SMS is not 2FA-secure

#1

Post by sergeant3 » Fri, Jan 10, 2020, 10:16 PM UTC

SMS is not 2FA-secure
issms2fasecure.com

Re: SMS is not 2FA-secure

#2

Post by doctor_eval » Fri, Jan 10, 2020, 11:01 PM UTC

Betteridge's law of headlines is an adage that states: "Any headline that ends in a question mark can be answered by the word no".

https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headline...

Re: SMS is not 2FA-secure

#3

Post by frenchyatwork » Fri, Jan 10, 2020, 11:03 PM UTC

But how else are you supposed to encourage users to give you their phone numbers so you can track them better?

Re: SMS is not 2FA-secure

#4

Post by hprotagonist » Fri, Jan 10, 2020, 11:04 PM UTC

uh.. No, and NIST has been saying this for about 5 years.

Re: SMS is not 2FA-secure

#5

Post by theonething » Fri, Jan 10, 2020, 11:10 PM UTC

The answer is no, but is it more secure than no 2FA?

Of course there are much better 2FA options, but for the general public, they are probably too complicated to use.

Everyone understands SMS.

Re: SMS is not 2FA-secure

#6

Post by Andrew_nenakhov » Fri, Jan 10, 2020, 11:12 PM UTC

Not in Russia. Numerous examples exist when victim's number was linked to attacker's sim card to obtain 2FA code, then linked back to victim's sim so he does not notice anything.

This happened both by government-linked parties, where they are able to coerce providers to do it, mostly targeting prominent political opposition members. It also happened without government involvement, done by provider's personnel with sufficient access and some entrepreneur attitude.

The rule of thumb to protect against it:

- do not use SMS 2FA

- if you do, use a foreign SIP number with SMS capabilities

- if you HAVE to use local sim, use SIM that belongs to someone else and noone knows you use it

Re: SMS is not 2FA-secure

#7

Post by lmilcin » Fri, Jan 10, 2020, 11:15 PM UTC

Just use a token like yubikey. I have a small fleet and am very happy with the decision.

The only problem is there are very few services that get it right. Get it right means support multiple tokens and allow to truly disable any other means of logging in or recovering the password.

Most services seem bent on allowing many ways of logging in without giving a choice. For example, they will advertise they use 2fa tokens but then if you can't produce one they will still allow you to log in with SMS or mail (ie. password recovery by mail). Facebook will not even let you set up tokens without having SMS set up as a factor and the phone number verified.

I hope slowly developers will get more aware and they will be better tooling (and stack exchange answers to ctrl+c ctrl+v...) to do it correctly.

Re: SMS is not 2FA-secure

#8

Post by minimaxir » Fri, Jan 10, 2020, 11:18 PM UTC

theonething wrote: post #5

The answer is no, but is it more secure than no 2FA? Of course there are much better 2FA options, but for the general public, they are probably too complicated to use. Everyone understands SMS.

Awareness may make providers more willing to switch to a better 2FA, such as TOTP.

Re: SMS is not 2FA-secure

#9

Post by goldcd » Fri, Jan 10, 2020, 11:19 PM UTC

Compared to what?

Better than not having it? Yes.

Better than committing a 4,096Kb PK to memory and confirming all interactions with mental arithmetic? No.

Re: SMS is not 2FA-secure

#10

Post by thiagomgd » Fri, Jan 10, 2020, 11:20 PM UTC

doctor_eval wrote: post #2

Betteridge's law of headlines is an adage that states: "Any headline that ends in a question mark can be answered by the word no". https://en.m.wikipedia.org/wiki/Betteridge's_law_of_headline...

As always, it works (the law, not the SMS 2FA)