4 ms·

You really should not be using SMS for 2FA.

by ThePowerOfFuet 3y ago

iaresee 3y ago
You really aren't following along closely enough: all other options were failing for me.
- speedgoose 3y ago
  But you have setup SMS 2FA enabled, which is convenient this time but a big security hole. You should consider disabling it once the situation comes back to normal.
  - iaresee 3y ago
    > But you have setup SMS 2FA enabled No. I did not. Nor do I now. I had a TOTP setup in 1Password and Mongo was telling me MFA _wasn't_ set up and sending me through the MFA setup flow again. All options, SMS included, were failing in that MFA setup flow they pushed me in to. They're back now and my existing TOTP token is generating one time use passwords that work now.
    - rezonant 3y ago
      I bet that's because different parts of their stack disagreed. Obviously a two factor setup should not be acceptable when one is already in place-- if the frontend thought it wasn't but the backend/auth services thought it was, it could explain that.
salil999 3y ago
For my own knowledge, if the options were between using SMS for 2FA or not having 2FA at all then what is better? I've heard mixed things about this.
- mtremsal 3y ago
  SMS 2FA is better than no MFA at all, despite the very valid concerns about SMS. It at least protects against credential stuffing and similar automated attacks.
  - wyldfire 3y ago
    I guess I've always cynically assumed that companies want my phone number to make the data they gather more valuable by making it easier to link with a unique index like a phone number.
    - rezonant 3y ago
      Two things can be true at the same time.
- rezonant 3y ago
  Well a simswap attack requires the account password, since otherwise you would not be able to receive an SMS message for the two factor part. But without two factor, only your account credentials are needed. So yeah, it's definitely better than nothing, you are effectively forcing your opponent to social engineer your carrier, and doing that generally requires knowing the full number and usually at least your name, if not more identifying information that's harder to get, like social security number or equivalent. Sure, TOTP or other two factor mechanisms are better because they require access to one of your authenticated devices (assuming the TOTP isn't done by a secure enclave), but SMS two factor is definitely better than disabling two factor.

You really should not be using SMS for 2FA.

iaresee 3y ago

You really aren't following along closely enough: all other options were failing for me.

speedgoose 3y ago
But you have setup SMS 2FA enabled, which is convenient this time but a big security hole. You should consider disabling it once the situation comes back to normal.
- iaresee 3y ago
  > But you have setup SMS 2FA enabled No. I did not. Nor do I now. I had a TOTP setup in 1Password and Mongo was telling me MFA _wasn't_ set up and sending me through the MFA setup flow again. All options, SMS included, were failing in that MFA setup flow they pushed me in to. They're back now and my existing TOTP token is generating one time use passwords that work now.
  - rezonant 3y ago
    I bet that's because different parts of their stack disagreed. Obviously a two factor setup should not be acceptable when one is already in place-- if the frontend thought it wasn't but the backend/auth services thought it was, it could explain that.

salil999 3y ago

For my own knowledge, if the options were between using SMS for 2FA or not having 2FA at all then what is better? I've heard mixed things about this.

mtremsal 3y ago
SMS 2FA is better than no MFA at all, despite the very valid concerns about SMS. It at least protects against credential stuffing and similar automated attacks.
- wyldfire 3y ago
  I guess I've always cynically assumed that companies want my phone number to make the data they gather more valuable by making it easier to link with a unique index like a phone number.
  - rezonant 3y ago
    Two things can be true at the same time.
rezonant 3y ago
Well a simswap attack requires the account password, since otherwise you would not be able to receive an SMS message for the two factor part. But without two factor, only your account credentials are needed. So yeah, it's definitely better than nothing, you are effectively forcing your opponent to social engineer your carrier, and doing that generally requires knowing the full number and usually at least your name, if not more identifying information that's harder to get, like social security number or equivalent. Sure, TOTP or other two factor mechanisms are better because they require access to one of your authenticated devices (assuming the TOTP isn't done by a secure enclave), but SMS two factor is definitely better than disabling two factor.