7 ms·

How about instead we just make it illegal to use SMS for identity verification? I'm tired of "Your phone is your identity". It's exclusive of certain society me

How about instead we just make it illegal to use SMS for identity verification? I'm tired of "Your phone is your identity". It's exclusive of certain society members anyway, horribly not-encrypted, not-authenticated, can be intercepted, replayed, spoofed, phished, and a million other reasons. Your phone number should not be your gateway to essential services like banking, investments, or even personal life. The madness has to _fucking_ stop.

patrick451 3y ago
Makes sense in principle, but what's the alternative? Do we get rid of 2FA altogether?
- exabrial 3y ago
  Sms “auth” is doing nothing but piggybacking/hijacking the hard credit pull the carriers ran on you when you got your phone. So something that indicates there’s a real person there paying a bill. Plenty of room for innovation here but my suspicion would be that it be a function of a credit bureau.
  - bensecure 3y ago
    Does sms auth not work with prepaid sim cards? I think the real benefit is that a sim card is basically a trusted computing device, but with a system in place at the carrier to give you back your number if you lose it. In effect, its a digital proof of identity. Since identity is fundamentally the job of the government, the real solution should be id cards with trusted computing chips in them. Though that will open up a can of worms with regards to privacy and government overreach.
    - mindslight 3y ago
      Simple answer: implement a privacy law with teeth. It doesn't even need to be framed from scratch - the GDPR does a fantastic job at preempting most of the flaws that lobbyists would love to slip in.
      - naniwaduni 3y ago
        What is the whole "consent" nonsense in the GDPR if not a huge gaping flaw slipped in by lobbyists?
    - tsimionescu 3y ago
      It does, but in most of Europe at least, the process for (legally) getting a prepaid SIM card also involves showing government ID.
  - otabdeveloper4 3y ago
    Lots of countries don't have the concept of "credit rating" and yet still everyone uses the phone as a second factor, everywhere. No, the reason is that your phone number effectively functions as your personal ID, lacking of any other good alternative.
  - SheinhardtWigCo 3y ago
    It already is the function of a credit bureau, and they're not doing a very good job. AT&T required me to go to a retail store with government-issued ID and provide the last 4 digits of my SSN. I then had to answer some questions that were clearly provided by a credit bureau; all of them were some version of "which of these 5 addresses have you lived at before?" This was concerning because I'd think that for most people, with a bit of digging, it's not that hard to get a list of previous addresses. But sim swapping should probably be at least as difficult as obtaining a replacement passport or drivers license.
- DANmode 3y ago
  "Passkeys" Passwordless, whatever it's called this week.
- jesseendahl 3y ago
  The alternative is passkeys, which are strongly phishing-resistant and don't require an annoying "second factor" step for the user at all.
  - drdaeman 3y ago
    While true and while absolutely better from the security and privacy standpoints, aren't passkeys less inclusive than SMS 2FA? Honest question - I'm not sure. I can see them being more both less and more inclusive: it's somewhat more inclusive because they don't require any monetary payments on a monthly basis to keep the phone number active, but it's also most likely significantly less in terms of adoption. Also, passkeys don't provide a way to perform non-Internet authentication. Like when you call your bank or they call you, you cannot use a passkey to authenticate each other purely over the phone, you need to be online. While this is surely technically possible to do over the phone (or postal pigeons -- j/k), it's not even on a radar and is extremely unlikely to ever happen in any foreseeable future.
- vegetablepotpie 3y ago
  Ideally consumers would have access to multiple 2FA methods that all vendors support standard, including SMS, app based authentication, RSA keys, Yubikeys etc. that the user would choose based on the users constraints, need for convenience, and threat model.
- Aardwolf 3y ago
  In mainland Europe, banks used 2FA devices with a little lcd display since at least the early 2000s. Now they're going more phone based which feels like a step back to me (but more convenient of course... though I hate the kind that makes you film a colored qr code from your pc monitor: doesn't work in mobile browser since phone camera can't look at its own screen, and makes you look like photographing your pc screen)
  - InCityDreams 3y ago
    Bastard bank charges me €20 for one of those LCD things. Luckily the battery lasts multiple years. The device particularly saved me when my phone got dropped and all i could do was email the world.
  - svennek 3y ago
    In Denmark, we have a common login system called MitID (translated: MyID), which is used by all bank, insurance company, the governmental digital mail system (not email, but pdf's in a vault) and it still-alive now-commercial-only predecessor. I believe it is by law. The system is 2FA with either your phone or a hardware dongle proving your identity. It is strongly authenticating you as a person, that is precisely identified (but the services are only getting a token, but it can also validate your person-number - think SSN in US context). It is quite harsh in device security, recently failing on beta versions of Android - on top of afaik always failing on rooted devices... The phone version also requires you to scan a continuously changing qr-code twice to proceed, which is shown when you need to identify yourself (in an I-frame). This is to ensure you are "physically" present where you are being authenticated (i.e. to block of some phone scams). Works pretty well and is reasonable secure, whilst still having some flaws.. In the future, I believe this system will work in some/all of the EU due to the coming eIDAS legislation...
- bdcravens 3y ago
  TOTP apps are good enough in most cases.
- koito17 3y ago
  Multi-factor authentication doesn't need a cellular phone. I personally use TOTP codes and security keys whenever I can, as I am very weary of giving away my phone number (I want to believe this is why I rarely get spam calls or texts). There is an obvious downside to security keys (cannot be backed up or transfer secrets), but passkeys are slowly becoming a viable alternative, which gives you almost the same level of security as security keys implementing FIDO2. Major services like GitHub already allow passkey authentication. Both iOS and Android have supported passkeys for a while now, and so have all of the major browsers (Chrome, Firefox, Safari). So overall, I think passkeys are a good alternative to SMS :)
  - kredd 3y ago
    Now try to explain that to a person in their 70s that are thrice removed from tech industry while they're trying to check their bank account balance. I agree with you 100%, I wish we went for much secure way. Unfortunately UX friction and pre-established ideas will make it way harder to roll out to the general public.
    - extraduder_ire 3y ago
      I think 2fa card readers that use your bank card (like the one that goes in an ATM) to generate a code are easier to understand than receiving an SMS. Especially here in chip-and-pin land.
    - squigz 3y ago
      Couldn't the same thing have been said for SMS 2FA, and not all that long ago?
      - andrewflnr 3y ago
        Honestly "plug the little black thing in here, rub the gold dot when the screen says" is better ux than typing numbers. Have you ever the heard stories where people aren't able to type in their code before it expires?
    - artificialLimbs 3y ago
- noqc 3y ago
  yes.
- safety1st 3y ago
  The immediate alternatives which are available today are 2FA via email or via an authenticator app such as Authy or Google Authenticator. So it's entirely a matter of whatever idiot companies decided to implement 2FA exclusively via SMS, adding support for one or both of those. I'm another person who hates having to do 2FA via phone all the time, I am overseas a lot and it can pose serious problems for account access. I found out today that Authy even has a Linux client - hopefully this is the beginning of my life getting a lot easier.
michaeljx 3y ago
Most of the world does SMS 2fa without an issue. It is only a problem in the US where anyone can pretend to be anyone else, take over their identity, SSN, mobile number, take a loan in their name etc etc.
- redox99 3y ago
  SIM swapping is a problem in most countries.
  - reboot81 3y ago
    And the ones who don’t experience this issue at all, perhaps US could study why that is?
    - Dylan16807 3y ago
      > And the ones who don’t experience this issue at all, perhaps US could study why that is? You'll have to name a few first. I know the comment you replied to said "most", but that's not a declaration that any countries have actually solved the issue. It's more that some countries are just too small/isolated to see certain crimes, so it's easier to say "most" than "all".
- saurik 3y ago
  The problem isn't "2fa": the problem is services that just use it as your identity. You'll go to sign in to the account and it merely asks for your phone number, to which it sends a login link. Or--even more unacceptable as it makes you THINK the password matters--you'll say you "forgot your password" and it sends a code to your phone number and that code is all that was required to get back into the account. This isn't a second factor: this is replacing your first factor (your password); maybe you could call it an "alternative factor"?
  - shortcake27 3y ago
    It’s impressive how some of the most successful tech companies in the world get this wrong. If you give your phone number to Google, they will pressure you to enable SMS MFA and SMS account recovery. So your phone number becomes the weakest link into your account, which is pretty bad considering the state of sim swapping. Google and other companies should make this clear to users. You should never have both SMS MFA and SMS account recovery enabled. If you must, only ever enable one. Ideally, neither.
shortcake27 3y ago
There is a specific issue with SMS that I hate more than any of the issues you mentioned - the state of roaming. Because every company on the planet forces me to provide my phone number to auth me with SMS, I now need to pay for roaming to use this god-awful method of authentication I never signed up for. On top of the local sim card I still need to buy, because roaming is often throttled to unusable speeds. But it gets better. If I break my phone, I can currently move my physical sim into a new device in a matter of seconds. No problem. But with Apple removing the physical sim, soon I’m going to be forced to switch to eSIM. eSIM is marketed as more practical, yet in reality it is anything but. I’ve been following forums for many telcos in the UK and Australia to understand the problems people face with eSIM. First of all, if it is even possible to provision a new eSIM, most telcos lock this behind SMS 2FA. So if you break your phone, you can’t log in to provision a new eSIM. Also, usually this needs to done using an app, which is often only available in the telco’s region. So if you live between countries, you’re again out of luck. Some telcos require you to visit a physical store to move an eSIM to a new device. Some telcos won’t provision a new eSIM electronically, requiring you to use a physical cardboard QR kit. And some telcos can only activate a new eSIM when the device is connected directly to their network, so even if you somehow managed to jump through all these hoops, you still wouldn’t be able to activate a new eSIM abroad. So if you break your phone overseas, you either need to live without banking and a range of other services, or book an immediate flight back to your home country just to provision a new eSIM. Calling this madness is an understatement. Any company forcing MFA must allow users to pick from a range of open standards.
- thaumasiotes 3y ago
  > So if you break your phone overseas, you either need to live without banking and a range of other services, or book an immediate flight back to your home country just to provision a new eSIM. I have these services connected to a Google Voice number.
  - idontwantthis 3y ago
    Not every service will let you use VoIP. Capital One for example.

patrick451 3y ago

Makes sense in principle, but what's the alternative? Do we get rid of 2FA altogether?

exabrial 3y ago
Sms “auth” is doing nothing but piggybacking/hijacking the hard credit pull the carriers ran on you when you got your phone. So something that indicates there’s a real person there paying a bill. Plenty of room for innovation here but my suspicion would be that it be a function of a credit bureau.
- bensecure 3y ago
  Does sms auth not work with prepaid sim cards? I think the real benefit is that a sim card is basically a trusted computing device, but with a system in place at the carrier to give you back your number if you lose it. In effect, its a digital proof of identity. Since identity is fundamentally the job of the government, the real solution should be id cards with trusted computing chips in them. Though that will open up a can of worms with regards to privacy and government overreach.
  - mindslight 3y ago
    Simple answer: implement a privacy law with teeth. It doesn't even need to be framed from scratch - the GDPR does a fantastic job at preempting most of the flaws that lobbyists would love to slip in.
    - naniwaduni 3y ago
      What is the whole "consent" nonsense in the GDPR if not a huge gaping flaw slipped in by lobbyists?
  - tsimionescu 3y ago
    It does, but in most of Europe at least, the process for (legally) getting a prepaid SIM card also involves showing government ID.
- otabdeveloper4 3y ago
  Lots of countries don't have the concept of "credit rating" and yet still everyone uses the phone as a second factor, everywhere. No, the reason is that your phone number effectively functions as your personal ID, lacking of any other good alternative.
- SheinhardtWigCo 3y ago
  It already is the function of a credit bureau, and they're not doing a very good job. AT&T required me to go to a retail store with government-issued ID and provide the last 4 digits of my SSN. I then had to answer some questions that were clearly provided by a credit bureau; all of them were some version of "which of these 5 addresses have you lived at before?" This was concerning because I'd think that for most people, with a bit of digging, it's not that hard to get a list of previous addresses. But sim swapping should probably be at least as difficult as obtaining a replacement passport or drivers license.
DANmode 3y ago
"Passkeys" Passwordless, whatever it's called this week.
jesseendahl 3y ago
The alternative is passkeys, which are strongly phishing-resistant and don't require an annoying "second factor" step for the user at all.
- drdaeman 3y ago
  While true and while absolutely better from the security and privacy standpoints, aren't passkeys less inclusive than SMS 2FA? Honest question - I'm not sure. I can see them being more both less and more inclusive: it's somewhat more inclusive because they don't require any monetary payments on a monthly basis to keep the phone number active, but it's also most likely significantly less in terms of adoption. Also, passkeys don't provide a way to perform non-Internet authentication. Like when you call your bank or they call you, you cannot use a passkey to authenticate each other purely over the phone, you need to be online. While this is surely technically possible to do over the phone (or postal pigeons -- j/k), it's not even on a radar and is extremely unlikely to ever happen in any foreseeable future.
vegetablepotpie 3y ago
Ideally consumers would have access to multiple 2FA methods that all vendors support standard, including SMS, app based authentication, RSA keys, Yubikeys etc. that the user would choose based on the users constraints, need for convenience, and threat model.
Aardwolf 3y ago
In mainland Europe, banks used 2FA devices with a little lcd display since at least the early 2000s. Now they're going more phone based which feels like a step back to me (but more convenient of course... though I hate the kind that makes you film a colored qr code from your pc monitor: doesn't work in mobile browser since phone camera can't look at its own screen, and makes you look like photographing your pc screen)
- InCityDreams 3y ago
  Bastard bank charges me €20 for one of those LCD things. Luckily the battery lasts multiple years. The device particularly saved me when my phone got dropped and all i could do was email the world.
- svennek 3y ago
  In Denmark, we have a common login system called MitID (translated: MyID), which is used by all bank, insurance company, the governmental digital mail system (not email, but pdf's in a vault) and it still-alive now-commercial-only predecessor. I believe it is by law. The system is 2FA with either your phone or a hardware dongle proving your identity. It is strongly authenticating you as a person, that is precisely identified (but the services are only getting a token, but it can also validate your person-number - think SSN in US context). It is quite harsh in device security, recently failing on beta versions of Android - on top of afaik always failing on rooted devices... The phone version also requires you to scan a continuously changing qr-code twice to proceed, which is shown when you need to identify yourself (in an I-frame). This is to ensure you are "physically" present where you are being authenticated (i.e. to block of some phone scams). Works pretty well and is reasonable secure, whilst still having some flaws.. In the future, I believe this system will work in some/all of the EU due to the coming eIDAS legislation...
bdcravens 3y ago
TOTP apps are good enough in most cases.
koito17 3y ago
Multi-factor authentication doesn't need a cellular phone. I personally use TOTP codes and security keys whenever I can, as I am very weary of giving away my phone number (I want to believe this is why I rarely get spam calls or texts). There is an obvious downside to security keys (cannot be backed up or transfer secrets), but passkeys are slowly becoming a viable alternative, which gives you almost the same level of security as security keys implementing FIDO2. Major services like GitHub already allow passkey authentication. Both iOS and Android have supported passkeys for a while now, and so have all of the major browsers (Chrome, Firefox, Safari). So overall, I think passkeys are a good alternative to SMS :)
- kredd 3y ago
  Now try to explain that to a person in their 70s that are thrice removed from tech industry while they're trying to check their bank account balance. I agree with you 100%, I wish we went for much secure way. Unfortunately UX friction and pre-established ideas will make it way harder to roll out to the general public.
  - extraduder_ire 3y ago
    I think 2fa card readers that use your bank card (like the one that goes in an ATM) to generate a code are easier to understand than receiving an SMS. Especially here in chip-and-pin land.
  - squigz 3y ago
    Couldn't the same thing have been said for SMS 2FA, and not all that long ago?
    - andrewflnr 3y ago
      Honestly "plug the little black thing in here, rub the gold dot when the screen says" is better ux than typing numbers. Have you ever the heard stories where people aren't able to type in their code before it expires?
  - artificialLimbs 3y ago
noqc 3y ago
yes.
safety1st 3y ago
The immediate alternatives which are available today are 2FA via email or via an authenticator app such as Authy or Google Authenticator. So it's entirely a matter of whatever idiot companies decided to implement 2FA exclusively via SMS, adding support for one or both of those. I'm another person who hates having to do 2FA via phone all the time, I am overseas a lot and it can pose serious problems for account access. I found out today that Authy even has a Linux client - hopefully this is the beginning of my life getting a lot easier.

michaeljx 3y ago

Most of the world does SMS 2fa without an issue. It is only a problem in the US where anyone can pretend to be anyone else, take over their identity, SSN, mobile number, take a loan in their name etc etc.

redox99 3y ago
SIM swapping is a problem in most countries.
- reboot81 3y ago
  And the ones who don’t experience this issue at all, perhaps US could study why that is?
  - Dylan16807 3y ago
    > And the ones who don’t experience this issue at all, perhaps US could study why that is? You'll have to name a few first. I know the comment you replied to said "most", but that's not a declaration that any countries have actually solved the issue. It's more that some countries are just too small/isolated to see certain crimes, so it's easier to say "most" than "all".
saurik 3y ago
The problem isn't "2fa": the problem is services that just use it as your identity. You'll go to sign in to the account and it merely asks for your phone number, to which it sends a login link. Or--even more unacceptable as it makes you THINK the password matters--you'll say you "forgot your password" and it sends a code to your phone number and that code is all that was required to get back into the account. This isn't a second factor: this is replacing your first factor (your password); maybe you could call it an "alternative factor"?
- shortcake27 3y ago
  It’s impressive how some of the most successful tech companies in the world get this wrong. If you give your phone number to Google, they will pressure you to enable SMS MFA and SMS account recovery. So your phone number becomes the weakest link into your account, which is pretty bad considering the state of sim swapping. Google and other companies should make this clear to users. You should never have both SMS MFA and SMS account recovery enabled. If you must, only ever enable one. Ideally, neither.

shortcake27 3y ago

There is a specific issue with SMS that I hate more than any of the issues you mentioned - the state of roaming. Because every company on the planet forces me to provide my phone number to auth me with SMS, I now need to pay for roaming to use this god-awful method of authentication I never signed up for. On top of the local sim card I still need to buy, because roaming is often throttled to unusable speeds. But it gets better. If I break my phone, I can currently move my physical sim into a new device in a matter of seconds. No problem. But with Apple removing the physical sim, soon I’m going to be forced to switch to eSIM. eSIM is marketed as more practical, yet in reality it is anything but. I’ve been following forums for many telcos in the UK and Australia to understand the problems people face with eSIM. First of all, if it is even possible to provision a new eSIM, most telcos lock this behind SMS 2FA. So if you break your phone, you can’t log in to provision a new eSIM. Also, usually this needs to done using an app, which is often only available in the telco’s region. So if you live between countries, you’re again out of luck. Some telcos require you to visit a physical store to move an eSIM to a new device. Some telcos won’t provision a new eSIM electronically, requiring you to use a physical cardboard QR kit. And some telcos can only activate a new eSIM when the device is connected directly to their network, so even if you somehow managed to jump through all these hoops, you still wouldn’t be able to activate a new eSIM abroad. So if you break your phone overseas, you either need to live without banking and a range of other services, or book an immediate flight back to your home country just to provision a new eSIM. Calling this madness is an understatement. Any company forcing MFA must allow users to pick from a range of open standards.

thaumasiotes 3y ago
> So if you break your phone overseas, you either need to live without banking and a range of other services, or book an immediate flight back to your home country just to provision a new eSIM. I have these services connected to a Google Voice number.
- idontwantthis 3y ago
  Not every service will let you use VoIP. Capital One for example.