Didn’t we just learn you shouldn’t use SMS 2FA?
A lot of people say that. But SMS 2FA is better than nothing.
Nope, not if it introduces common customer support backdoors.
HTML attributes to improve your users' two factor authentication experience
11–20 of 82 posts
Re: HTML attributes to improve your users' two factor authentication experience
#12Didn’t we just learn you shouldn’t use SMS 2FA?
Taking over accounts is mainly American thing, the rest of the world is using same method to identify yourself to a telecom company - by providing your ID card or passport.
Re: HTML attributes to improve your users' two factor authentication experience
#13Hello! I’m the author of this article. Thanks for posting! Here’s to the power of HTML attributes and better sign in experiences for everyone.
I know you're probably paid to do so, but please stop recommending that site operators use SMS for a second factor.
Re: HTML attributes to improve your users' two factor authentication experience
#14Didn’t we just learn you shouldn’t use SMS 2FA?
Twilio offers a service to send SMSes via an API. Of course they're going to tell you to use this.
Re: HTML attributes to improve your users' two factor authentication experience
#15Didn’t we just learn you shouldn’t use SMS 2FA?
For low-stakes auth or simply duplicate user prevention SMS is sufficient. E.g. dating apps, sharing economy services, e-commerce sites.
Re: HTML attributes to improve your users' two factor authentication experience
#16These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/
Re: HTML attributes to improve your users' two factor authentication experience
#17Re: HTML attributes to improve your users' two factor authentication experience
#18Re: HTML attributes to improve your users' two factor authentication experience
#19These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/
Oy, me too, and though I love Twilio they are an offender here! What is the point of this pattern? Something to do with SSO validation or something?
Re: HTML attributes to improve your users' two factor authentication experience
#20Hello! I’m the author of this article. Thanks for posting! Here’s to the power of HTML attributes and better sign in experiences for everyone.
I know you're probably paid to do so, but please stop recommending that site operators use SMS for a second factor. https://www.issms2fasecure.com/
I’m actually paid to say that too ;) . In fact, SIM swapping isn’t the only weakness of SMS, take a look into the SS7 network and how that allows for a rogue operator to redirect SMS messages too.
At Twilio, we have APIs for two factor authentication and we recommend implementing via push notification to the Authy app with “approve” and “deny” buttons. This is more secure and a better experience than SMS. The API also allows for regular app based 2FA, with a TOTP code, which is more secure than SMS. But it also allows you to fallback to SMS, which is still more secure than no 2FA.
You do have to consider the threat model for your own application when considering these sort of security measures. If the value of an account takeover is high then a targeted attack can, and will, break SMS 2FA. Which is why the Twilio 2FA API allows you to turn off SMS 2FA if you choose.
Ultimately I’d prefer SMS over nothing when it comes to 2FA, but I also encourage developers to use more secure options that can also have a better experience.