4 ms·

What do you mean? I "have" access to my SMSes via my phone, and I "have" access to my email or my Authy also via my phone. If you get my phone, you can: 1. sta

by aftbit 3y ago

What do you mean? I "have" access to my SMSes via my phone, and I "have" access to my email or my Authy also via my phone. If you get my phone, you can: 1. start password reset via email 2. confirm via SMS 2FA So that makes this into 1FA not 2FA. At least for TOTP secrets, I can store them securely, and attackers cannot convince a human support agent somewhere to hand them over. If you want true 2FA, you need something like WebAuthn with hardware tokens where the private key is on the token, but then you need a recovery process, and that takes you right back to the lowest common denominator of SMS verification.

FabHK 3y ago
You need the SIM to receive SMS ("possession"), not just a password ("knowledge"). For email, you just need knowledge.
- aftbit 3y ago
  I disagree. To access my email, I need to do one of a few things: 1. Use a device I already have authenticated to access it (something I have) 2. Log in to my email again, going through Google authentication, which includes a proper 2FA system (password plus either Yubikey or TOTP auth code), and is protected by Google's relatively strong security. 3. Log into my domain registrar and change my DNS to point my email somewhere else. This is also protected by 2FA but is probably an easier vector to gain access to my email. 4. (hypothetically) Hack Google (either by hacking the password reset flow, or hacking their actual backends) and gain access to my email messages. This seems relatively difficult but I include it for completeness. If I want to gain access to SMS sent to my phone, I need to do one of a few things: 1. Use a device that is already authenticated, my phone with its SIM (something I have) 2. Log into my T-Mobile account and order a new SIM 3. Contact T-Mobile support and convince them to SIM-swap or port-out my number So I get where they are coming from, but IMO neither SMS nor email proves access to "something I have". Both have relatively easy recovery processes that allow someone who has _nothing at all_ to gain access to my messages. SMS just happens to be run by legacy companies that do not take security nearly as seriously as the average modern email provider. Outlook, Google, Proton, Fastmail, etc all have better security than T-Mobile. They (and other major carriers) are famously bad at ensuring that they do not SIM-swaps. Hackers buy access to low-level customer service credentials and offer swaps for $100 to $10000 USD depending on the target. If you truly want to prove "something I have", then you need to go to a hardware token issued by a trusted vendor, potentially with a key baked into it. These were quite common in the past. TOTP and HOTP used on a hardware token predates their use on phones, and they are still issued for things like wire authorization by business banks, or even PayPal (I think). Or you could use WebAuthn or PassKeys or whatever they are called now, binding the token to the TPM in your general computing device, or using a specialized security processor like a YubiKey or Ledger. I understand why SMS might be accepted as a "lowest common denominator" second factor. It is certainly better than nothing at all. It just should not be seen as more secure than TOTP or email IMO.

by aftbit 3y ago

FabHK 3y ago

You need the SIM to receive SMS ("possession"), not just a password ("knowledge"). For email, you just need knowledge.

aftbit 3y ago
I disagree. To access my email, I need to do one of a few things: 1. Use a device I already have authenticated to access it (something I have) 2. Log in to my email again, going through Google authentication, which includes a proper 2FA system (password plus either Yubikey or TOTP auth code), and is protected by Google's relatively strong security. 3. Log into my domain registrar and change my DNS to point my email somewhere else. This is also protected by 2FA but is probably an easier vector to gain access to my email. 4. (hypothetically) Hack Google (either by hacking the password reset flow, or hacking their actual backends) and gain access to my email messages. This seems relatively difficult but I include it for completeness. If I want to gain access to SMS sent to my phone, I need to do one of a few things: 1. Use a device that is already authenticated, my phone with its SIM (something I have) 2. Log into my T-Mobile account and order a new SIM 3. Contact T-Mobile support and convince them to SIM-swap or port-out my number So I get where they are coming from, but IMO neither SMS nor email proves access to "something I have". Both have relatively easy recovery processes that allow someone who has _nothing at all_ to gain access to my messages. SMS just happens to be run by legacy companies that do not take security nearly as seriously as the average modern email provider. Outlook, Google, Proton, Fastmail, etc all have better security than T-Mobile. They (and other major carriers) are famously bad at ensuring that they do not SIM-swaps. Hackers buy access to low-level customer service credentials and offer swaps for $100 to $10000 USD depending on the target. If you truly want to prove "something I have", then you need to go to a hardware token issued by a trusted vendor, potentially with a key baked into it. These were quite common in the past. TOTP and HOTP used on a hardware token predates their use on phones, and they are still issued for things like wire authorization by business banks, or even PayPal (I think). Or you could use WebAuthn or PassKeys or whatever they are called now, binding the token to the TPM in your general computing device, or using a specialized security processor like a YubiKey or Ledger. I understand why SMS might be accepted as a "lowest common denominator" second factor. It is certainly better than nothing at all. It just should not be seen as more secure than TOTP or email IMO.