5 ms·
Counterpoint: SMS login and account recovery is good UX, and it's the telcos that need to step up their collective game.
by Retr0id 3y ago
Counterpoint: SMS login and account recovery is good UX, and it's the telcos that need to step up their collective game.
- neallindsay 3y agoYou know that they won't though, so why even make this argument?
- Retr0id 3y agoBy that logic, consumers and tech companies won't change either and we can bypass this whole discussion. I live in a part of the world where, on occasion, governments decide to regulate such things.
- spenvo 3y agoFrom the article: > For many years, people in the industry have invariably said something like: "Well... offering SMS-based authentication is better overall for customer security, because of its convenience (despite its shortcomings) vs other methods" (such as the far-more secure use of email for verification). To that I say: "who are YOU to deprive your customers of security?" and > Much of the ire relating to SIM-swap attacks has, understandably, been directed at carriers. Indeed, carriers do a terrible job of securing customers’ phone numbers, and may be liable for that shortcoming. But here’s the thing: carriers’ security has always been bad, it has even been legislated into being bad, and other companies have still chosen to build mission-critical systems on top of that weak link. and > Despite offering poor security, SMS offers a nearly frictionless way to sign up new customers (think of Uber's onboarding) and handle password resets, and companies felt they had to match competitors' adoption of this technique. This last bit was unfortunately overwritten in a Wordpress post update, and I added it back.
- j16sdiz 3y ago> such as the far-more secure use of email for verification Hmm.. sure? They have different threat profile. Don't think it is more secure.
- spenvo 3y agoThere is a straightforward manner to overtake your phone number (call your carrier and use social engineering). There is nothing you, the customer, can do to lock that down. (I've tried with my carrier.) With email, you can lock that down with robust 2FA (Google Authenticator/Authy/etc) and crooks have no straightforward way of defeating that. This is how it plays out year after year and why SIM-swap gangs are so prevalent.
- j45 3y agoTelcos are not responsible for using fingerprint or facial recognition as joint user+password. When it comes to good UX it’s important to clarify whose goals it’s best for: compromise security for convenience and adoption of an app? Or setting up the user to succeed more. SMS is a lazy form of 2Fa. it reminds one of the descriptions of sms being an open postcard. Theatre and pageantry have limited value where it sets users up for much worse
- pdntspa 3y agoNo, it's not, and it's fucking annoying to deal with. I am on my desktop computer, stop sending me to my phone just to log in because you don't want to support FIDO or some other form of real 2FA. There's a fingerprint reader on my laptop, face id on my phone, and a yubikey in my USB. Fucking use it
- 2OEH8eoCRo0 3y ago> There's a fingerprint reader on my laptop, face id on my phone, and a yubikey in my USB. Great! Not everyone has that! I do but if I could only implement one type of 2FA I'd probably still pick SMS.
- chrispeel 3y agoEveryone can get an app on their phone or computer that supports TOTP, such as Google Authenticator https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password
- gruez 3y agoWhat happens when they smash their phone and now you have to do account recovery? With SMS authentication you can presumably offload that to the carrier.
- supertrope 3y agoThe problem is customer support load. Also what does the company do about those without a smartphone? No smartphone no service? This is why businesses peg account authentication to phone numbers. It offloads IAM overhead to phone companies.
- pdntspa 3y agoWho cares. Spend the money on customer service people then. Companies don't need all the profits they make and investors dont need their 10000x returns when 9900x will do just fine.
- batch12 3y agoFrom the examples I've seen, the attackers essentially become the customer. They've either socially engineered the customer or done research to gain access to enough information to validate themselves as the customer. Come up with a solution and sell it. You'll make some money.
- batch12 3y agoWell that got me thinking. You could stand up a third party verification service and sell the offering to companies that don't want to be bothered with authenticating the user. Something like Okta (I know, bad example when talking infosec at the moment) for real life.
- wahnfrieden 3y agoThey won't pay for it
- batch12 3y agoWith the right legal language, I think they would.
- batch12 3y agoI just realized this does exist (kinda) in the US with identogo. Could be an easy service offering for them or a partner for another company focused on the mfa issue.
- dcow 3y agoThere are numerous ID-proofing services out there.
- lxgr 3y agoSomebody already pays for it. Once regulations ensure that it's the companies skimping on KYC themselves, most will happily outsource that task to the cheapest (compliant) provider.
- 3y ago
- johnneville 3y agowhile it works well a majority of the time, it results in an exceptionally bad UX if you lose your phone, don't have reception, or are traveling outside of your service area
- justin_oaks 3y agoI once worked in a building with terrible cell reception. I hated anything that required SMS for 2FA because I'd have to go outside to get the text message. My in-laws lived in an area with poor cell reception too. Whenever I'd go there, I couldn't use SMS either. Both of those places had good Internet service. Any time SMS was required, my UX was terrible. Hooray for anyone who supported TOTP, email, or any other form of 2FA.
- mooreds 3y agoI wrote a comment 11 days ago talking about SMS for a second factor, but it applies in general as well: https://news.ycombinator.com/item?id=39130032 https://news.ycombinator.com/item?id=39130032 Email is better, for sure, but mostly because email providers are either controlled by the user (for us nerds with a custom domain) or a large, impersonal entity (google or similar). Neither is available to change by attackers in the same way as phone number providers are. I work for an identity provider and we have a number of folks who want us to support this, almost always from a UX perspective. I think that there also needs to be some onus on the phone providers, as suggested above. With the continued push to have the phone number as a global identifier (offline and online), we need our telco providers to require more to change phone numbers.
- lxgr 3y ago> With the continued push to have the phone number as a global identifier (offline and online), we need our telco providers to require more to change phone numbers. No, we need to push back on this user-hostile trend, not stick on yet more band-aids. Phone numbers are country-specific, impossible to own in any meaningful way for private individuals (unlike e.g. domain names), and add an unnecessary point of failure.
- kelseyfrog 3y agoCounter-counterpoint, when companies implement a system with a known flaw, then they're responsible for the consequences of creating that system.
- batch12 3y agoOTP can be social engineered, hardware keys can be stolen, who determines what constitutes a flaw? Edit: also, do both pay in this case? The telcom and the service?
- tamimio 3y agoThat’s a problem with the user, not the protocol or the system, users have been and will be always the weakest point, but they are accountable for it if it happens, not the case for sim swap attacks.
- batch12 3y agoYes, true. However- to paraphrase a red team operations book I read, if the user can be tricked into into compromising your security with a click, then you can't blame the user. An organization's defensive security strategy should not hinge on a single user's decision to click or not. Edit: I am swapping users with you, sorry for the confusing reply. I'm thinking telcom employee, you user of the app that got swapped (I think, apologies if I am wrong)
- tamimio 3y agoHa! I was going to say if you solve the user vulnerability then congratulations, all systems are mostly safe! Before reading that you meant telecom employees. The reality is TOTP despite any issues, is far more secure and available than SMS, security for obvious reasons but also availability, you can have your TOTP token accessible everywhere (say in your password manager) but if you can’t receive an SMS because you lost your phone or maybe traveling, then you are in a tough position, maybe even locked out completely. I personally even back up the TOTP tokens so I can reuse them without being tied to specific platform/app (I am looking at you Authy!)
- crmd 3y agoIf having your account hijacked is is a good user experience then I have no idea what UX means.
- johnea 3y agoI completely disagree. Using a corporate account for personal identification is a major failure of public infrastructure. The US government should step up it's game. An individual's identity financial transactions should NOT be determined by holding an account at one of 4 mega-corporations. We should work towards something in this direction: https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/
- zeven7 3y agoGetting the government involved in this is the only worse idea than delegating to 4 major corporations. It should be delegated more broadly and users should have more options not less.
- johnea 3y agoIt's obvious that government is already involved with everyone's identification. This is analogous to the argument that government shouldn't be involved in "the free market", when the market is actually defined by the laws that regulate it. Let's just call this the "Texas Delusion"... Governments can be changed by democratic processes, corporate decision making is completely inaccessible to the public. Do people really think life would be better if goggle just ran everything?
- paiute 3y agoI’m so happy other people think this too!!! No one trusts the government, but usps is still offers pretty good privacy. I want mandatory acceptance of a gov issued ID, but at the same time i want to be able to use things anonymously.
- lrvick 3y agoNot everyone has (or wants) a phone or to grant control of their life to a cell phone carrier
- dkjaudyeqooe 3y agoYes having an SMS sent to a number you no longer own is great UX.
- Pufferbo 3y agoIf you don’t have your phone; if you’re abroad and don’t have SNS; if you’re in a building with no service; if you changed your phone number, they all suck. Also, another valid point is that often times it’s hard to tell what’s a legitimate SNS message and what’s phishing. Their phone numbers are always gibberish and sometimes change between requests.
- lxgr 3y agoIf you never move internationally, travel abroad, are outside cell coverage, and don't value security too highly, it sure is.
- __MatrixMan__ 3y agoAny auth mechanism that requires a trusted third party is hardly an auth mechanism at all.
- romwell 3y ago>Counterpoint: SMS login and account recovery is good UX, and it's the telcos that need to step up their collective game. Oh, yeah, fantastic UX. I've had my phone and credit cards stolen while traveling abroad (such a hard-to-imagine scenario, innit?), and was consequently locked out of all important services. Very good UX: being left without a phone and access to bank account and email and most messengers at the same time (thankfully, Skype isn't one of them). Double props to CitiBank for requiring SMS authentication to change the phone number on the account.