Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is using SMS bad for 2FA?

news.ycombinator.com

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Why is using SMS bad for 2FA?

#21

Post by PranavBerry »

ViViDboarder wrote: post #20
PranavBerry wrote: post #16

Earlier quoted context omitted.

> FIDO Alliance is doing with WebAuthn Yes I looked into it, but it looks like WebAuthn does not support multiple devices (let me know if I am wrong). What if I want to login from two different devices? I don't think that is possible with WebAuthn, but using my authenticator you can login to multiple devices. You will also be able to add a recovery email address to my authenticator to recover your accounts if you pho…

Yes it is. I can plug my Yubikey into as many laptops as I would like. > You will also be able to add a recovery email address to my authenticator to recover your accounts if you phone gets damaged/lost. This worries me. That means I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy. All my 2FA is on my Yubikey.

> plug my Yubikey into as many laptops as I would like.

What if you don't own a physical key?

> I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy

This is optional. You can choose not to have a recovery email. Just curious though, what do you do if your Yubikey gets stolen/damaged/lost?

Re: Why is using SMS bad for 2FA?

#22

Post by toast0 »

SMS has poor end to end security. It's not end to end encrypted, and there's no guarantee of effective transport encryption, and the parties involved may not be trusted.

In the common case, the sender will submit an SMS to an aggregator. The aggregator may send it on to the carrier's gateway, or another aggregator or a 'grey route'. Grey routes are usually things like gsm modems or automated phones with consumer oriented service plans. The carrier's gateway may be operated by a third party, and is hooked up to the internal messaging system.

Generally speaking, all of these points log message content for a significant amount of time, and often logs are available in near real time. That's potentially a lot of people who have legitimate access to view the messages in real time; if any of the points in the message flow have a security issue, your messages are vulnerable. And the message flow is opaque.

Sometimes, the over the air part of the messaging isn't well encrypted either, so being in the right place with the right equipment gives you access to the codes, without any insider access.

With respect to your idea... If I'm a common person with one phone and no other computing devices, how do I scan the QR code on the screen from the app I want to login to with the app you've provided. Also, when I lose/drop/etc that single device, how do I get my account back? Account recovery that relies on users to take proactive steps tends to be low success. This is the hard part, and where SMS as 2FA tends to do well; account recovery is outsourced to the phone companies of the world.

Re: Why is using SMS bad for 2FA?

#23

Post by PranavBerry »

toast0 wrote: post #22

SMS has poor end to end security. It's not end to end encrypted, and there's no guarantee of effective transport encryption, and the parties involved may not be trusted. In the common case, the sender will submit an SMS to an aggregator. The aggregator may send it on to the carrier's gateway, or another aggregator or a 'grey route'. Grey routes are usually things like gsm modems or automated phones with consumer orie…

>If I'm a common person with one phone

I had not thought about that but I think I can add push notifications if this is a problem. So on your phone you just tap the login with my authenticator button and approve the push notification in my authenticator app.

>how do I get my account back?

You can optionally add a recovery email.

Re: Why is using SMS bad for 2FA?

#25

Post by warrenm »

Problems with SMS:

- it's best effort: message may (or may not) be delivered; they may (or may not) come in order; they may (or may not) be timely

- SIM stealing/swapping is not hard

- it's all plain-text

- if you fatfinger the phone number, your auth code goes to the wrong place

Re: Why is using SMS bad for 2FA?

#26

Post by warrenm »

>To login, you just scan the QR code from my authenticator and enter your phone's pin or use Face/Touch ID

Others see the problem with having to scan your QR code while using the device that, presumably, needs the QR code scanned ... you've just mandated multiple devices

You might look at SQRL (https://www.grc.com/sqrl/sqrl.htm)

Or just use "normal" TOTP systems like the myriad authenticator tools already out there

Re: Why is using SMS bad for 2FA?

#28

Post by ViViDboarder »

PranavBerry wrote: post #21
ViViDboarder wrote: post #20

Earlier quoted context omitted.

Yes it is. I can plug my Yubikey into as many laptops as I would like. > You will also be able to add a recovery email address to my authenticator to recover your accounts if you phone gets damaged/lost. This worries me. That means I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy. All my 2FA is on my Yubikey.

> plug my Yubikey into as many laptops as I would like. What if you don't own a physical key? > I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy This is optional. You can choose not to have a recovery email. Just curious though, what do you do if your Yubikey gets stolen/damaged/lost?

I have a backup Yubikey as well as backup codes stored in an encrypted file and backed up to several different devices.
Post reply on HN