3 ms·
While I don't strongly disagree with any of the points made regarding the security of the SMS network, I do feel that the article is inordinately preoccupied wi
by mikehall314 12y ago
While I don't strongly disagree with any of the points made regarding the security of the SMS network, I do feel that the article is inordinately preoccupied with banking, and dismisses SMS authentication out of hand because it isn't good enough for your bank. In the case of a bank, I agree that a security token certainly is the right tool for the job. But what about other login services?
It doesn't really matter to me, as a developer, whether SMS is impregnable. It matters whether it is harder to break than user-originated passwords. Users are notoriously bad at picking good passwords, and are easily socially engineered.
We can implement password policies to attempt to mitigate this, but what we end up doing is frustrating our users, who will struggle to remember the 8 character minimum, alphanumeric, at least one capital letter, at least one piece of punctuation password we have forced them to choose.
What ends up happening is that users either forget their "strong" passwords, and have to reset them via email or SMS every time. Or they write their passwords down or store them all on a spreadsheet. Or they reuse then same strong password across multiple services (and even correct horse battery staple doesn't avoid that one).
SMS authentication may not be perfect, but single-use passwords, with nothing for the user to remember, is an improvement on weak user-originated passwords. For my money, at least!
- tbrownaw 12y agoWe can implement password policies to attempt to mitigate this, but what we end up doing is frustrating our users, who will struggle to remember the 8 character minimum, alphanumeric, at least one capital letter, at least one piece of punctuation password we have forced them to choose. >>> math.log((26+26+10+32) ** 8, 2) 52.4367108134211 So a "perfect" 8-character password has about 52 bits entropy. $ wc -l /usr/share/dict/american-english 99171 /usr/share/dict/american-english >>> math.log(99171,2) * 3 49.792892048685374 3 random dictionary words has almost 50 bits. 4 words would have about 66 bits. Couldn't average-user password strength be hugely improved by giving better password instructions (if your signup / passwork-change page is SSL as it should be, maybe even provide a few dozen random words as possibilities)?
- derleth 12y agoBut then we'd have to retrain programmers to nix the maximum password length rules, which would likely require a massive overhaul of a few databases. (Wait for it... )
- nly 12y ago> dismisses SMS authentication out of hand because it isn't good enough for your bank. My bank seem too have decided that it's good enough.
- kondro 12y agoHa! I work with banks every day and see some of the worst architectural decisions made in the name of security. What's worse is most of these decisions actually make their systems less secure! It seems to be impossible for banks to NOT role their own authentication systems. And every one I've seen ends up with passwords stored or transferred in a way less secure than if they just plugged in an OAuth library or use any of the standard WSS/WSSE options to secure their SOAP endpoints.