3 ms·

I think it's important to distinguish between the use of SMS in two-factor authentication vs. single-factor. The author is referring to single-factor authentica

I think it's important to distinguish between the use of SMS in two-factor authentication vs. single-factor. The author is referring to single-factor authentication in the form of SMS one-time passwords. He has some great points, but I don't think they discredit the effectiveness of SMS as a component of two-factor authentication.

akerl_ 12y ago
Discrediting the security of SMS tokens applies whether or not they're a single factor or part of a multi-factor system. If logging in to my account requires a password and an SMS token, and SMS tokens are so easily compromised, my account is effectively protected by only a password. While compromising the token alone doesn't give an attacker access to my account, I can't consider my account to be protected by multiple factors.
- virtue3 12y ago
  There are many sites that will use sms tokens as a recovery option as well. Making them a singular point of compromise even in a two-factor system.
- rcxdude 12y ago
  Multiple factors help a lot even if most of the factors a not very secure, because now the attacker has to compromise both of them for the same target in order to succeed. So if a bank uses SMS and a password you need to develop a way to capture passwords and then also capture SMS messages. The number of accounts you compromise is the intersection of these two sets, instead of the union which would occur from two separate exploits. So it increases the costs of attackers significantly. Of course a properly cryptographically secure token is better (and you should demand such for important stuff like access to your bank account), but SMS as a second factor is far from useless. EDIT: SMS also has the property that compromise is transient: not only do you have to compromise two seperate systems, but you need to compromise one of them at the time which you wish to login.
- ademarre 12y ago
  SMS security tokens have significant weaknesses; yes. The reason for multi-factor authentication is to compensate for the weaknesses of any single factor. This works reasonably well as long as the factors aren't so weak as to be trivially surmounted. If there existed a single authentication factor that was at once practical and perfectly secure, then there would be no need for multi-factor auth.
  - akerl_ 12y ago
    The point of the article is that SMS as a security factor is weak enough as to be trivially surmounted.
    - ademarre 12y ago
      Weak, yes. But trivial? The article does not convince me of that. > In this context, the telephone network itself may no longer be the weakest link in the chain. The diligent attacker only needs to look for the cloud operator with an unplugged security hole and use their system as a stepping stone to read any SMS they want, when they want. This is the most practical attack described in the article. Attack vectors like this will occasionally open up, but I would not call it trivial.
      - Klinky 12y ago
        I agree. That quote basically describes any technical attack on a service. You could write any article stating XYZ tech is insecure if you're sounding the alarm based on "future unknown vulnerabilities".

akerl_ 12y ago

Discrediting the security of SMS tokens applies whether or not they're a single factor or part of a multi-factor system. If logging in to my account requires a password and an SMS token, and SMS tokens are so easily compromised, my account is effectively protected by only a password. While compromising the token alone doesn't give an attacker access to my account, I can't consider my account to be protected by multiple factors.

virtue3 12y ago
There are many sites that will use sms tokens as a recovery option as well. Making them a singular point of compromise even in a two-factor system.
rcxdude 12y ago
Multiple factors help a lot even if most of the factors a not very secure, because now the attacker has to compromise both of them for the same target in order to succeed. So if a bank uses SMS and a password you need to develop a way to capture passwords and then also capture SMS messages. The number of accounts you compromise is the intersection of these two sets, instead of the union which would occur from two separate exploits. So it increases the costs of attackers significantly. Of course a properly cryptographically secure token is better (and you should demand such for important stuff like access to your bank account), but SMS as a second factor is far from useless. EDIT: SMS also has the property that compromise is transient: not only do you have to compromise two seperate systems, but you need to compromise one of them at the time which you wish to login.
ademarre 12y ago
SMS security tokens have significant weaknesses; yes. The reason for multi-factor authentication is to compensate for the weaknesses of any single factor. This works reasonably well as long as the factors aren't so weak as to be trivially surmounted. If there existed a single authentication factor that was at once practical and perfectly secure, then there would be no need for multi-factor auth.
- akerl_ 12y ago
  The point of the article is that SMS as a security factor is weak enough as to be trivially surmounted.
  - ademarre 12y ago
    Weak, yes. But trivial? The article does not convince me of that. > In this context, the telephone network itself may no longer be the weakest link in the chain. The diligent attacker only needs to look for the cloud operator with an unplugged security hole and use their system as a stepping stone to read any SMS they want, when they want. This is the most practical attack described in the article. Attack vectors like this will occasionally open up, but I would not call it trivial.
    - Klinky 12y ago
      I agree. That quote basically describes any technical attack on a service. You could write any article stating XYZ tech is insecure if you're sounding the alarm based on "future unknown vulnerabilities".