Tell HN: SMS-based two-factor authentication is not secure

You're thinking about this wrong.

SMS 2FA is not for you.

They say it's for you (for your security or your protection or your ease of use or whatever) but that is a lie.

In cases where SMS 2FA is forced, to the exclusion of all other proofing mechanisms, it is generally because the provider has a brutally difficult spam/scam problem that is complicated to solve.

So, instead of solving their spam/scam problem, they just throw some sand in the gears (of their users) and very loosely attempt to piggyback on the physical phone / physical SIM / physical ID confluence that constitutes a "normal user".

This is, of course, a very leaky mapping and anyone determined can, of course, work right around this. But it does seem to lessen their (again, brutally difficult) spam/scam problem.

The most ironic deployment of this (desperate) technique is Twilio whose own numbers cannot be used for SMS 2FA auth[1] and yet they require a true, mobile (non-VOIP) number to use their own service.

[1] Twilio numbers are not mobile numbers. Most SMS 2FA is sent from "short codes" and short codes cannot SMS non-mobile ("voip") numbers.

Yet Apple, SendGrid, any many other require it.

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to backing it up? You cannot prove you are you and so customer support cannot help you. Google, Microsoft, and Apple are not known for helping consumers get themselves out of this catch-22.

It is a mistake to ask consumers to protect, backup, and secure their digital lives themselves. Consumers don't have the time or skills to keep up with the hackers. If Apple, Google, ATT, Verizon etc. cannot provide digital security, this is an opportunity for someone else to step in. My personal suggestion is this is a ripe opportunity for someone like the US Post Office or Department of Motor Vehicles. Consumers would go to the US Post Office or DMV and purchase a Yubi key from them. The additional value they add, is they can verify the identity of the consumers who is purchasing the Yubi key and replace the key if it is lost/stolen. Similar to how they process driver licenses or passports. This service is optional and would actually cost money. I would gladly pay a monthly fee for this peace of mind.

1. Somebody loads fakebank.com.

2. It pops up a username/password screen. The user types in their credentials for realbank.com.

3a. The owners of fakebank.com use your creds to log in to realbank.com and are presented with a TOTP page.

3b. fakebank.com loads another page that asks the user for their TOTP. The user enters it, still thinking they are logging in to realbank.com

4. The owners of fakebank.com use the TOTP to authenticate as the user with realbank.com.

Entire SDKs to automate this are sold on the black market.

With just a SIM swap, isn't it possible for an attacker to reset the password on your main email account (e.g. gmail) via the phone, then from there reset the password on your money account through the stolen email?