5 ms·

This makes me feel really good that the Canada Revenue Agency and most banks in Canada use SMS for second factor auth!

lxgr 3y ago
The EBA (the European banking regulator in charge of specifying the technical details of the PSD2 regulation, which covers secure cardholder authentication, among other things) also stated a while ago that only SMS-OTP is a "true" factor; Email-OTP isn't. Ironically, my email account is so much better protected than my mobile phone number. I'm trying very hard to believe that the SMS lobby (i.e. mobile phone operators, which earn multiple cents per inbound SMS in Europe, as well as our friendly SMS verification providers adding their markup on that) didn't exert some pressure on the regulators here...
- FabHK 3y ago
  Insofar as one of the factors should be something the user knows, and one factor something the user has, that makes perfect sense. You know your password (or the master password to your password manager), and you have your phone with the SIM card. With email (or Authy), the second factor is also something you know, thus it's not 2F anymore. Note that NIST also recommends against email as a factor in 2FA (A-B11 here: https://pages.nist.gov/800-63-FAQ/ https://pages.nist.gov/800-63-FAQ/ ), and says that SMS OTP must be directed to a phone, not an IP address (such as with VoIP, see A-B01 in the same document). "Methods that do not prove possession of a specific device, such as voice-over-IP (VOIP) or email, SHALL NOT be used for out-of-band authentication." (5.1.3.1 of NIST SP 800-63B)
  - aftbit 3y ago
    What do you mean? I "have" access to my SMSes via my phone, and I "have" access to my email or my Authy also via my phone. If you get my phone, you can: 1. start password reset via email 2. confirm via SMS 2FA So that makes this into 1FA not 2FA. At least for TOTP secrets, I can store them securely, and attackers cannot convince a human support agent somewhere to hand them over. If you want true 2FA, you need something like WebAuthn with hardware tokens where the private key is on the token, but then you need a recovery process, and that takes you right back to the lowest common denominator of SMS verification.
    - FabHK 3y ago
      You need the SIM to receive SMS ("possession"), not just a password ("knowledge"). For email, you just need knowledge.
      - aftbit 3y ago
        I disagree. To access my email, I need to do one of a few things: 1. Use a device I already have authenticated to access it (something I have) 2. Log in to my email again, going through Google authentication, which includes a proper 2FA system (password plus either Yubikey or TOTP auth code), and is protected by Google's relatively strong security. 3. Log into my domain registrar and change my DNS to point my email somewhere else. This is also protected by 2FA but is probably an easier vector to gain access to my email. 4. (hypothetically) Hack Google (either by hacking the password reset flow, or hacking their actual backends) and gain access to my email messages. This seems relatively difficult but I include it for completeness. If I want to gain access to SMS sent to my phone, I need to do one of a few things: 1. Use a device that is already authenticated, my phone with its SIM (something I have) 2. Log into my T-Mobile account and order a new SIM 3. Contact T-Mobile support and convince them to SIM-swap or port-out my number So I get where they are coming from, but IMO neither SMS nor email proves access to "something I have". Both have relatively easy recovery processes that allow someone who has _nothing at all_ to gain access to my messages. SMS just happens to be run by legacy companies that do not take security nearly as seriously as the average modern email provider. Outlook, Google, Proton, Fastmail, etc all have better security than T-Mobile. They (and other major carriers) are famously bad at ensuring that they do not SIM-swaps. Hackers buy access to low-level customer service credentials and offer swaps for $100 to $10000 USD depending on the target. If you truly want to prove "something I have", then you need to go to a hardware token issued by a trusted vendor, potentially with a key baked into it. These were quite common in the past. TOTP and HOTP used on a hardware token predates their use on phones, and they are still issued for things like wire authorization by business banks, or even PayPal (I think). Or you could use WebAuthn or PassKeys or whatever they are called now, binding the token to the TPM in your general computing device, or using a specialized security processor like a YubiKey or Ledger. I understand why SMS might be accepted as a "lowest common denominator" second factor. It is certainly better than nothing at all. It just should not be seen as more secure than TOTP or email IMO.
  - lxgr 3y ago
    > you have your phone with the SIM card. Yeah, or a fraudster that talked my provider in to SIM-swapping it or porting out my number (quite possible, since many phone providers don't have 2FA themselves!), or malware on my Android phone with access to incoming SMS, or (although much less likely) an SS7 attacker... A SIM is indeed a smart card theoretically capable of acting as a true "possession" factor (e.g. using EAP-AKA/EAP-SIM, although almost nobody uses that) – but calling it a possession factor for SMS-OTP is at least as much as a stretch as calling an email inbox a knowledge-only factor: Accessing my inbox requires a FIDO authenticator and password. > Note that NIST also recommends against email as a factor in 2FA I guess bad decisions and/or lobbying aren't limited to European regulators/legislators then.

lxgr 3y ago

The EBA (the European banking regulator in charge of specifying the technical details of the PSD2 regulation, which covers secure cardholder authentication, among other things) also stated a while ago that only SMS-OTP is a "true" factor; Email-OTP isn't. Ironically, my email account is so much better protected than my mobile phone number. I'm trying very hard to believe that the SMS lobby (i.e. mobile phone operators, which earn multiple cents per inbound SMS in Europe, as well as our friendly SMS verification providers adding their markup on that) didn't exert some pressure on the regulators here...

FabHK 3y ago
Insofar as one of the factors should be something the user knows, and one factor something the user has, that makes perfect sense. You know your password (or the master password to your password manager), and you have your phone with the SIM card. With email (or Authy), the second factor is also something you know, thus it's not 2F anymore. Note that NIST also recommends against email as a factor in 2FA (A-B11 here: https://pages.nist.gov/800-63-FAQ/ https://pages.nist.gov/800-63-FAQ/ ), and says that SMS OTP must be directed to a phone, not an IP address (such as with VoIP, see A-B01 in the same document). "Methods that do not prove possession of a specific device, such as voice-over-IP (VOIP) or email, SHALL NOT be used for out-of-band authentication." (5.1.3.1 of NIST SP 800-63B)
- aftbit 3y ago
  What do you mean? I "have" access to my SMSes via my phone, and I "have" access to my email or my Authy also via my phone. If you get my phone, you can: 1. start password reset via email 2. confirm via SMS 2FA So that makes this into 1FA not 2FA. At least for TOTP secrets, I can store them securely, and attackers cannot convince a human support agent somewhere to hand them over. If you want true 2FA, you need something like WebAuthn with hardware tokens where the private key is on the token, but then you need a recovery process, and that takes you right back to the lowest common denominator of SMS verification.
  - FabHK 3y ago
    You need the SIM to receive SMS ("possession"), not just a password ("knowledge"). For email, you just need knowledge.
    - aftbit 3y ago
      I disagree. To access my email, I need to do one of a few things: 1. Use a device I already have authenticated to access it (something I have) 2. Log in to my email again, going through Google authentication, which includes a proper 2FA system (password plus either Yubikey or TOTP auth code), and is protected by Google's relatively strong security. 3. Log into my domain registrar and change my DNS to point my email somewhere else. This is also protected by 2FA but is probably an easier vector to gain access to my email. 4. (hypothetically) Hack Google (either by hacking the password reset flow, or hacking their actual backends) and gain access to my email messages. This seems relatively difficult but I include it for completeness. If I want to gain access to SMS sent to my phone, I need to do one of a few things: 1. Use a device that is already authenticated, my phone with its SIM (something I have) 2. Log into my T-Mobile account and order a new SIM 3. Contact T-Mobile support and convince them to SIM-swap or port-out my number So I get where they are coming from, but IMO neither SMS nor email proves access to "something I have". Both have relatively easy recovery processes that allow someone who has _nothing at all_ to gain access to my messages. SMS just happens to be run by legacy companies that do not take security nearly as seriously as the average modern email provider. Outlook, Google, Proton, Fastmail, etc all have better security than T-Mobile. They (and other major carriers) are famously bad at ensuring that they do not SIM-swaps. Hackers buy access to low-level customer service credentials and offer swaps for $100 to $10000 USD depending on the target. If you truly want to prove "something I have", then you need to go to a hardware token issued by a trusted vendor, potentially with a key baked into it. These were quite common in the past. TOTP and HOTP used on a hardware token predates their use on phones, and they are still issued for things like wire authorization by business banks, or even PayPal (I think). Or you could use WebAuthn or PassKeys or whatever they are called now, binding the token to the TPM in your general computing device, or using a specialized security processor like a YubiKey or Ledger. I understand why SMS might be accepted as a "lowest common denominator" second factor. It is certainly better than nothing at all. It just should not be seen as more secure than TOTP or email IMO.
- lxgr 3y ago
  > you have your phone with the SIM card. Yeah, or a fraudster that talked my provider in to SIM-swapping it or porting out my number (quite possible, since many phone providers don't have 2FA themselves!), or malware on my Android phone with access to incoming SMS, or (although much less likely) an SS7 attacker... A SIM is indeed a smart card theoretically capable of acting as a true "possession" factor (e.g. using EAP-AKA/EAP-SIM, although almost nobody uses that) – but calling it a possession factor for SMS-OTP is at least as much as a stretch as calling an email inbox a knowledge-only factor: Accessing my inbox requires a FIDO authenticator and password. > Note that NIST also recommends against email as a factor in 2FA I guess bad decisions and/or lobbying aren't limited to European regulators/legislators then.