21–30 of 35 posts
The main reason why companies like SMS 2FA: It costs next to nothing, and it shifts the responsibility to the customer. Your account got hacked? Not our problem, we have 2FA. Must've been your fault.
SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, "training" people to use TOTP apps, or "forcing" people to install an app on their personal devices. That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and…
Everyone has a 2nd email, personal + work or school.
You could argue that both emails are probably accessible from an email app on the phone, but if the phone is stolen, then that's no worse than SMS or ToTP apps also on the phone.
You could argue password reuse, but if the address used for 2FA is never exposed to the end user after being set+verified, then the attacker would have no way of knowing the victim's 2nd email address.
Unless the attack is targeted... But if the attack is targeted, then we're back to SMS being vulnerable.
So, what it comes down to is 2nd email as 2FA is more secure and more efficient than SMS out of the gate... (and much cheaper)...
And, if I use a very obscure and otherwise not used email (with its own security + strong password), even a targeted attack has no better chance than a ToTP app on an offline device, like an iPod touch.
So:
- 1st.) ToTP on offline device (most secure, most expensive, most difficult to learn, hard to use),
- 2nd.) 2nd email (can be most secure, cheapest, easiest to learn, easiest to use), and
- 3rd.) SMS (least secure, mid-expensive, mid-learnability, mid-usability).
Why didn't we all default to 2nd email then, instead of SMS as a paradigm? Actually, was used, and still used by Gmail from the beginning (even in conjunction with ToTP now)...
I think the worst is when companies force you to leave SMS on as a fallback. On stripe, I use a security key. Someone has to either steal my keyring, or steal my backup key. But I'm force to leave SMS on as a fallback, so really, the weakest link is there, and a potential cracker only needs to break this extremely fragile insecure system, and completely bypass the security key.
SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, "training" people to use TOTP apps, or "forcing" people to install an app on their personal devices. That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and…
It already does, both through an app notification using the Microsoft Authenticator TOTP app, as well as through the app-agnostic TOTP method. (Just checked my own settings.) It's just not the easiest thing to find the settings page where you do it, because Microsoft helpfully hides it behind "advanced security options" instead of just putting it next to the "change password" UI like the other major sites do.
> Most security people still don't distinguish between authenticators and identities, as federation concepts like identity providers are still in the rarefied space of enterprise.
Who are you counting as "security people" in this case? I feel like the distinction for that kind of thing has been around for a long, long time, as evidenced by SSH public key configs and Active Directory certificate based login configuration both allowing multiple keys/certs per user, or Github allowing multiple keys as access tokens, etc. If we're talking about OTP keyrings issued by banks to consumers, again I don't think those things have been equated to identity as much as being treated like a second key for a second lock on the same door.
SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, "training" people to use TOTP apps, or "forcing" people to install an app on their personal devices. That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and…
>2. in unionized environments what is meant by "unionized" here? It doesn't seem to be related to labor unions.
If an employer wants employees in a bargaining unit to use their own mobile devices and install a TOTP app on them, employer has to pay, and then the responsibility for it working needs to be established. In normal environments, you just say "we use this here," and users figure it out. If it's organic bottom-up adoption based on the option, it works, but if you impose a change, it creates admin overheads.
Email is also a very weak form of 2nd factor that's more popular than it should be.
SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, "training" people to use TOTP apps, or "forcing" people to install an app on their personal devices. That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and…
Beyond marketing, I've never understood SMS as the default 2FA over just using a second email as the 2nd factor. Everyone has a 2nd email, personal + work or school. You could argue that both emails are probably accessible from an email app on the phone, but if the phone is stolen, then that's no worse than SMS or ToTP apps also on the phone. You could argue password reuse, but if the address used for 2FA is never ex…
1) Getting a mobile phone number seems much more difficult than getting an email. It provides some amount of country verification: If a service runs for let's say Danish people, then they can expect the phone number to be a +45.
2) taking over someone's email seems much more easy than taking over someone's phone, since many people reuse same password everywhere, then if you already have the password of the service requesting the OTP, good chance is that you also have the email password. The email address is not hard to find if attacker has password to the first email too. Hoping for security by obscurity (i.e. the 2nd email is now a "secret") isn't great.
3) physical security: without sophisticated attack, SMS can only be received on the actual user mobile phone, even if a phone with no passphrase. "If the phone is stolen" isn't a realistic scenario against a scammer on another continent.
Also from a theoritical point of view: it's a completely different communication channel, so if someone has somehow taken over the first channel (via some malware running on the email client/computer), then they still need to take over second channel. So for instance, if a USPS snail mail wasn't so slow (or you don't need the OTP code right away), even if really insecure, it'd be better than 2nd email, as it follows same benefits as SMS.
Please, no more SMS Authentication. Hacker news readers are in a unique position to prevent this "feature" from entering products. Let's work on putting this idea out to pasture. TOTP, while not perfect, is an improvement. The protocol could be improved to provide protection against proxy attacks, but the point I'm trying to make is that your regular user can use TOTP. I've successfully set it up for my parents (both…
Same for companies a lot of the time.
Are there any cheaper, but still reliable hardware keys nowadays?
Earlier quoted context omitted.
Beyond marketing, I've never understood SMS as the default 2FA over just using a second email as the 2nd factor. Everyone has a 2nd email, personal + work or school. You could argue that both emails are probably accessible from an email app on the phone, but if the phone is stolen, then that's no worse than SMS or ToTP apps also on the phone. You could argue password reuse, but if the address used for 2FA is never ex…
My guess is the most common attacker is someone sitting on a computer in a different country/continent. So: 1) Getting a mobile phone number seems much more difficult than getting an email. It provides some amount of country verification: If a service runs for let's say Danish people, then they can expect the phone number to be a +45. 2) taking over someone's email seems much more easy than taking over someone's phon…
> Also from a theoritical point of view: it's a completely different communication channel, so if someone has somehow taken over the first channel (via some malware running on the email client/computer), then they still need to take over second channel.
...is a very good point. Although, (without any data to back up this claim), I would think most users with a compromised device have a fully compromised device.
Edit:
> Hoping for security by obscurity (i.e. the 2nd email is now a "secret") isn't great.
To clarify, that's not exactly the point. If the attacker discovers the value for the phone number or 2nd email (through a data breach), then it becomes targeted, which brings us back to the security of SMS vs email (the parent article).