6 ms·
It's time to stop using SMS (2021)
- dang 3y agoDiscussed at the time: It’s time to stop using SMS for security - https://news.ycombinator.com/item?id=26469738 https://news.ycombinator.com/item?id=26469738 - March 2021 (147 comments)
- DustinBrett 3y agoFeels like SMS 2FA logins have become the new norm for some reason.
- 70rd 3y agoAnyone tracking signup conversion will realize that phone numbers are autofilled whereas 2FA requires an installation for a greater number of users, leading to drop-off.
- mewpmewp2 3y ago2FA apps also require me to do many more actions as opposed to SMS as notification. Would be much better if there was some sort of nudge mechanism for phone to display the proper code.
- Loughla 3y agoMicrosoft does this. eBay also. And steam. Once you install the app, any time there is a sign in, you get a pop up on your phone. Yes/no button. Very convenient. Why don't more apps do that?
- rolobio 3y agoI disabled my eBay app login pop up because it would never come. My login would sit pending forever. Would much prefer TOTP, even if a little slower.
- fiddlerwoaroof 3y agoBecause, over the last five or ten years, MFA has been adopted as a best practice and it’s easier to check the box with SMS than to get all your users to install a TOTP app. (another example of “Best Practices” being actively harmful: people should use passkeys now)
- semiquaver 3y agoIn the past two years or so I’ve seen the floodgates open for un-opted-in email-based 2FA, usually tied with “known device” recognition. This is obviously more secure than SMS but I just wish it weren’t less convenient, especially on mobile (specifically talking about the iOS 2FA iMessage input method integration) By contrast I feel like SMS 2FA increasingly is not an option, or at least not the default. Almost no sites I interact with outside of big tech offer TOTP or FIDO2, which is a real shame.
- njovin 3y agoI don't see how email-based 2FA is more secure than SMS. With email, if an attacker gains access to my email account she can remotely de-auth my mobile device's email client, reset my password for service X, and sign in to service X without my knowledge (assuming I don't notice my email client has stopped working). With SMS, if they gain access to my email account, I at least get the notice of the attempted login via SMS and can take appropriate action.
- semiquaver 3y agoSMS is architecturally insecure. It’s been demonstrated time and time again that cellular providers cannot effectively prevent SIM-hijacking via social engineering and other means. Email isn’t perfect, but I believe that my account is much more resistant to takeover than my phone number is.
- robertoandred 3y agomacOS/iOS support autofilling 2FA codes received via email in addition to those received via Messages.
- semiquaver 3y agoYeah, but only if you use Mail.app. AFAIK there’s no api for third party apps like gmail to do so.
- 3y ago
- deleted 3y ago[deleted]
- cobbal 3y agoIt's also time to stop using medium for anything. I wonder if the author really opted to unpublish this piece from the internet, or if they just got defaulted in when medium "released a new feature"
- liquidgecka 3y agoI just migrated my blog and popular posts from medium. I noticed a ton of issues as well. What's interesting is that a metric ton of traffic to domain is directed at articles unrelated to me. Somehow medium was serving a ton of content on my domain which is a huge issue for me.
- proneb1rd 3y agoI concur. I can’t even read the whole article without a huge banner forcing me to sign up.
- 1vuio0pswjnm7 3y agohttps://cc.bingj.com/cache.aspx?d=4850435797098829&w=iktuFvtbW-KduVaF4w3easUC-G9UgG4a https://cc.bingj.com/cache.aspx?d=4850435797098829&w=iktuFvt...
- kerkeslager 3y agoDisagree. SMS is not perfect for security. But SMS is better security than no 2FA at all, and for many (most?) situations, more-secure alternatives aren't viable. The deprecation of Authy or loss of keys has left me permanently locked out of a few accounts. YubiKey and similar aren't ubiquitous enough or usable enough for many users. I've experienced these problems personally and I'm likely in the most technical 1% of users you're likely to encounter. SMS is ubiquitous and users understand it, and is secure enough for many situations. If you're running a service that requires a high level of security, fine, force users to use TOTP/HOTP or something, but be aware you're going to be excluding some users and adding to your support costs by doing that.
- deleted 3y ago[deleted]
- rolobio 3y agoI disagree that SMS two factor is more secure than a password alone. I have found that once you enter your phone, it is more trusted than your password (meaning it alone can reset your password). A phone number is as secure as the least competent support person at your phone provider. A password, with email reset is better. My email has two factors of authentication, rather than whatever my phone provider requires as proof.
- kerkeslager 3y ago> I have found that once you enter your phone, it is more trusted than your password (meaning it alone can reset your password). Sure, but my answer to that is simply, don't trust users' SMS more than their password. You should require two factors of authentication to change settings on any authentication factor (i.e. SMS and email to change password, password and email to change SMS). Notably, email is arguably less secure than SMS.
- saurik 3y agoWhat you describe isn't 2FA, though. "SMS two factor" fundamentally precludes the idea that the second factor can be used as a primary factor as then it isn't "two factor" it is "one factor".
- resuresu 3y ago[dead]
- HumblyTossed 3y agoDisagree. SMS is the only thing that can get through if you can only ping a tower. If for no other reason than that it should stay around.
- cuu508 3y agoI think the article is about not using SMS for 2FA, not about abandoning SMS altogether.
- AlienRobot 3y agoI wish someone could tell me how bad is SMS for 2FA in reality, because every time I hear about it it's worded as if someone could gain access to your account JUST by stealing your SMS, which is exactly what TWO factor authentication would prevent from happening. I've been under the impression a lot of scary articles about it are talking about single-factor recovery methods that use SMS, such as password reset systems. I also think it's weird how e-mail never seems to be counted as a form of 2FA. If everyone used e-mail as 2FA, then I'd only need to secure my e-mail account. If my passwords are saved locally in my computer, isn't the computer "something I have"? Holding a phone number in a complex system of telephony is the most weird "something you have" you could come up with.
- hirsin 3y agoYou've basically backed into the logic of passkeys as well. It's all about _provably_ having the thing you have. Basically everyone is storing their passwords on their computer anyway, if at all, so the computer is the thing they have. Why not make that the factor instead of a string?
- AlienRobot 3y ago>Passkeys are a new way to sign in to apps and websites. They’re both easier to use and more secure than passwords, so users no longer need to rely on the names of pets, birthdays or the infamous “password123.”[1] Hmmm... is THIS the vectors people are considering when they make these things? I mean, it makes sense, but it does put it a whole different perspective. Am I correct to think that these aren't real problems if you use passphrases instead of some cliched password? Because you can steal my phone and get through the lock screen to access all my stuff with the passkey, but you can't get my master password out of brain lest you put a probe in it. 1. https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/ https://blog.google/technology/safety-security/the-beginning...
- vrnvu 3y agoI'm not keen on giving out my phone number and not looking to grab another SIM just for sign-ups. I can use a temporary email for a quick test, or even create a dedicated email for your service that includes two-factor authentication (2FA) for extra security. I might opt for a privacy service like DuckDuckGo or Apple's "Hide My Email." A phone number, which requires being attached to a passport/ID? I'd rather stop using your service than trust you with that data.
- noman-land 3y agoYou can rent a phone number from Twilio for $2/mo and forward incoming calls and texts to your phone number. Although as of recently you can't send texts unless you do some dumb identity verification thing.
- aftbit 3y agoExcept many/most services will not trust any "VoIP" phone numbers, because the real reason they want your number is not 2FA, but instead sibyl resistance. If you force scammers/fraudsters to burn an "expensive" number (yes, $4/mo prepaid SIM is expensive) then you get less spam/fraud. By the way, don't use Twilio. You can get a phone number from someone like BulkVS or Anveo Direct for literally $0.06/month.
- k8svet 3y agoShout out to Ticketmaster for not allowing the only real phone number I have. Walked into an Oxxo. Bought a sim card for like $3, Ticketmaster happily let me use it. Good job, guys.
- hirsin 3y agoDid you happen to transfer that phone number from a land-line to a mobile? Sort of like geo-ip systems, the SMS providers like twilio track blocks of numbers and label them as land-line or not, and refuse to send SMS to landlines. Unfortunately they're quite stale and don't account for the possibility that users could switch their number. They have ways for the user to reach out individually and fix their number, which is... Dumb.
- k8svet 3y agoMy phone number was once a Verizon number. Then Google Voice. Then Google Fi. Then, since Google couldn't transfer my number from Fi back to Voice, and Fi left me stranded multiple times with a non-functioning phone, I transferred out to Telnyx where I have my own little scripts that forward calls and forward/reverse-fwd SMS to my email. It's brilliant for my lifestyle - bouncing around countries with a different eSIM every month or so. Idk, I get why it's the way it is but it's asinine and annoying as hell.
- Animats 3y agoMaybe for security, but the proprietary alternatives to SMS are worse. Some have ads, some have interoperability problems, some have spam, and some get shut down when the vendor loses interest. If all you need to say is "I'll be 5 mins late", it's hard to beat SMS.
- andy99 3y agoThe thing about SMS is it's comparatively neutral. It's not proprietary like imessages, not a mitm attack like whatever the protocol google tries to insert for you is. With respect to authentication, the same applies. I see companies now forcing you on to an app ostensibly for 2FA but obviously just to ransom you into the app to up their metrics. And SMS works on dumb phones.
- hirsin 3y agoHow many sites actually do that? Microsoft does it for the device compliance/SSO/push notification stuff. Heck even we (GitHub) don't push the app and require TOTP or SMS first if you want to use the app.
- fasteo 3y agoWill not happen anytime soon. Tied to an actual identity (anon prepaid cards are no longer available in most countries), easily deployed at scale and across all population types (think older people), no app needed, and compatible with 100% of all mobile phones.
- janci 3y agoYes, SIMs can be swapped and SMS can be eavesdropped. But SMS 2FA has some qualities hard to replicate by other solutions: Reliability. It's extremely hard to accidentally break a SIM card. If you drop or drown your phone it may easily become inoperable, but the SIM will be still OK and ready to work in other device. Availability. If you somehow destroy your SIM it is reasonably easy to get a replacement. Properely and securely backing up an app-based authenticator is difficult. Enrolling multiple authenticators is cumbersome and sometimes not possible at all. Migrating to new device is as easy as it gets. Attack discovery. If you are being sim-swapped, you will notice immediately as your phone stops working. If someone is eavesdroppoing your SMS OTP you will notice as you will receive unsolicited authentication attempts. Attack scope. The attack must be targeted as it is much more costly to do it in larger scale. Attack mitigation. You can take back your stolen SIM as opposed to leaked keys. I'm not saying SMS is best solution, but it is good enough in many aspects. Other solutions are best in one aspect and much worse in others. SMS strikes the right balance IMO and can be rasonably secure when used as second factor. (Not first and only!)
- mitchbob 3y agohttps://archive.ph/6FDB3 https://archive.ph/6FDB3