Let's Ban SMS 2FA

The author seems to assume that security is (or should be) the only consideration in implementing 2FA. When in practice, practicality and convenience are part of the equation as well. While imperfect, SMS 2FA significantly improves security while also remaining convenient.

Instead of suggesting that we put in place legislation banning it (?!), perhaps the author should come up with an alternative solution that provides improved security with the same or better convenience for end users and the organizations using it.

The author has a few assumptions that I think are incorrect.

Not all accounts need the same level of security or protection. SMS 2FA can be a very reasonable option depending on the accounts. No law can make that kind of a decision in a reasonable way. So the law has to be toothless (if it leaves too much leeway) or it will remove a valid option from people.

The usability and the availability of other 2FA are not on par with SMS. The gap is not trivial as the author makes it sound like. Account recovery problem is a very difficult one to fix cleanly for all types of accounts. SMS is still a useful option.

Sim swap attack is multiple orders of magnitude more difficult than credential stuffing. It's not close to the most important attack vector for majority of people. It certainly is not worth legislating a solution for specifically. There are reasonable practical solutions for people who want protection against SMS as 2fa from sim hijacking - e.g. many cell phone providers support 2fa or pin to protect it from the sim attack in most scenarios. It's a much cheaper solution for the society than banning SMS 2fa.

Really though? I get maybe being confused the first time they used it, but you really think they couldn't figure it out?

An authenticator app just has the codes and the sites. SMS has the codes, all the previous codes, all of your other SMSs. Plus the messages come from a 5 digit phone number that has a similar format to the 6-digit code you're supposed to enter. The whole system is byzantine IMO and the authenticator app has a much simpler flow. But, you know, I recognize that not everyone may experience it the same way.

I'm generally curious if people think there's a simplicity to the SMS approach other than just familiarity with something that's awkward.

The real problem IMO is not that it's hard to use an authenticator app, it's that the authenticator app provides an actual secret. There's less of a backdoor, so customers can lock themselves out. The downside of the backdoor is it's a security risk. The upside is that managing private keys is a nightmare and nobody wants to force their customers to actually manage private keys.

This is the most annoying thing about 2FA apps. I once dropped my phone and broke it. It wasn't in a repairable state. Lost access to multiple accounts due to losing 2FA apps. Sometimes, I think security people make them unnecessarily complex just for the sake of it. Not all services need 2FA. And SMS is fine for most of the things.

Honestly?

Let's ban mobile/proprietary devices and related apps, soft-token included. We have smartcards since decades, we have physical OTP tokens, there is no reasons to allow someone else spying on intrinsically insecure platforms for logins.