3 ms·
In the case he cited with CloudFlare, the phishing the voicemail was a pretty effective attack vector. Also, where does he tie PIN weakness to SMS interception?
by pfraze 13y ago
In the case he cited with CloudFlare, the phishing the voicemail was a pretty effective attack vector. Also, where does he tie PIN weakness to SMS interception? They're uniquely vulnerable.
> Take a random Internet service protected by passwords and add a second factor to the login step where after login and password you must enter a code that gets SMS'd to your preconfigured phone number. The number of fraudulent logins will drop to near zero as password guessing is no longer sufficient to break in to an account.
I think you're mitigating one set of risks while adding others.
EDIT: just want to add, I do think UX should be a primary concern of security; I just disagree with your analysis of his post.
- poutine 13y agoOh really? You think that login+password is a trade of equal risk with login+password+sms? Sorry, but the second is clearly has much less risk. Twitter introduced SMS authentication as a second factor. Do you really think that their number of fraudulent logins for users protected by that second factor hasn't gone down to near zero?
- pfraze 13y agoI think some of the use-cases are getting mixed, including by myself and by the author. I do agree that 2FA, even with cell-phones, will improve the security of the web interface. The CloudFlare breach was caused by using the phone as an independent authenticator (overriding the password) which is not 2FA, as I understand it. And I agree, the likelihood of SMS interception or spoofing during the verification process seems pretty slim. I'm going to bow out to the security experts at this point.
- pyre 13y agoIIRC, GSM has been cracked. I'm not an expert, so I'm not sure how this affects SMS, but as SMS is done via a control channel (that was not originally intended to be used for text messaging), I'm assuming that there are no extra protections there. Granted, this requires physical proximity though, which definitely raises the bar for any attacker.
- poutine 13y ago> EDIT: just want to add, I do think UX should be a primary concern of security; I just disagree with your analysis of his post. Fair enough. I think the interesting thing to debate is his conclusion: that two factor auth using SMS is so flawed as to be avoided completely. That's complete nonsense.