3 ms·

Discrediting the security of SMS tokens applies whether or not they're a single factor or part of a multi-factor system. If logging in to my account requires a

by akerl_ 13y ago

Discrediting the security of SMS tokens applies whether or not they're a single factor or part of a multi-factor system. If logging in to my account requires a password and an SMS token, and SMS tokens are so easily compromised, my account is effectively protected by only a password. While compromising the token alone doesn't give an attacker access to my account, I can't consider my account to be protected by multiple factors.

virtue3 13y ago
There are many sites that will use sms tokens as a recovery option as well. Making them a singular point of compromise even in a two-factor system.
rcxdude 13y ago
Multiple factors help a lot even if most of the factors a not very secure, because now the attacker has to compromise both of them for the same target in order to succeed. So if a bank uses SMS and a password you need to develop a way to capture passwords and then also capture SMS messages. The number of accounts you compromise is the intersection of these two sets, instead of the union which would occur from two separate exploits. So it increases the costs of attackers significantly. Of course a properly cryptographically secure token is better (and you should demand such for important stuff like access to your bank account), but SMS as a second factor is far from useless. EDIT: SMS also has the property that compromise is transient: not only do you have to compromise two seperate systems, but you need to compromise one of them at the time which you wish to login.
ademarre 13y ago
SMS security tokens have significant weaknesses; yes. The reason for multi-factor authentication is to compensate for the weaknesses of any single factor. This works reasonably well as long as the factors aren't so weak as to be trivially surmounted. If there existed a single authentication factor that was at once practical and perfectly secure, then there would be no need for multi-factor auth.
- akerl_ 13y ago
  The point of the article is that SMS as a security factor is weak enough as to be trivially surmounted.
  - ademarre 13y ago
    Weak, yes. But trivial? The article does not convince me of that. > In this context, the telephone network itself may no longer be the weakest link in the chain. The diligent attacker only needs to look for the cloud operator with an unplugged security hole and use their system as a stepping stone to read any SMS they want, when they want. This is the most practical attack described in the article. Attack vectors like this will occasionally open up, but I would not call it trivial.
    - Klinky 13y ago
      I agree. That quote basically describes any technical attack on a service. You could write any article stating XYZ tech is insecure if you're sounding the alarm based on "future unknown vulnerabilities".

by akerl_ 13y ago

virtue3 13y ago

There are many sites that will use sms tokens as a recovery option as well. Making them a singular point of compromise even in a two-factor system.

rcxdude 13y ago

Multiple factors help a lot even if most of the factors a not very secure, because now the attacker has to compromise both of them for the same target in order to succeed. So if a bank uses SMS and a password you need to develop a way to capture passwords and then also capture SMS messages. The number of accounts you compromise is the intersection of these two sets, instead of the union which would occur from two separate exploits. So it increases the costs of attackers significantly. Of course a properly cryptographically secure token is better (and you should demand such for important stuff like access to your bank account), but SMS as a second factor is far from useless. EDIT: SMS also has the property that compromise is transient: not only do you have to compromise two seperate systems, but you need to compromise one of them at the time which you wish to login.

ademarre 13y ago

SMS security tokens have significant weaknesses; yes. The reason for multi-factor authentication is to compensate for the weaknesses of any single factor. This works reasonably well as long as the factors aren't so weak as to be trivially surmounted. If there existed a single authentication factor that was at once practical and perfectly secure, then there would be no need for multi-factor auth.

akerl_ 13y ago
The point of the article is that SMS as a security factor is weak enough as to be trivially surmounted.
- ademarre 13y ago
  Weak, yes. But trivial? The article does not convince me of that. > In this context, the telephone network itself may no longer be the weakest link in the chain. The diligent attacker only needs to look for the cloud operator with an unplugged security hole and use their system as a stepping stone to read any SMS they want, when they want. This is the most practical attack described in the article. Attack vectors like this will occasionally open up, but I would not call it trivial.
  - Klinky 13y ago
    I agree. That quote basically describes any technical attack on a service. You could write any article stating XYZ tech is insecure if you're sounding the alarm based on "future unknown vulnerabilities".