Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#41

Post by staticassertion »

darkwater wrote: post #34
staticassertion wrote: post #26

Earlier quoted context omitted.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

> In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.

> Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.

So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.

Re: Tell HN: SMS-based two-factor authentication is not secure

#42

Post by ascar »

StavrosK wrote: post #17
teekert wrote: post #11

Earlier quoted context omitted.

Can you explain how I'm weaker with 2FA via SMS than without 2FA? I agree SMS is not good 2FA but your statement is more extreme.

Because companies routinely and silently use SMS 2FA as SMS 1FA.

But that's not an inherent problem of SMS 2FA. It's just bad implementation.

Re: Tell HN: SMS-based two-factor authentication is not secure

#43

Post by [deleted] »

Zolt wrote: post #14
teekert wrote: post #11

Earlier quoted context omitted.

Can you explain how I'm weaker with 2FA via SMS than without 2FA? I agree SMS is not good 2FA but your statement is more extreme.

If I didn’t have SMS-2FA enabled, they would not have been able to take control of my email address without guessing the password.

[deleted]

Re: Tell HN: SMS-based two-factor authentication is not secure

#44

Post by rocqua »

jsnell wrote: post #35
staticassertion wrote: post #26

Earlier quoted context omitted.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch. For most of the world, SMS is it. The Nordic countries have th…

> Some form of trust that can be bootstrapped again from scratch.

This is not using it as a second factor. It is using it as the only factor. Having SMS as the only factor is not purely additive. As such it can (and obviously does) reduce security.

Account recovery is hard, SMS is quite usable there, but way to insecure to be the only basis for bootstrapping account recovery.

Re: Tell HN: SMS-based two-factor authentication is not secure

#45

Post by stavros »

ascar wrote: post #42
StavrosK wrote: post #17

Earlier quoted context omitted.

Because companies routinely and silently use SMS 2FA as SMS 1FA.

But that's not an inherent problem of SMS 2FA. It's just bad implementation.

No, the inherent problem of SMS is that it can be stolen/redirected. Given that, and given that companies are too eager to use it as 1FA, you shouldn't use it.

If I'm giving advice to companies, I say "don't use SMS 2FA as 1FA" (well, I actually say "don't use SMS 2FA at all, it's too tempting for a support person to use it as 1FA"), but this thread is about the user, and as a user, you shouldn't use SMS 2FA.

Re: Tell HN: SMS-based two-factor authentication is not secure

#46

Post by rocqua »

Zolt wrote: post #7
UncleMeat wrote: post #4

That isn't 2FA. That is a single factor recovery process. SIM-swapping only defeats SMS-based 2FA if the attacker also has your password, which is difficult to accomplish if you are using good passwords that are unique.

I had to remove this detail from my original post as it was too long: Boost mobile is negligent and not following industry standards. Their whole security model is based on a 4-digit pin. At first I thought somebody had a script working its way up through all the combinations at the login screen, but I no longer feel that is the case. The fact that at least nine of us had this same issue within days makes me think th…

Does coinbase really allow account recovery with just an SMS? It seems to me like the attacker must have had more than just control over your SMS number.

Re: Tell HN: SMS-based two-factor authentication is not secure

#47

Post by Wowfunhappy »

staticassertion wrote: post #37
Wowfunhappy wrote: post #29

Earlier quoted context omitted.

> the fact that it can actually reduce your security is very problematic. The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP.

> The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP. I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else. Every piece of information the attacker can get is valuable for forging auth. What SMS is good at is being available. At this point cell phones are…

> I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else.

So it's better to not consider that information at all?

What is better? (1) Requiring a password to login or (2) Requiring a password and a code sent via SMS?

The problem you're describing is that services accept SMS in leu of other forms of verification, such as an actual password. Personally, I would very much like it if I could turn off any and all forms of "I forgot my password" flows. There should at minimum be a one-week waiting period or similar.

Re: Tell HN: SMS-based two-factor authentication is not secure

#48

Post by Ensorceled »

ThePowerOfFuet wrote: post #23
bszupnick wrote: post #10

Not only is it not secure, it's not a constant for everyone. I moved countries and I am now locked out of my bank account abroad since they verify logins via OTP over SMS.

Why cancel your old phone number in that country when you still have a bank account there? I suggest a bank which doesn't suck, such as bunq.

Maybe they didn't know they needed a phone number to maintain access to the account?

Let's not blame the victim here.

Re: Tell HN: SMS-based two-factor authentication is not secure

#50

Post by rocqua »

swiley wrote: post #6

Not only is SMS two factor authentication not secure, it weakens the security of accounts it is enabled on. Experts know this (because it's obvious) but large companies like Google continue to insist on using it either because they like the data collection or because they're just covering their asses.

The unstated point here is that SMS as a second factor very often leads to companies using SMS as an alternative factor. This is what makes giving companies your mobile number for SMS 2FA a risky proposition.
Post reply on HN