Too bad there are those that still only allow SMS, e.g. Sony. Patreon used to be the same.
Sony allows TOTP.
Tell HN: SMS-based two-factor authentication is not secure
51–60 of 291 posts
Re: Tell HN: SMS-based two-factor authentication is not secure
#52Not only is SMS two factor authentication not secure, it weakens the security of accounts it is enabled on. Experts know this (because it's obvious) but large companies like Google continue to insist on using it either because they like the data collection or because they're just covering their asses.
I'm not sure it's true that Google insists on using it. Sure, they'll use it as a second-factor by default - but you're not obligated to use it, can use app-based authentication, and can use MFA with a hardware key too.
Re: Tell HN: SMS-based two-factor authentication is not secure
#53SMS 2FA isn’t secure, but what about a small retail/delivery business that uses SMS as the only means of authentication?
Payment is not done over SMS but separately through cash or Venmo, so it seems like the worst that could happen is a delivery gets nefariously ordered for someone who didn’t want it.
Re: Tell HN: SMS-based two-factor authentication is not secure
#54It all boils down to the fact that the states don't have a reliable identity verification system. Can't securely recover accounts, have to resort to silly 2FA methods, and so on.
Re: Tell HN: SMS-based two-factor authentication is not secure
#55Earlier quoted context omitted.
Why cancel your old phone number in that country when you still have a bank account there? I suggest a bank which doesn't suck, such as bunq.
Maybe they didn't know they needed a phone number to maintain access to the account? Let's not blame the victim here.
The bank is at least equally at fault, if not more so.
Re: Tell HN: SMS-based two-factor authentication is not secure
#56Earlier quoted context omitted.
If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…
> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.
And the site has to support U2F. U2F is a great standard but almost none of the businesses I interact with support it. There are maybe 3 banks in the US that support it, but not mine.
Re: Tell HN: SMS-based two-factor authentication is not secure
#57Earlier quoted context omitted.
> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.
SMS is better than nothing, but you have a bunch of other better fallback alternatives before you should rely on it. You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person). You can have online push login approvals. You can have a TOTP code generator.
> You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person).
How many services do that today? And since so few people have fallbacks what is their recovery process like? Because the hackers will find the weaknesses.
Re: Tell HN: SMS-based two-factor authentication is not secure
#58Earlier quoted context omitted.
> In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.
> Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability. So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.
A phone's TPM is the only U2F token that 99% of the world owns, assuming they own one at all.
Re: Tell HN: SMS-based two-factor authentication is not secure
#59Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.
The option for a delay of is great. The option of adding a custom security question/password etc. is even better. The option of completely turning off recovery is also great. The ability to have your solution on multiple devices without a need for a mobile phone number based recovery is great as well.
I hate it that Twitter forces you to enter a mobile phone number even when you set up an authenticator code generator as 2FA.
Oftentimes the weakest link in most of these services is the account recovery part.
When we set up the self service account recovery in saas pass password manager and authenticator we added all of these customizable options to mitigate against potential SIM Swap attacks.
Re: Tell HN: SMS-based two-factor authentication is not secure
#60I forgot to include this in my original post. I use the Microsoft authenticator application to authenticate my account. My mistake was also including my mobile number as an alternative way to authenticate my account. I don’t know if I was aware of this or if Microsoft prompted me for my phone number at one time and I did not think through all the ramifications.