Security Analysis of SMS as a Second Factor of Authentication
queue.acm.org
queue.acm.org
On stripe, I use a security key. Someone has to either steal my keyring, or steal my backup key.
But I'm force to leave SMS on as a fallback, so really, the weakest link is there, and a potential cracker only needs to break this extremely fragile insecure system, and completely bypass the security key.
This smells similar to banks not needing to check check signature anymore.
That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and FIDO tokens for systems people, but for institutions with thousands or tens of thousands of employees, SMS 2FA is still economical and will still be with us 5-10 years from now. It's the new passwords.
The smart thing would be for MSFT/o365 to give you the option to switch to a TOTP token and other authenticators with a better experience so people can switch organically. Most security people still don't distinguish between authenticators and identities, as federation concepts like identity providers are still in the rarefied space of enterprise. Identity isn't well thought out either because it's a legal concept, and like most tech risk and liability, if anyone read the fine print they'd never use it.
SMS 2FA is basically a ritual that allows people to agree to ignore risk.
Trying to teach my parents now to use a Authy, Google Auth, 1Password, LastPass is pretty much a non-starter. I'd be getting calls every other day.
SMS 2FA allows my parents to considerably shrink their attack surface without a high barrier to entry.
what is meant by "unionized" here? It doesn't seem to be related to labor unions.
If an employer wants employees in a bargaining unit to use their own mobile devices and install a TOTP app on them, employer has to pay, and then the responsibility for it working needs to be established. In normal environments, you just say "we use this here," and users figure it out. If it's organic bottom-up adoption based on the option, it works, but if you impose a change, it creates admin overheads.
tl;dr -- unions aren't all alike, and don't all bargain over the same issues.
Everyone has a 2nd email, personal + work or school.
You could argue that both emails are probably accessible from an email app on the phone, but if the phone is stolen, then that's no worse than SMS or ToTP apps also on the phone.
You could argue password reuse, but if the address used for 2FA is never exposed to the end user after being set+verified, then the attacker would have no way of knowing the victim's 2nd email address.
Unless the attack is targeted... But if the attack is targeted, then we're back to SMS being vulnerable.
So, what it comes down to is 2nd email as 2FA is more secure and more efficient than SMS out of the gate... (and much cheaper)...
And, if I use a very obscure and otherwise not used email (with its own security + strong password), even a targeted attack has no better chance than a ToTP app on an offline device, like an iPod touch.
So:
- 1st.) ToTP on offline device (most secure, most expensive, most difficult to learn, hard to use),
- 2nd.) 2nd email (can be most secure, cheapest, easiest to learn, easiest to use), and
- 3rd.) SMS (least secure, mid-expensive, mid-learnability, mid-usability).
Why didn't we all default to 2nd email then, instead of SMS as a paradigm? Actually, was used, and still used by Gmail from the beginning (even in conjunction with ToTP now)...
1) Getting a mobile phone number seems much more difficult than getting an email. It provides some amount of country verification: If a service runs for let's say Danish people, then they can expect the phone number to be a +45.
2) taking over someone's email seems much more easy than taking over someone's phone, since many people reuse same password everywhere, then if you already have the password of the service requesting the OTP, good chance is that you also have the email password. The email address is not hard to find if attacker has password to the first email too. Hoping for security by obscurity (i.e. the 2nd email is now a "secret") isn't great.
3) physical security: without sophisticated attack, SMS can only be received on the actual user mobile phone, even if a phone with no passphrase. "If the phone is stolen" isn't a realistic scenario against a scammer on another continent.
Also from a theoritical point of view: it's a completely different communication channel, so if someone has somehow taken over the first channel (via some malware running on the email client/computer), then they still need to take over second channel. So for instance, if a USPS snail mail wasn't so slow (or you don't need the OTP code right away), even if really insecure, it'd be better than 2nd email, as it follows same benefits as SMS.
> Also from a theoritical point of view: it's a completely different communication channel, so if someone has somehow taken over the first channel (via some malware running on the email client/computer), then they still need to take over second channel.
...is a very good point. Although, (without any data to back up this claim), I would think most users with a compromised device have a fully compromised device.
Edit:
> Hoping for security by obscurity (i.e. the 2nd email is now a "secret") isn't great.
To clarify, that's not exactly the point. If the attacker discovers the value for the phone number or 2nd email (through a data breach), then it becomes targeted, which brings us back to the security of SMS vs email (the parent article).
It already does, both through an app notification using the Microsoft Authenticator TOTP app, as well as through the app-agnostic TOTP method. (Just checked my own settings.) It's just not the easiest thing to find the settings page where you do it, because Microsoft helpfully hides it behind "advanced security options" instead of just putting it next to the "change password" UI like the other major sites do.
> Most security people still don't distinguish between authenticators and identities, as federation concepts like identity providers are still in the rarefied space of enterprise.
Who are you counting as "security people" in this case? I feel like the distinction for that kind of thing has been around for a long, long time, as evidenced by SSH public key configs and Active Directory certificate based login configuration both allowing multiple keys/certs per user, or Github allowing multiple keys as access tokens, etc. If we're talking about OTP keyrings issued by banks to consumers, again I don't think those things have been equated to identity as much as being treated like a second key for a second lock on the same door.
This isn't true. You can bulk phish SMS, TOTP and the push confirmation stuff. Software to do this isn't theoretical you can just download it ready to use, because in each case you only need to fool a human into believing this is really their bank/ web mail/ government/ etc.
If you want to get rid of the opportunistic stuff you need technology like WebAuthn that makes it simply not work.
This is really the key issue here. Passwords are fine if you give people some place to keep them.
>...it became widely acknowledged that passwords should be highly complex in order to maximize their entropy and, thus, substantially increase the amount of time it would take to crack them.
This is only true if people reuse the same password for different sites. Otherwise the site can rate limit brute force attacks to the extent that even completely trivial passwords are OK.
I dunno, it seems that in most cases second factor auth is not really needed. We need to address the actual problem, not attempt to paper it over by dumping stuff on top. The "let's just let the phone company do the identity stuff" approach is a good example of failing to deal.
TOTP, while not perfect, is an improvement. The protocol could be improved to provide protection against proxy attacks, but the point I'm trying to make is that your regular user can use TOTP. I've successfully set it up for my parents (both closing in on 70years old and are not tech-savvy) and they have no issues using it.
Personally I use a hardware U2F key everywhere I can. With the newest version of Safari Tech Preview _finally_ supporting U2F, I'm hoping we see some deeper market penetration.
However most people I know have browser sync set up. They are using it for passwords. It would be great if it could manage a security token for them and allow authentication to websites without risk of leak.
Same for companies a lot of the time.
Are there any cheaper, but still reliable hardware keys nowadays?
"This article provides some insight into the security challenges of SMS-based multifactor authentication: mainly cellular security deficiencies, exploits in the SS7 (Signaling System No. 7) protocol, and the dangerously simple yet highly efficient fraud method known as SIM (subscriber identity module) swapping. Based on these insights, readers can gauge whether SMS tokens should be used for their online accounts. This article is not an actual analysis of multifactor authentication methods and what can be considered a second (or third, fourth, etc.) factor of authentication; for such a discussion, the author recommends reading security expert Troy Hunt's report on the topic."
Your account got hacked? Not our problem, we have 2FA. Must've been your fault.
Couldn’t disagree more. This is oversimplification of a complex subject.
Should eliminate OTA and SIM swap attack vectors from figure 2.