3 ms·
I read your blog post. The primary issue is that it doesn't fairly acknowledge problems with SMS 2FA alternatives: 1. First off, SMS 2FA is certainly better th
by hn_throwaway_99 3y ago
I read your blog post. The primary issue is that it doesn't fairly acknowledge problems with SMS 2FA alternatives:
1. First off, SMS 2FA is certainly better that _no_ 2FA. The primary breach vector is credential stuffing, and SMS 2FA is much better than just using a password in that scenario. Importantly, I'm referring to cases where 2FA is the second factor - cases where you can reset everything with just a passcode (usually forgot password scenarios) isn't really 2FA.
2. Thus, the primary alternatives are TOTP and Passkeys. If your service needs to support a wide variety of technically savvy (or not) users, and ages, I would say these are not really viable, at least not yet. I've seen many, many people struggle with setting up TOTP and using passkeys/hardware keys.
My opinion is that SMS 2FA is much better than nothing, as long as it's an actual second factor.
- LorenDB 3y agoThanks for the feedback! I agree that I don't do a perfect job of fairly representing the issue; I may rewrite that post to more clearly communicate that SMS is better than nothing at all.
- hughesjj 3y agoPlease do. You just know someone not "in the know" will get shown this and come to the wrong decision without that disclaimer. I'm not religious per say but I do believe in Murphy. Heck, update with this use case as an example and (re?)post the blog to HN/etc
- bluesign 3y agoI think problem with 'SMS 2FA is much better than nothing, as long as it's an actual second factor.' statement is: even though it is totally correct, at least passes some responsibility to 3rd party. ( phone operators etc ) So it becomes easy choice for companies, this leads to non-savvy to stay non-savvy.
- basch 3y agoThe problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sms to login or sms to reset password, it should disable 2fa until you agree to the new system. sms backdoor should be a completely separate setting than 2fa, but companies dont treat it that way. the sms/magiclink to login has won. the answer to stuffing is to mandate services cross reference their account lists against open leaked lists. thats best practice, and not enough sites are banning known passwords. sms backdoor is WORSE than "nothing" when nothing equals a unique non reused key.