Security Analysis of SMS as a Second Factor of Authentication

I feel like this is an important clarification from the end of the intro:

"This article provides some insight into the security challenges of SMS-based multifactor authentication: mainly cellular security deficiencies, exploits in the SS7 (Signaling System No. 7) protocol, and the dangerously simple yet highly efficient fraud method known as SIM (subscriber identity module) swapping. Based on these insights, readers can gauge whether SMS tokens should be used for their online accounts. This article is not an actual analysis of multifactor authentication methods and what can be considered a second (or third, fourth, etc.) factor of authentication; for such a discussion, the author recommends reading security expert Troy Hunt's report on the topic."

Please, no more SMS Authentication. Hacker news readers are in a unique position to prevent this "feature" from entering products. Let's work on putting this idea out to pasture.

TOTP, while not perfect, is an improvement. The protocol could be improved to provide protection against proxy attacks, but the point I'm trying to make is that your regular user can use TOTP. I've successfully set it up for my parents (both closing in on 70years old and are not tech-savvy) and they have no issues using it.

Personally I use a hardware U2F key everywhere I can. With the newest version of Safari Tech Preview _finally_ supporting U2F, I'm hoping we see some deeper market penetration.

I have something like 200 accounts stored in my LastPass account, and my main problem now is that I have no idea which of my accounts use SMS for 2FA. There was a period of time where 2FA was synonymous with SMS, and a further period of time where using a hardware key or authenticator app required setting up SMS first. I'm trying to clean it up, but it's a mess out there. Some accounts require a phone number and don't have an option to disable SMS as a option.

>Email accounts have become, over the years, not only large repositories of highly sensitive and private data, but also single points of failure for digital footprints on the Internet.

This is really the key issue here. Passwords are fine if you give people some place to keep them.

>...it became widely acknowledged that passwords should be highly complex in order to maximize their entropy and, thus, substantially increase the amount of time it would take to crack them.

This is only true if people reuse the same password for different sites. Otherwise the site can rate limit brute force attacks to the extent that even completely trivial passwords are OK.

I dunno, it seems that in most cases second factor auth is not really needed. We need to address the actual problem, not attempt to paper it over by dumping stuff on top. The "let's just let the phone company do the identity stuff" approach is a good example of failing to deal.

Not if you are securing your email with a security key and enforcing that you can only access it from devices that meet security guidelines (as is easy to do with Office 365 and almost easy to do in GSuite). Unlike SMS, where you could lock down your phone and take every precaution and an attacker could still compromise your SIM via your carrier.