3 ms·
Therefore, by adding multiple ways to log in/recover an account, each additional one lowers the safety? Also, worse: does this mean that by just having one bad
by gastonmorixe 2y ago
Therefore, by adding multiple ways to log in/recover an account, each additional one lowers the safety?
Also, worse: does this mean that by just having one bad 2FA/recovery method like SMS along with more secure ones like TOTP/RFC 6238 or hardware keys, the overall security level is as low/bad as the worst method undermining the rest? Why do companies still allow or even encourage multiple methods (and SMS)?
I love the convenience of SMS sometimes, but if it doesn't add any security at all, just a sense of fake security that they won't even need an IMEI from me, just my phone number, jeez. This should be solved or forbidden by major institutions and services.
- lisper 2y agoLike everything in computer security, it's complicated, and there are tradeoffs. First, intercepting SMS is not that easy. It's "easy" for someone who knows what they are doing and is willing to expend some resources, but it's not a casual attack that can be mounted by a script kiddie. It's a lot easier to steal your phone number using a social engineering attack. The easiest one to execute is to impersonate you somehow and get your number transferred to a "new" phone. That one got me a few years ago. Very scary. Second, in order to exploit an SMS attack you have to be able to link the number to e.g. a bank account. One mitigation for this is to use different and non-obvious user IDs for critical accounts. Third, despite its weaknesses, SMS 2FA is better than no 2FA at all. Even if breaking SMS is "easy" it's still an additional cost for a prospective hacker. You don't have to outrun the bear. But it is good to be aware that SMS 2FA is weak. It's better than nothing, but for things that are really mission-critical you should seek alternatives.