9 ms·

I've said it before, and I'll say it again: federal law should at least mandate that SMS 2FA cannot be a required option. With services like Paypal allowing you

I've said it before, and I'll say it again: federal law should at least mandate that SMS 2FA cannot be a required option. With services like Paypal allowing you to reset your entire account authentication just by receiving an SMS message, I expect disastrous results. Alternately, we could just ban SMS 2FA outright. It may be an unpopular opinion, but I'm sticking to my guns on this one. https://lorendb.dev/posts/lets-ban-sms-2fa/ https://lorendb.dev/posts/lets-ban-sms-2fa/

hn_throwaway_99 3y ago
I read your blog post. The primary issue is that it doesn't fairly acknowledge problems with SMS 2FA alternatives: 1. First off, SMS 2FA is certainly better that _no_ 2FA. The primary breach vector is credential stuffing, and SMS 2FA is much better than just using a password in that scenario. Importantly, I'm referring to cases where 2FA is the second factor - cases where you can reset everything with just a passcode (usually forgot password scenarios) isn't really 2FA. 2. Thus, the primary alternatives are TOTP and Passkeys. If your service needs to support a wide variety of technically savvy (or not) users, and ages, I would say these are not really viable, at least not yet. I've seen many, many people struggle with setting up TOTP and using passkeys/hardware keys. My opinion is that SMS 2FA is much better than nothing, as long as it's an actual second factor.
- LorenDB 3y ago
  Thanks for the feedback! I agree that I don't do a perfect job of fairly representing the issue; I may rewrite that post to more clearly communicate that SMS is better than nothing at all.
  - hughesjj 3y ago
    Please do. You just know someone not "in the know" will get shown this and come to the wrong decision without that disclaimer. I'm not religious per say but I do believe in Murphy. Heck, update with this use case as an example and (re?)post the blog to HN/etc
- bluesign 3y ago
  I think problem with 'SMS 2FA is much better than nothing, as long as it's an actual second factor.' statement is: even though it is totally correct, at least passes some responsibility to 3rd party. ( phone operators etc ) So it becomes easy choice for companies, this leads to non-savvy to stay non-savvy.
- basch 3y ago
  The problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sms to login or sms to reset password, it should disable 2fa until you agree to the new system. sms backdoor should be a completely separate setting than 2fa, but companies dont treat it that way. the sms/magiclink to login has won. the answer to stuffing is to mandate services cross reference their account lists against open leaked lists. thats best practice, and not enough sites are banning known passwords. sms backdoor is WORSE than "nothing" when nothing equals a unique non reused key.
gregmac 3y ago
> A bit more on the account recovery: given a valid email address, PayPal will happily send you a text to verify a password reset, and Amazon lets you reset your password with just a phone number. This means that as long as you know that somebody has an Amazon account that may be linked to their phone number, a simple SIM swapping attack or even snooping on local text messages can easily give you full access to somebody’s Amazon account. The trouble is not SMS being used for 2FA, but rather that using it as the password reset mechanism effectively means it's now the single authentication factor. This is really bad because SMS (due to SIM swapping) is significantly worse than regular passwords. When SMS is actually a second factor it's still actually an improvement over no 2FA for most users, because now in addition to just stealing your password the attacker has to SIM swap you or find some other means to get the 2FA code. Your proposed fixes (TOTP, Passkeys) are arguably no better if they are also used as single factor password resets. I think the problem is really for password recovery you need N+1 authentication mechanisms -- in other words for 2FA login, you need a 3rd password recovery mechanism so you can still do a 2FA password recovery in case one of the first two factors is unusable. Few sites do this right.

hn_throwaway_99 3y ago

I read your blog post. The primary issue is that it doesn't fairly acknowledge problems with SMS 2FA alternatives: 1. First off, SMS 2FA is certainly better that _no_ 2FA. The primary breach vector is credential stuffing, and SMS 2FA is much better than just using a password in that scenario. Importantly, I'm referring to cases where 2FA is the second factor - cases where you can reset everything with just a passcode (usually forgot password scenarios) isn't really 2FA. 2. Thus, the primary alternatives are TOTP and Passkeys. If your service needs to support a wide variety of technically savvy (or not) users, and ages, I would say these are not really viable, at least not yet. I've seen many, many people struggle with setting up TOTP and using passkeys/hardware keys. My opinion is that SMS 2FA is much better than nothing, as long as it's an actual second factor.

LorenDB 3y ago
Thanks for the feedback! I agree that I don't do a perfect job of fairly representing the issue; I may rewrite that post to more clearly communicate that SMS is better than nothing at all.
- hughesjj 3y ago
  Please do. You just know someone not "in the know" will get shown this and come to the wrong decision without that disclaimer. I'm not religious per say but I do believe in Murphy. Heck, update with this use case as an example and (re?)post the blog to HN/etc
bluesign 3y ago
I think problem with 'SMS 2FA is much better than nothing, as long as it's an actual second factor.' statement is: even though it is totally correct, at least passes some responsibility to 3rd party. ( phone operators etc ) So it becomes easy choice for companies, this leads to non-savvy to stay non-savvy.
basch 3y ago
The problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sms to login or sms to reset password, it should disable 2fa until you agree to the new system. sms backdoor should be a completely separate setting than 2fa, but companies dont treat it that way. the sms/magiclink to login has won. the answer to stuffing is to mandate services cross reference their account lists against open leaked lists. thats best practice, and not enough sites are banning known passwords. sms backdoor is WORSE than "nothing" when nothing equals a unique non reused key.

gregmac 3y ago

> A bit more on the account recovery: given a valid email address, PayPal will happily send you a text to verify a password reset, and Amazon lets you reset your password with just a phone number. This means that as long as you know that somebody has an Amazon account that may be linked to their phone number, a simple SIM swapping attack or even snooping on local text messages can easily give you full access to somebody’s Amazon account. The trouble is not SMS being used for 2FA, but rather that using it as the password reset mechanism effectively means it's now the single authentication factor. This is really bad because SMS (due to SIM swapping) is significantly worse than regular passwords. When SMS is actually a second factor it's still actually an improvement over no 2FA for most users, because now in addition to just stealing your password the attacker has to SIM swap you or find some other means to get the 2FA code. Your proposed fixes (TOTP, Passkeys) are arguably no better if they are also used as single factor password resets. I think the problem is really for password recovery you need N+1 authentication mechanisms -- in other words for 2FA login, you need a 3rd password recovery mechanism so you can still do a 2FA password recovery in case one of the first two factors is unusable. Few sites do this right.