. Sure, but that is not 2FA. It's 1FA. They could have used e-mail as the recovery mechanism to send a password reset link, then it still would have been SMS 2FA if they then required the SMS factor upon authentication and it would have been secure. This wasn't a problem of SMS 2FA, it was a problem of SMS based account recovery.
mindslight 3y ago
"SMS 2FA" makes bank account balances strictly less secure. The main thing you need to do to keep your bank balance secure is verify your transactions every statement period. Increasing login friction discourages the checking of transactions.
- mr_mitm 3y ago
  How does SMS 2FA make bank account balances (what do you even mean by that?) strictly less secure than having password 1FA? In both cases the attacker needs the password (or the client cert, whatever the other factor is), but only in the SMS 2FA case the attacker has to perform SIM swapping.
  - mindslight 3y ago
    After the first sentence, there were two more sentences explaining that. "Bank balance" meaning the money in your bank account, as opposed to information about your transactions. I did forget to include that my comment was US-centric.
    - mr_mitm 3y ago
      Sorry, I still don't follow. With SMS 2FA the attacker needs strictly more information as compared to just a password. It doesn't matter if you log into your bank account or twitter. Did you mean a TAN for protecting individual transactions? I file this under authorization instead of authentication. But even then a SMS TAN is better than no TAN. I cannot see a scenario where adding SMS authentication makes things less secure.
      - mindslight 3y ago
        You're focusing on an imagined attacker performing a single type of attack, and losing sight of more significant avenues for damage. When talking about the possibility of losing money, the main thing you need to do is check your account transactions within 30 days of being issued a statement. This is required so that you can report unauthorized transactions in a timely manner, so that they can be reversed. Transaction authentication essentially doesn't matter, especially in the consumer market - remember banks are still happily chugging along printing a withdrawal key on the front of every check. Any impediment to verifying your transactions in a timely manner, including for example discontinuing OFX Direct Connect access in the name of "2FA", increases the chance that you might miss the dispute period and actually lose money.
delfinom 3y ago
Not to worry, great companies like Google harass you to set a recovery phone number /s No seriously, it is aggravating how much SMS account recovery is a thing. Google even displays banners of "You are missing recovery information" because you set a recovery email but not a recovery phone.
- yomlica8 3y ago
  Recovery phone numbers are much more useful for user tracking than emails though.