Comment by hansvm | Hacker News Reader

Comment by hansvm | Hacker News Reader

Parent Full thread

> or preferred

I just made a new Google account a couple hours ago, and it definitely looks like the preferred mechanism.

- There's one stage in the signup flow you can't bypass without SMS (granted, it doesn't automatically save that number to the account if you opt out, so that's nice).

- When setting up 2FA you're given giant messaging encouraging you to use a phone number. There's tiny text for other 2FA options.

- Those other 2FA options don't actually include TOTP. To enable TOTP you have to enable a "primary" 2FA solution (SMS, hardware key, or push notification), then enable a "secondary" 2FA solution (which can include TOTP), and if you're concerned about the shitty security SMS provides you then need to remove that as a 2FA option.

Edit: Mind you, it's probably reasonable given the state of the rest of their ecosystem to not have TOTP as the 2FA for your Google account (like if you have a chicken and egg problem trying to get into an android device with a TOTP app), but TOTP doesn't seem to be anywhere near as preferred as SMS.

That, and they do support hardware tokens out of the box (even if the UI doesn't make that super clear), so that's a step in the right direction.

Even though TOTP is provably safer than SMS, it looks like the reason why they want SMS/push as a "primary" is so that they can suck in more phone numbers, since hardware keys have an additional cost that most people won't have. Phone numbers will let them do better ad targeting.

That is Silicon Valley's reason for 2FA in a nutshell. Phone numbers can only be obtained with identification in many countries. It is a privacy nightmare.

It may be safer but it is way less user friendly. If you lose your phone with Google Authenticator (or any competitor), you will lose access to your accounts. You'll need to find your backup codes or go through the process to reset your accounts, which can be very cumbersome. Once someone has to go through this process they won't want to use 2FA anymore, I've seen it happen to many people.

But if you break or lose your cell phone you can just get a new one, and you have access to your 2FA token again immediately. It's much easier for people to work with. Yes it's less secure technically, but that sacrifice is worth it for a lot of people.

You can backup your 2FA TOTP qrcodes to physical cold storage, and you can keep backups. Most non-technical people understand the process of "keep this print out safe + secure"

However you can lose control of your SMS phone number any number of ways that are beyond your control.

It's frustrating that so many providers push SMS as the only 2FA, when there are so many problems with it, and TOTP is provably better, privacy preserving, and much easier to work with.

I don't know if you ever worked with tech-illiterate people, but there is no way that they would print out or write down a list of codes or keep something in cold storage. Hell, even if they know how to. It's too much effort for something like email, and yet they wouldn't realize the importance until it's too late. I personally had to deal with an aging woman who had her online banking password set to her name followed by the year she was born in, and was unwilling to use the USB security key that the bank started providing. There was more than a million in her account. She couldn't be fucked to secure that kind of money with a free-of-charge easy to use key. It was not a case of an elderly woman struggling to remember her password or not understanding how to use it. In her mind she deserved the access to her account just on the merit of it being "hers", and she saw the security as an unnecessary ritual that the bank used as a barrier between her and her money and nothing could convince her otherwise.

That is a fair assessment in some cases, but I have also assisted tech-illiterate elderly folks with bank accounts in non-US banks. Keeping a printed list of codes (one time passwords) was in-scope for accessing the bank online, as well as other silly tricks as an on-screen keypad with rearranged numbers.

I think there is too much emphasis on catering to the lowest denominator to the point of sacrificing privacy and autonomy , rather than raising awareness and education.

There are authenticators out there that can run on multiple devices and have multiple backup and restore options (with SIM Swap prevention) like saas pass.

> Even though TOTP is provably safer than SMS

This seems like it would depend heavily on your threat model, especially keeping in mind that we're talking about second factors here.

For example, one threat is that bad guys gain access to the authentication data of the Relying Party. For example, maybe they find the daily backups are in backups.tgz on the web server for convenient downloading. Or maybe you never changed the password on the MySQL server. This is of course one way bad guys might have everybody's passwords, the first factor...

For TOTP the stored credentials include a "seed" value used to generate those six digit codes, and so by the relying party to confirm your code is correct. So for that credential access threat, the bad guys also have your TOTP codes and you're no better off with TOTP.

Whereas for SMS the stored credentials just include a phone number to send the one use codes to, bad guys having that isn't great news necessarily, but it doesn't actually give them the codes. Even if the one-use codes are stored in the same place as permanent credentials (which they may not be) and thus accessible to bad guys, the bad guys can't necessarily arrange to see them before you use them, and in any case can't arrange for you not to wonder why you're getting all these one-use SMS codes suddenly.

In contrast notably Security Keys don't end up with the Relying Party having any secrets at all, and so bad guys do not learn how to impersonate your users even if they somehow have access to the same means you use to authenticate those users.

Read more about HOTP and TOTP here:

https://en.wikipedia.org/wiki/HMAC-based_One-Time_Password

https://en.wikipedia.org/wiki/Time-based_One-Time_Password

Implementations vary, but TOTP was developed on top of HOTP and presents a standardized method to expire OTP codes.

> There's one stage in the signup flow you can't bypass without SMS

Which impedes the ability to sign up if one does not own a smartphone. I’m sure many people who are unhoused and rely on dumb phones need access to email to apply for jobs. Granted, I’m selecting a niche of a niche, but it’s a prime example of how badly the system is stacked against people trying to claw their way out of poverty.

Feature phones are perfectly capable of sms.

I didn't test this very much with the current Google flow. I know FB and whatnot require a post-paid cell plan (i.e., with your name attached) at that portion of their sign-up flow, and that precludes a lot of the cheaper phone options.

1) Type of plan as no baring on feature vs smart phone.

2) Maybe pre-paid plans are contract based.

> There's one stage in the signup flow you can't bypass without SMS

You used to be able to make gmail accounts without a phone by using an Android TV device. I wonder if that still works.

It's because people lose access to their phone number rarely. It would be pretty much expected for somebody to not realize their Google Authenticator codes aren't backed up before losing/selling their phone or losing their Yubikey before backing up the private key off it. As somebody who doesn't use SMS 2FA, I still think it's a great middle ground for the average user.

Untrue. Particularly in emerging economies where prepaid is much more common, it’s quite normal for people whose phone becomes unavailable to just buy a new one with an entirely new number and just tell everyone their number has changed.

Then they wouldn't use their temporary number for 2FA. But for a lot of people they have their number for decades and are not going to suddenly lose it as easily as you can drop your phone into the ocean.

emerging economies don't have number porting?

They do, but a lot of people don’t bother and just get a new number along with the new phone.

They finally updated Google Authenticator to enable backups and transfers between devices in December last year.[1] Also, there are other 2FA apps like Authy that are more user friendly and have been transferrable for years now.

However, I think you do have a point. The attacks that rely on intercepting SMS messages are cumbersome and are really feasible only for high value targets.

[1] https://www.androidpolice.com/2020/05/07/google-authenticato...

> The attacks that rely on intercepting SMS messages are cumbersome and are really feasible only for high value targets.

Depends on your definition of cumbersome, but it can be done fairly trivially[1] if you know what you’re doing.

[1] https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

The recommended alternative to Google’s proprietary authenticator is MIT-licensed andOTP. The app is also available on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

Reply on news.ycombinator.com