It’s time to stop using SMS for security
lucky225.medium.com
It’s time to stop using SMS for security
1–10 of 149 posts
Re: It’s time to stop using SMS for security
#2Why is this a download?
My covid project was an SMS news API completely controllable from your phone and delivers short news summaries on any topic scraped from across the web (www.zipnews.io). While fun and it has several paying customers, the SMS can be somewhat expensive to send. The strength is that everyone with a connected cell phone can access the API.
Re: It’s time to stop using SMS for security
#3My bank (USAA) decided to switch their 2FA away from SMS a while ago. They only do email or the USAA app auth code. I love it and I feel much safer with them because of it. Let's do start to move away - yes!
Re: It’s time to stop using SMS for security
#4The URL is giving an empty page for me, so I'm afraid I can't really comment on the content of the article itself.
With that said, people should fear any site/service that uses SMS for anything security related. SMS 2fa is a fairly common vector for compromise.
It can be nice for a "data feed" though. Like, getting an update on the status of your delivery driver. Though, this can also be really annoying when say... your old college starts spamming you with stuff... which I got to experience this weekend at 1am. :)
Re: It’s time to stop using SMS for security
#5My bank (USAA) decided to switch their 2FA away from SMS a while ago. They only do email or the USAA app auth code. I love it and I feel much safer with them because of it. Let's do start to move away - yes!
Should be optional.
I feel equally threatened by a potentially weak bank app running on my phone all the time as I would my carrier giving away the keys to the castle.
Re: It’s time to stop using SMS for security
#6My bank (USAA) decided to switch their 2FA away from SMS a while ago. They only do email or the USAA app auth code. I love it and I feel much safer with them because of it. Let's do start to move away - yes!
Should be optional. I feel equally threatened by a potentially weak bank app running on my phone all the time as I would my carrier giving away the keys to the castle.
If only there were any perfectly good open standards for 2FA that were implemented by numerous free apps and/or secure hardware tokens...
Re: It’s time to stop using SMS for security
#7So, I work in telecom and dabble a bit in software.
I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale?
At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”.
I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable.
Re: It’s time to stop using SMS for security
#8So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…
I don’t think anyone hates SMS 2FA in general, just that it is susceptible to MITM attacks (snooping/interception) than other solutions (device, key, app) as is made clear in this article.
I note, however, that this attack seems to only be possible on VOIP routable numbers, and it’s my experience that banks, etc, will not allow you to use VOIP routable numbers for 2FA. That’s definitely not the case for a naive implementation of sms 2fa as would be done by likely any dev using Twilio, etc.
Re: It’s time to stop using SMS for security
#9So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…
Probably the SIM porting attacks, where telco employees are vulnerable to being socially engineered to letting an attacker port your phone number over to another device. Also this new attack, which is more stealthy.
Re: It’s time to stop using SMS for security
#10So, I work in telecom and dabble a bit in software. I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale? At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”. I’d love a parable of ho…
I don’t think anyone hates SMS 2FA in general, just that it is susceptible to MITM attacks (snooping/interception) than other solutions (device, key, app) as is made clear in this article. I note, however, that this attack seems to only be possible on VOIP routable numbers, and it’s my experience that banks, etc, will not allow you to use VOIP routable numbers for 2FA. That’s definitely not the case for a naive imple…
I hate sms because most 2FA services don't deliver to VoIP numbers.