Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#81

Post by iso1210 »

raesene9 wrote: post #75
addingnumbers wrote: post #72

Earlier quoted context omitted.

The problem is with most online services, the only second factor allowed is SMS. If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably. It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use…

I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.

What's the recovery process when your phone gets stolen, or you drop it?

Re: Tell HN: SMS-based two-factor authentication is not secure

#82

Post by UncleMeat »

raesene9 wrote: post #8
jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the ac…

TOTP is phishable, which is a way way way more common attack than sim swaps.

Re: Tell HN: SMS-based two-factor authentication is not secure

#83

Post by addingnumbers »

raesene9 wrote: post #75
addingnumbers wrote: post #72

Earlier quoted context omitted.

The problem is with most online services, the only second factor allowed is SMS. If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably. It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use…

I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.

A bad second factor is better than no second factor.

I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.

Re: Tell HN: SMS-based two-factor authentication is not secure

#84

Post by UncleMeat »

headmelted wrote: post #52
swiley wrote: post #6

Not only is SMS two factor authentication not secure, it weakens the security of accounts it is enabled on. Experts know this (because it's obvious) but large companies like Google continue to insist on using it either because they like the data collection or because they're just covering their asses.

I'm not sure it's true that Google insists on using it. Sure, they'll use it as a second-factor by default - but you're not obligated to use it, can use app-based authentication, and can use MFA with a hardware key too.

Yup. My Google account will not use SMS as a recovery method. U2F with backup codes is all I have enabled.

Re: Tell HN: SMS-based two-factor authentication is not secure

#85

Post by indymike »

This is really interesting because of a few things:

* SMS authentication is not the same thing as 2FA, but people think that it is.

* SMS account recovery is convenient for the bad guys.

* The fact you got a welcome text from Metro PCS. If that was sent to your Boost device, someone from TMobile (they operate the networks that both Boost and Metro ride on) needs to take a look as that should not have been able to happen.

* In order to port a number you have to know the account security question's answer. Boost does have this. Was this bypassed?

Re: Tell HN: SMS-based two-factor authentication is not secure

#86

Post by esolyt »

Wowfunhappy wrote: post #22
staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I'm glad someone is bringing this up.

I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

Re: Tell HN: SMS-based two-factor authentication is not secure

#87

Post by profsnuggles »

addingnumbers wrote: post #83
raesene9 wrote: post #75

Earlier quoted context omitted.

I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.

A bad second factor is better than no second factor. I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.

If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.

Re: Tell HN: SMS-based two-factor authentication is not secure

#88

Post by fulafel »

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

This kind of arrangement is often mockingly, but accurately, called 1/2 factor authentication.

Re: Tell HN: SMS-based two-factor authentication is not secure

#89

Post by addingnumbers »

profsnuggles wrote: post #87
addingnumbers wrote: post #83

Earlier quoted context omitted.

A bad second factor is better than no second factor. I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.

If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.

You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.

Re: Tell HN: SMS-based two-factor authentication is not secure

#90

Post by artificialLimbs »

lazide wrote: post #78
artificialLimbs wrote: post #70

Earlier quoted context omitted.

I've signed up with voip.ms, which provides me a pay as you go sms number for basically $0/mo. since I only use it for auth.

Many services go out of their way to detect and block the use of VoIP numbers for SMS auth :s

What's the reasoning behind that? Maybe to prevent bots?
Post reply on HN