4 ms·

So the case against SMS 2FA boils down to “There are two factors, but the second factor is something a determined actor can get around by SIM swapping.” But t

So the case against SMS 2FA boils down to “There are two factors, but the second factor is something a determined actor can get around by SIM swapping.” But there are still two factors and SMS 2FA handles disaster recovery much better than the listed alternatives for most people. This argument strikes me as kind of like - “a determined actor can get around a deadbolt pretty easily, so the standard for homes should be a vault door and fines if you leave a hide-a-key rock anywhere near your house.”

LorenDB 3y ago
Author here - yes, I agree that SMS 2FA is much better than nothing, but let's be honest, implementing and using actually secure 2FA is a lot easier than installing a vault door on your home. When the barrier to adoption and inconvenience to the user is so low, there's no reason to not adopt better 2FA methods.
- deleted 3y ago
  [deleted]
- pcloadletter_ 3y ago
  >When the barrier to adoption and inconvenience to the user is so low Is it low though? I'm not sure my parents could figure out how to use an authenticator app.
  - dtx1 3y ago
    Then your Patents should not be near any account that should reasonably require 2FA. They are perfect prey for scammers.
    - deleted 3y ago
      [deleted]
  - c22 3y ago
    I've noticed that for sites I visit rarely there will be some sort of drift from the auth app and I'm often forced to use a backup code. I'd rather just have a whole list of allowable factors and the opportunity to configure one or more of them depending on my personal risk tolerance.
  - ants_everywhere 3y ago
    Really though? I get maybe being confused the first time they used it, but you really think they couldn't figure it out? An authenticator app just has the codes and the sites. SMS has the codes, all the previous codes, all of your other SMSs. Plus the messages come from a 5 digit phone number that has a similar format to the 6-digit code you're supposed to enter. The whole system is byzantine IMO and the authenticator app has a much simpler flow. But, you know, I recognize that not everyone may experience it the same way. I'm generally curious if people think there's a simplicity to the SMS approach other than just familiarity with something that's awkward. The real problem IMO is not that it's hard to use an authenticator app, it's that the authenticator app provides an actual secret. There's less of a backdoor, so customers can lock themselves out. The downside of the backdoor is it's a security risk. The upside is that managing private keys is a nightmare and nobody wants to force their customers to actually manage private keys.
- seliopou 3y ago
  Tell that to my retirement-age mother.
- mxchris2121 3y ago
  One of my coworkers (at a social services agency) was the victim of a sim swap. If it can happen to her it can happen to anyone. They gained access to her bank accounts, all her email, as well as PayPal and Venmo. She ended up switching phone providers.
  - jimberlage 3y ago
    Yes, and sometimes even locked houses are broken into.
- jimberlage 3y ago
  Out of curiosity - do you think that difficulty of installation is what keeps people from installing a vault door on their home? I imagine even if it were easier, you would see low adoption, because “I’ve never been robbed but I have locked myself out, does this mean I can’t call a locksmith anymore?” Would be top of people’s minds.
- panarky 3y ago
  > much better than nothing If you wouldn't advocate banning deadbolt locks just because vault doors are better, why advocate banning SMS 2FA?
  - nullc 3y ago
    One reason to ban 2FA SMS is because end users take on most of the cost of a compromise, but they are generally pretty poweless to prevent others from creating the vulnerability, particularly where the party requiring the SMS 2fa is a government or government contractor. I don't know that I'd go so far as saying that a ban is the right thing, but something is needed.
basch 3y ago
SMS disaster recovery becomes 1FA. If im giving my phone number and a second factor to verify me, I don’t want it repurposed as a single factor backdoor. Too often companies dont advertise that it’s a backdoor into the account, or the feature gets added after they collect the info.
nullc 3y ago
> But there are still two factors usually not. The problem with SMS 2fa is that once a company can do it is almost always easy to social engineer them into resetting the password based on only being able to pass the SMS 2fa... which is a big problem because SMS 2fa has no security against a moderately committed attacker. The only way you can protect yourself is to refuse to give online services a phone number.

LorenDB 3y ago

Author here - yes, I agree that SMS 2FA is much better than nothing, but let's be honest, implementing and using actually secure 2FA is a lot easier than installing a vault door on your home. When the barrier to adoption and inconvenience to the user is so low, there's no reason to not adopt better 2FA methods.

deleted 3y ago
[deleted]
pcloadletter_ 3y ago
>When the barrier to adoption and inconvenience to the user is so low Is it low though? I'm not sure my parents could figure out how to use an authenticator app.
- dtx1 3y ago
  Then your Patents should not be near any account that should reasonably require 2FA. They are perfect prey for scammers.
  - deleted 3y ago
    [deleted]
- c22 3y ago
  I've noticed that for sites I visit rarely there will be some sort of drift from the auth app and I'm often forced to use a backup code. I'd rather just have a whole list of allowable factors and the opportunity to configure one or more of them depending on my personal risk tolerance.
- ants_everywhere 3y ago
  Really though? I get maybe being confused the first time they used it, but you really think they couldn't figure it out? An authenticator app just has the codes and the sites. SMS has the codes, all the previous codes, all of your other SMSs. Plus the messages come from a 5 digit phone number that has a similar format to the 6-digit code you're supposed to enter. The whole system is byzantine IMO and the authenticator app has a much simpler flow. But, you know, I recognize that not everyone may experience it the same way. I'm generally curious if people think there's a simplicity to the SMS approach other than just familiarity with something that's awkward. The real problem IMO is not that it's hard to use an authenticator app, it's that the authenticator app provides an actual secret. There's less of a backdoor, so customers can lock themselves out. The downside of the backdoor is it's a security risk. The upside is that managing private keys is a nightmare and nobody wants to force their customers to actually manage private keys.
seliopou 3y ago
Tell that to my retirement-age mother.
mxchris2121 3y ago
One of my coworkers (at a social services agency) was the victim of a sim swap. If it can happen to her it can happen to anyone. They gained access to her bank accounts, all her email, as well as PayPal and Venmo. She ended up switching phone providers.
- jimberlage 3y ago
  Yes, and sometimes even locked houses are broken into.
jimberlage 3y ago
Out of curiosity - do you think that difficulty of installation is what keeps people from installing a vault door on their home? I imagine even if it were easier, you would see low adoption, because “I’ve never been robbed but I have locked myself out, does this mean I can’t call a locksmith anymore?” Would be top of people’s minds.
panarky 3y ago
> much better than nothing If you wouldn't advocate banning deadbolt locks just because vault doors are better, why advocate banning SMS 2FA?
- nullc 3y ago
  One reason to ban 2FA SMS is because end users take on most of the cost of a compromise, but they are generally pretty poweless to prevent others from creating the vulnerability, particularly where the party requiring the SMS 2fa is a government or government contractor. I don't know that I'd go so far as saying that a ban is the right thing, but something is needed.

basch 3y ago

SMS disaster recovery becomes 1FA. If im giving my phone number and a second factor to verify me, I don’t want it repurposed as a single factor backdoor. Too often companies dont advertise that it’s a backdoor into the account, or the feature gets added after they collect the info.

nullc 3y ago

> But there are still two factors usually not. The problem with SMS 2fa is that once a company can do it is almost always easy to social engineer them into resetting the password based on only being able to pass the SMS 2fa... which is a big problem because SMS 2fa has no security against a moderately committed attacker. The only way you can protect yourself is to refuse to give online services a phone number.