Hacker News Reader

Comment by willow9886 | Hacker News Reader

There's always going to be a trade off between security, usability, and price. Physical keys are clearly more secure, but also come with increased price and some usability issues (e.g. if you don't have your key you're screwed). But as Google's research demonstrated, there are also usability issues with SMS OTP (3% avg failure rate vs 0% avg failure rate with keys).

Net-net, it depends on how sensitive the data is that your are protecting, and whether you prefer increased security or ease of use.

View on HN

Given that NIST now explicitly says you shouldn't use SMS for 2FA, I'm not sure why we're even trying to compare U2F to SMS OTP. It's just not a useful comparison at all. Any company that is even considering supporting U2F should already be offering non-SMS-based OTP anyway.

For the vast majority of users who are not the targets of government attacks, SMS OTP is still a huge win for account security. Alex Stamos put it well:

https://twitter.com/jonoberheide/status/804363754842554375 "Nothing < SMS < Push < U2F"

https://twitter.com/alexstamos/status/804367695860744192 "Seems like the right ordering, but when deployment is 98% < 2% < .5% < .01% complaining about SMS security is pretty silly."

The security of these is actually somewhat DUE TO the low adoption rates. If all of my consumer services have SMS 2FA, attackers will currently just move on to the next account in their list. It's similar to the spam game: it doesn't have to be perfect, just enough to make it not economically viable to spend the time required to crack it. Once everyone has SMS 2FA, I'll move on to push or U2F and be ahead for another decade or so. It's just important that people are given an option, so lazy / don't know any better consumers can do the easy thing and get their accounts stolen, while people who actually care / know enough to know they should care can stay somewhat safer. The unbalance is unfortunate, but until we figure out a way to ACTUALLY secure things which companies will get onboard with (related: the US uses chip cards now...but still only requires a signature facepalm) staying one or two steps ahead of the general population makes you pretty safe against everything except targeted attacks.

SMS-based 2FA doesn't stop phishing, which is a significant security benefit of U2F.

State actors aren't the only ones threatening the security of SMS OTP.

OK...but Google and my bank still use OTP over SMS to two-factor authenticate me. So clearly there's room for discussion and evangelism here. NIST can say that pigs fly, but until I see it in the wild I'm going to take it with a grain of salt.

Just so you know, you can also use Google Authenticator if you really dislike SMS. Make sure to back up those emergency keys though, and read about encrypting your iTunes backups so it'll actually back up the GA settings.

Even better is to buy a Yubikey, for those services that already support U2F use that. For those that do not, use the Yubico Authenticator and your Yubikey over NFC. You care one key around and no secrets are ever on your phone.

If the bank doesn't support RFC 6238 OTP, Google Authenticator will not help.

Reply on news.ycombinator.com