3 ms·

> SMS is actually a perfectly good channel for 2FA You might have different definitions of both "perfectly" and "good" than the researchers who found in every

> SMS is actually a perfectly good channel for 2FA You might have different definitions of both "perfectly" and "good" than the researchers who found in every case with every major phone provider, the SIM could be stolen. See: https://www.issms2fasecure.com/ https://www.issms2fasecure.com/ ... - We examined the authentication procedures used by five prepaid wireless carriers when a customer attempts to change their SIM card, or SIM swap. - We found that all five carriers use insecure authentication challenges that can easily be subverted by attackers. - We reverse-engineered the authentication policies of over 140 websites that offer SMS-based authentication, and rated the vulnerability level of users of each website to a SIM swap attack. - We found 17 websites on which user accounts can be compromised based on a SIM swap alone. After over 60 days since our disclosure, nine of these websites remain vulnerable in their default configuration.

patmcc 3y ago
You might have difficulty reading entire comments. Yes, SMS 2FA will fail against a sophisticated and targeted attack. It is still drastically better than NO second factor, which is the actual comparison in the real world. There are people without smartphones. There are people without the ability to install/use a TOTP app. My aunt can either use SMS 2FA or nothing. 2MS protects her pretty well against 95% of the types of attacks she's likely to face.
- Terretta 3y ago
  Which part of your comment do you think I failed to read? Frankly, a secure password alone, with no second factor, is "drastically" better than a secure password with ability to change that password by SMS, as is frequently the case (a quarter of the time, per that research). So set up LastPass or 1Password for your aunt. As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world. Your claim is "Because most customers, most of the time, are not under a targeted or even semi-targeted attack." On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated.
  - patmcc 3y ago
    >>Frankly, a secure password alone, with no second factor, is "drastically" better than a secure password with ability to change that password by SMS, as is frequently the case (a quarter of the time, per that research). So set up LastPass or 1Password for your aunt. Obviously password resets shouldn't be possible by SMS alone, I never claimed otherwise. I'm talking about using SMS as a second factor - in addition to having the valid password. >>As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world. In my experience, low-net-worth + technically unsophisticated users are mostly at risk from brute force attacks and/or credential stuffing, and SMS (as an actual second factor, not a "reset the password for free" button) is very effective at stopping that. >>On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated. If your customers have phone number/username/password all leaked together...sure, I can believe that. Probably you should focus on preventing leaks of that size.
    - Terretta 3y ago
      > If your customers have phone number/username/password all leaked together...sure, I can believe that. Probably you should focus on preventing leaks of that size. A substantial proportion of your customers' email + password pairs have been leaked before they sign up with you. Email and phone are already paired from data brokers, you don't need the dump. A majority of SaaS providers and banks fail to check for previously leaked creds. Many of the same ones that think SMS is "perfectly good".
      - patmcc 3y ago
        Is your bank one of the ones that uses email addresses for usernames? Because that's a great way to make it much easier for attackers to match up leaked creds. Consider switching to a (chosen) username or card number or something. If your username is quickly matched to a phone number (or email address) it makes phishing (or account takeovers) much easier.
  - drivebycomment 3y ago

patmcc 3y ago

You might have difficulty reading entire comments. Yes, SMS 2FA will fail against a sophisticated and targeted attack. It is still drastically better than NO second factor, which is the actual comparison in the real world. There are people without smartphones. There are people without the ability to install/use a TOTP app. My aunt can either use SMS 2FA or nothing. 2MS protects her pretty well against 95% of the types of attacks she's likely to face.

Terretta 3y ago
Which part of your comment do you think I failed to read? Frankly, a secure password alone, with no second factor, is "drastically" better than a secure password with ability to change that password by SMS, as is frequently the case (a quarter of the time, per that research). So set up LastPass or 1Password for your aunt. As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world. Your claim is "Because most customers, most of the time, are not under a targeted or even semi-targeted attack." On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated.
- patmcc 3y ago
  >>Frankly, a secure password alone, with no second factor, is "drastically" better than a secure password with ability to change that password by SMS, as is frequently the case (a quarter of the time, per that research). So set up LastPass or 1Password for your aunt. Obviously password resets shouldn't be possible by SMS alone, I never claimed otherwise. I'm talking about using SMS as a second factor - in addition to having the valid password. >>As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world. In my experience, low-net-worth + technically unsophisticated users are mostly at risk from brute force attacks and/or credential stuffing, and SMS (as an actual second factor, not a "reset the password for free" button) is very effective at stopping that. >>On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated. If your customers have phone number/username/password all leaked together...sure, I can believe that. Probably you should focus on preventing leaks of that size.
  - Terretta 3y ago
    > If your customers have phone number/username/password all leaked together...sure, I can believe that. Probably you should focus on preventing leaks of that size. A substantial proportion of your customers' email + password pairs have been leaked before they sign up with you. Email and phone are already paired from data brokers, you don't need the dump. A majority of SaaS providers and banks fail to check for previously leaked creds. Many of the same ones that think SMS is "perfectly good".
    - patmcc 3y ago
      Is your bank one of the ones that uses email addresses for usernames? Because that's a great way to make it much easier for attackers to match up leaked creds. Consider switching to a (chosen) username or card number or something. If your username is quickly matched to a phone number (or email address) it makes phishing (or account takeovers) much easier.
- drivebycomment 3y ago