3 ms·

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of securi

by elric 2y ago

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

calfuris 2y ago
I've seen it forced on non-public-facing systems where the company already has everyone's phone number, so that can't be the only reason.
rafram 2y ago
That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!
- lolinder 2y ago
  > the new SSNs - unique identifiers that never change and connect you across services And just like SSNs both the "unique" and the "never change" are only true of the spherical cow version of the system. Phone numbers are actually substantially worse at being unique and unchanging, what with people in families sharing a phone or trading phone numbers, people forgetting to transfer the number when switching carriers, people intentionally switching numbers in an attempt to end spam calls... The number of ways to break the assumed invariants is actually quite high. See Falsehoods Programmers Believe About Phone Numbers [0]. [0] https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md https://github.com/google/libphonenumber/blob/master/FALSEHO...
- dylan604 2y ago
  since COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device. I know I'm not the first person to be unable to port a number, so calling a phone number something that never changes is a bit skewed
  - rafram 2y ago
    Yeah, I didn’t mean that they never change in reality, but that they’re treated as if they never change. (Same with SSNs.) I can only imagine how many hundreds of services I’d lose access to if I lost my number. Hours and hours talking to customer service.
Rygian 2y ago
Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.
- aftbit 2y ago
  I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice. Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.
  - pwg 2y ago
    > It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. It's not, but much like 'fax' hanging on in the medical environment because it has been labeled "secure" by the regulations, there is a line in some regulation rule somewhere that labels "SMS" as "secure" but does not label "email" as "secure", and because they do the minimum to meet the regulation, they go with "SMS" and go on about their day.
    - mjevans 2y ago
      Important distinction. 'Fax' is 'exempt' not secure. So of course many places will take the relief valve even though the service is both a poor fit / quality and horridly insecure. When it works right the records aren't even in a sealed envelope but just on the output of some printer somewhere for anyone to see!
  - Rygian 2y ago
    Sending a one time code by email means that anyone with access to them inbox can both reset the password (first factor) and intercept one time codes ("second" factor). Using SMS creates an opportunity to dissociate those two situations.
  - 2y ago
aftbit 2y ago
They often want your phone number for anti-fraud or anti-sybil reasons. If they have free accounts, requiring a phone number helps prevent you from creating a new account to evade a ban and makes it easier to link bad behavior across accounts.
nolist_policy 2y ago
No, most companies actually want your phone number for spam prevention. I think the contribution of Spammers to the decline of the Internet is underrated.
- arp242 2y ago
  Only by those who never worked on these kind of services. Running something like a webmail service is being flypaper for dickheads. As soon as you gain any sort of popularity you will have some very hard and sharp lessons about the lengths spammers will go through to make abuse your service. First rule of designing anything: "if some cunt can make a buck by completely fucking over your system then that cunt will completely fuck over your system because that cunt is a cunt."
  - lolinder 2y ago
    You don't even have to be running a webmail service, the instant you use any service to send an email with even one user-controlled field (even something as innocuous as their name) you already have a problem.
    - arp242 2y ago
      Yeah, I meant "webmail" in the broadest possible sense. And it's even broader than that: anything that allows making anything public really: from forum comments to Instagram to WordPress sites to Wikipedia. Remember that for about ten years there was a person who consistently and frequently inserting images of ceiling fans in random articles.
brandon272 2y ago
They force SMS 2FA because it is a lot more frictionless to assume that your users have a phone number than to assume that they have a 2FA app installed on their phone and know how to manage those tools. It's also easier to support.
- ryandrake 2y ago
  Ugghhh, "frictionless" as if we're talking about logging into Candy Crush here. Are the "Growth Hackers" infiltrating banking apps now? I don't want my bank software to be frictionless. I want it to be secure.
  - brandon272 2y ago
    The person I was replying to said "they just want your phone number", which to me implies that we're not talking about 2FA at the level of banking apps, as the bank already has your phone number, among plenty of other details. Most banking apps I have used also do not use SMS 2FA.

by elric 2y ago

I've long suspected that companies which force SMS 2FA don't really care about security, they just want your phone number, and 2FA is a convenient bit of security theatre to make you give it to them.

calfuris 2y ago

I've seen it forced on non-public-facing systems where the company already has everyone's phone number, so that can't be the only reason.

rafram 2y ago

That’s definitely part of it. Phone numbers are the new SSNs - unique identifiers that never change and connect you across services - except you also hand them out to everyone you meet. One might say it seems like a bad system!

lolinder 2y ago
> the new SSNs - unique identifiers that never change and connect you across services And just like SSNs both the "unique" and the "never change" are only true of the spherical cow version of the system. Phone numbers are actually substantially worse at being unique and unchanging, what with people in families sharing a phone or trading phone numbers, people forgetting to transfer the number when switching carriers, people intentionally switching numbers in an attempt to end spam calls... The number of ways to break the assumed invariants is actually quite high. See Falsehoods Programmers Believe About Phone Numbers [0]. [0] https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md https://github.com/google/libphonenumber/blob/master/FALSEHO...
dylan604 2y ago
since COVID, i've had 3 new numbers. i'm sure that's an edge case, but it happens. my second number came when I brought my own device to a pre-pay plan on a new carrier that said my number was not able to be ported. then, when i upgraded phones, the pre-pay number was not eligible for carrying over to the new device. I know I'm not the first person to be unable to port a number, so calling a phone number something that never changes is a bit skewed
- rafram 2y ago
  Yeah, I didn’t mean that they never change in reality, but that they’re treated as if they never change. (Same with SSNs.) I can only imagine how many hundreds of services I’d lose access to if I lost my number. Hours and hours talking to customer service.

Rygian 2y ago

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.

aftbit 2y ago
I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice. Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.
- pwg 2y ago
  > It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. It's not, but much like 'fax' hanging on in the medical environment because it has been labeled "secure" by the regulations, there is a line in some regulation rule somewhere that labels "SMS" as "secure" but does not label "email" as "secure", and because they do the minimum to meet the regulation, they go with "SMS" and go on about their day.
  - mjevans 2y ago
    Important distinction. 'Fax' is 'exempt' not secure. So of course many places will take the relief valve even though the service is both a poor fit / quality and horridly insecure. When it works right the records aren't even in a sealed envelope but just on the output of some printer somewhere for anyone to see!
- Rygian 2y ago
  Sending a one time code by email means that anyone with access to them inbox can both reset the password (first factor) and intercept one time codes ("second" factor). Using SMS creates an opportunity to dissociate those two situations.
- 2y ago

aftbit 2y ago

They often want your phone number for anti-fraud or anti-sybil reasons. If they have free accounts, requiring a phone number helps prevent you from creating a new account to evade a ban and makes it easier to link bad behavior across accounts.

nolist_policy 2y ago

No, most companies actually want your phone number for spam prevention. I think the contribution of Spammers to the decline of the Internet is underrated.

arp242 2y ago
Only by those who never worked on these kind of services. Running something like a webmail service is being flypaper for dickheads. As soon as you gain any sort of popularity you will have some very hard and sharp lessons about the lengths spammers will go through to make abuse your service. First rule of designing anything: "if some cunt can make a buck by completely fucking over your system then that cunt will completely fuck over your system because that cunt is a cunt."
- lolinder 2y ago
  You don't even have to be running a webmail service, the instant you use any service to send an email with even one user-controlled field (even something as innocuous as their name) you already have a problem.
  - arp242 2y ago
    Yeah, I meant "webmail" in the broadest possible sense. And it's even broader than that: anything that allows making anything public really: from forum comments to Instagram to WordPress sites to Wikipedia. Remember that for about ten years there was a person who consistently and frequently inserting images of ceiling fans in random articles.

brandon272 2y ago

They force SMS 2FA because it is a lot more frictionless to assume that your users have a phone number than to assume that they have a 2FA app installed on their phone and know how to manage those tools. It's also easier to support.

ryandrake 2y ago
Ugghhh, "frictionless" as if we're talking about logging into Candy Crush here. Are the "Growth Hackers" infiltrating banking apps now? I don't want my bank software to be frictionless. I want it to be secure.
- brandon272 2y ago
  The person I was replying to said "they just want your phone number", which to me implies that we're not talking about 2FA at the level of banking apps, as the bank already has your phone number, among plenty of other details. Most banking apps I have used also do not use SMS 2FA.