4 ms·

Well ... let's be honest: SMS 2FA shouldn't be a thing. TOTP or stronger, please.

• SpaethCo 3y ago
  TOTP or SMS, it's just another text password you're entering in that's fully phishable. TOTP just "feels" more secure.
  • ezfe 3y ago
    SMS 2FA is a code that you're entering from a phone number. The "risk" is that your phone number can be ported without your permission, and then someone else can get the code. TOTP is more secure because it isn't tied to a phone number. You're right that it's still phishable but that's not the point. In both cases, the primary benefit to the general population is to have a rotating credential that, if one website is hacked, is useless on another website.
  • throwway120385 3y ago
    TOTP is more secure in that you can't be simjacked by someone impersonating you in the cell phone store.
    • SpaethCo 3y ago
      That's assuming your attacker already has your password, or the service allows SMS password reset. (thus negating the second factor. Essentially SMS becomes the only factor.)
  • jjav 3y ago
    No, TOTP is far more secure because it has no dependence on a third-party who can mess up in many ways (Denial of service like in this case by being unavailable, Impersonation by allowing SIM swaps or intercepting messages directly). You fully control how to store the TOTP seed and how you compute the value, so it is far more secure. Yes, it can be phished if you fall for that, but it removes several attack vectors.
    • Scoundreller 3y ago
      > You fully control how to store the TOTP seed Sorta. The seed still needs to be issued to you in some way.
    • SpaethCo 3y ago
      > Yes, it can be phished if you fall for that, but it removes several attack vectors. How was the first factor (the password) compromised? Assuming the user is using site-unique passwords, in 99% of cases where an attacker obtains a functional password they can get at least one TOTP code or the seed in the same manner. (ie, if I can steal your password DB, odds are pretty good for me stealing your TOTP seed DB as well.) The outcome of a single successful authentication is a longer-lived session cookie. Once an attacker has that they can reset your creds (usually just requiring re-entering the password) and the account is theirs. IMO, the only 2nd factor that matters are those that mutually authenticate like PassKeys / FIDO keys.
• Johnny555 3y ago
  Isn't that what passkeys are suppose to be? Better and stronger than passwords with TOTP?
• steelframe 3y ago
  > TOTP or stronger, please One of the biggest weaknesses with TOTP apps I've tried using is that you have to remember to transfer them to a new phone before you get rid of your old phone. I once got locked out of a domain registrar because I set up TOTP on an old phone many years back. That was long gone by the time I wanted to do something with my domain. TOTP is fine, but always give me recovery codes I can print and out and keep with my other important documents. Too many services don't do that.
• zackkitzmiller 3y ago
  SMS 2FA and TOTP aren't mutually exclusive are they? TOTP -> Time-based One Time Password SMS -> Delivery mechanism. You can deliver TOTP over SMS. Obviously, SMS shouldn't be used, but I was under the impression that the code generation mechanism and the code generation algorithms are completely disparate concepts.
  • BenjiWiebe 3y ago
    Not sure I'm understanding you, but TOTP isn't delivered. It's generated locally/offline, based on the time and a private key that was set up when you first turned on TOTP 2FA.