Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Analysis of SMS as a Second Factor of Authentication

queue.acm.org

Post reply on HN
Print view View original

11–20 of 35 posts

Re: Security Analysis of SMS as a Second Factor of Authentication

#11

Post by orev »

upofadown wrote: post #8

>Email accounts have become, over the years, not only large repositories of highly sensitive and private data, but also single points of failure for digital footprints on the Internet. This is really the key issue here. Passwords are fine if you give people some place to keep them. >...it became widely acknowledged that passwords should be highly complex in order to maximize their entropy and, thus, substantially inc…

MFA wouldn’t be needed in a perfect world, but that world clearly doesn’t exist, despite 50 years of pleading with people to pick good passwords and manage them correctly. At some point you just need to look at the evidence and find another way to accomplish your goals.

Re: Security Analysis of SMS as a Second Factor of Authentication

#12

Post by kevincox »

exabrial wrote: post #4

Please, no more SMS Authentication. Hacker news readers are in a unique position to prevent this "feature" from entering products. Let's work on putting this idea out to pasture. TOTP, while not perfect, is an improvement. The protocol could be improved to provide protection against proxy attacks, but the point I'm trying to make is that your regular user can use TOTP. I've successfully set it up for my parents (both…

What I would like to see is software U2F keys that browsers sync for you. I'm sure this would upset some people but I don't think the average user has the ability to understand and maintain a set of security keys. Furthermore you have to maintain the keys separately for each site. This means that I only use 2fa for a small number of valuable sites, because the pain of rotating the credentials is huge.

However most people I know have browser sync set up. They are using it for passwords. It would be great if it could manage a security token for them and allow authentication to websites without risk of leak.

Re: Security Analysis of SMS as a Second Factor of Authentication

#15

Post by fulafel »

blakesterz wrote: post #2

I feel like this is an important clarification from the end of the intro: "This article provides some insight into the security challenges of SMS-based multifactor authentication: mainly cellular security deficiencies, exploits in the SS7 (Signaling System No. 7) protocol, and the dangerously simple yet highly efficient fraud method known as SIM (subscriber identity module) swapping. Based on these insights, readers…

It would give a more credible impression without the exploit vs vulnerability terminology confusion (that repeats many times in the article)

Re: Security Analysis of SMS as a Second Factor of Authentication

#16

Post by postalrat »

WhyNotHugo wrote: post #3

I think the worst is when companies force you to leave SMS on as a fallback. On stripe, I use a security key. Someone has to either steal my keyring, or steal my backup key. But I'm force to leave SMS on as a fallback, so really, the weakest link is there, and a potential cracker only needs to break this extremely fragile insecure system, and completely bypass the security key.

I assume it's their attempt at reducing support calls.

Re: Security Analysis of SMS as a Second Factor of Authentication

#17

Post by irjustin »

motohagiography wrote: post #9

SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, "training" people to use TOTP apps, or "forcing" people to install an app on their personal devices. That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and…

Agreed with this analysis.

Trying to teach my parents now to use a Authy, Google Auth, 1Password, LastPass is pretty much a non-starter. I'd be getting calls every other day.

SMS 2FA allows my parents to considerably shrink their attack surface without a high barrier to entry.

Re: Security Analysis of SMS as a Second Factor of Authentication

#18

Post by gruez »

motohagiography wrote: post #9

SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, "training" people to use TOTP apps, or "forcing" people to install an app on their personal devices. That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and…

>2. in unionized environments

what is meant by "unionized" here? It doesn't seem to be related to labor unions.

Re: Security Analysis of SMS as a Second Factor of Authentication

#19

Post by R0b0t1 »

WhyNotHugo wrote: post #3

I think the worst is when companies force you to leave SMS on as a fallback. On stripe, I use a security key. Someone has to either steal my keyring, or steal my backup key. But I'm force to leave SMS on as a fallback, so really, the weakest link is there, and a potential cracker only needs to break this extremely fragile insecure system, and completely bypass the security key.

So is stripe liable for your account being compromised due to SIM hijacking? The telephone companies claim they're not liable, and you certainly aren't liable, so who is?

This smells similar to banks not needing to check check signature anymore.

Re: Security Analysis of SMS as a Second Factor of Authentication

#20

Post by jiveturkey »

> Regardless of the critical nature of an online account or the individual who owns it, using a second form of authentication should always be the default option, regardless of the method chosen.

Couldn’t disagree more. This is oversimplification of a complex subject.

Post reply on HN