Ask HN: How can techies influence companies to stop implementing SMS/phone 2FA | Hacker News Reader

Ask HN: How can techies influence companies to stop implementing SMS/phone 2FA

100 pointscodegeek146 comments

We are tired of the risk that SMS 2FA brings. Most of us have gotten smart enough to not use it but some companies (financial institutions especially) only have SMS based 2FA even in 2022.

Then, there are some shady ones that force you to enter a phone number even for non SMS/TOTP based (looking at you sendgrid)

People losing access to their phone is a scenario and puts users at significant risk of losing access to key accounts. I am not even talking about the security risk SMS 2FA brings which of course it does.

The worst part is that even now, companies are implementing it as a "updated security measure". Who are these people in the tech. departments making these decisions ? It is beyond ridiculous and why can't there be someone who understands that this needs to stop. I know most common people have no idea but there are plenty of us who know what a pain in the ass this is.

Is it time to try and force a legislation through Congress because I don't think these companies give a shit until forced to.

View on HN

This is the most naive take on HN. The only secure computer is one that's been unplugged and buried in six feet of concrete, everything after that is a compromise

The real world security issues that companies face are things like:

  - users that re-use tiny passwords written on post-it note that's attached to their monitor
  - regulated industries that don't allow them to actually lock a user out, which causes leaky social engineering flows for their help centers
  - users that constantly forget their passwords, and have terrible forgotten password questions/answers
  - passwords they share with a friend/partner, that they then have a falling out with

The reason SMS 2FA is popular, is because the average use case is that the user's (reused and/or weak) password was captured somewhere, and this protects the user from simple attacks to their account where the password is known. It's just like the pin code for most modern smartphones: just secure enough to keep the average person out if their phone is lost or stolen

"But Joe, having a more secure system isn't that much harder on the user and is infinitely more secure". I promise you, it is that much harder. Most users can barely understand/handle SMS 2FA. Remember, we have to force users to not use trivially simple passwords like 'password'. Shoot, companies like AOL still derive monthly subscription fees because it's too hard for people to figure out how to change email providers

My bank wanted me to verbally give them a new password (with various constaints like uppercase, lowercase, symbols, at least 12 characters) over the phone, having already identified with a dozen or so personal bits of information.

Apparently it was perfectly secure because to use it I also need an SMS

Yikes. You should get a new bank. There are acceptable places for compromising security a bit, but reading out your password over the phone and then verifying SMS code also over the phone is definitely not one of them.

I hear you. However, don't force it on me then. Why not make it optional and give me a big disclaimer that I assume the risk if not signing up for that SMS based 2FA ? We already check many boxes. happy to check 1 more.

You are the one forcing your opinion on us. "We are tired". No, you are tired.

> give me a big disclaimer that I assume the risk

Are you (and everybody else who ticks this box) going to pay for the company’s time dealing with the resulting tech-support phone calls? You might be willing to assume the risk for your own data, but for the company to offer this option, you also need to assume the risk of increasing their operating expenses

> The reason SMS 2FA is popular, is because the average use case is that the user's (reused and/or weak) password was captured somewhere...

People are not disputing the effectiveness of 2FA. They're saying that SMS is not a reasonable way to implement 2FA.

All my banks' websites in Europe (I've got several) are requiring the use of a physical device, provided by the bank, and protected by a PIN. I need to use such devices both to log in and to confirm wire transfer / stock buys / etc.

U2F keys like Yubikeys and physical 2FA devices like those provided by my banks are way better than SMS 2FA. Why not strive towards that instead of saying that SMS 2FA is popular for reasons and that nothing can be done about it?

Physical 2FA devices impose a significant price burden on folks who don't have a lot of disposable income. Imagine scraping by to pay rent from your minimum wage job, and you're told that you can't sign up for $SERVICE because you don't have a new enough phone or a yubikey.

Email 2FA works just fine. Set a long, secure password for your email account. Trust that your email provider won't allow anyone to brute force their way into the account. Don't use that email for any other accounts. Bam, security is fine.

Stop trying to force more and more purchases and apps down other people's throats. Maybe I don't have a smartphone or a yubikey. I should still be able to use services, especially when many of them are required to function in society today.

Italy here.

A couple of my banks let me login by confirming my identity with a fingerprint on my phone, in their app.

Another one still supports their old 6 digits OTP generator, but also has the app with the fingerprint authorization.

Mastercard does key6 but they or my bank also send a SMS with a numeric code.

Paypal sends an SMS with an OTP.

It seems that nobody wants to spend money on hardware here.

The parent did refer to banks giving them to people. I just got a USB one in a swag bag at an event from Google so I guess they're pretty inexpensive these days. But I don't disagree with the basic point. Most everyone has a phone and won't carry around a separate hardware device in general irrespective of price.

Yeah, of course I won't do that because I might lose that device and it takes space, times the number of banks giving me their own hardware.

I keep my hardware key generator at home. I need it only to perform some operations from my computer. Everything I do outside home is with the phone, which funnily is its own 2FA device. Banks and regulators accept that for the sake of convenience.

> I promise you, it is that much harder.

Than TOTP? Than email? The problem with SMS is that it adds additional vulnerabilities through sim jacking. Every other 2FA method is tied much more strongly to an identity.

> Than TOTP?

Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device.

> Than email?

Probably not much better than email for most users, but I guarantee for a large subset of users the SMS experience is better. With email you need to go to a separate app/page on the same device, with SMS you get a notification on a separate device or a notification popup on the same device (that usually lets you easily copy the code). Again, I totally agree that SMS has issues, but people arguing against it should spend some time in a usability lab with non-tech people - the kind of issues they hit will blow your mind.

> The problem with SMS is that it adds additional vulnerabilities through sim jacking.

Then fix the SIM-jacking problem. Which, I'll note, phone companies have made a lot of improvements in making this harder, and in the US government has gotten involved in making this harder.

Most importantly, note that SIM-jacking is really just a "how do we verify someone who lost a device" problem. That exact same problem exists with TOTP and hardware keys. All we really need are uniform guidelines for proving identity when a device is lost so you're not at the mercy of some low-paid, outsourced service rep to keep your account secure in the face of a persuasive bad guy.

> Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device.

You can store your backup codes in any number of ways. The easiest being to just download them and have them automatically backed up to Google Photos/ iCloud.

> Again, I totally agree that SMS has issues, but people arguing against it should spend some time in a usability lab with non-tech people - the kind of issues they hit will blow your mind.

I don't really care about usability when the solution is strictly worse than doing nothing. Like, to be clear, users would be safer without SMS if they just used a unique password. SMS is a terrible solution that really only solves "you used the same password across two sites, one of those sites got popped, the attacker doesn't have access to the common tooling to phish your SMS, and you can't figure out how to use email apparently".

> Then fix the SIM-jacking problem.

It's a lot harder to fix "make SIM recovery safe" than it is to fix "make email recovery safe" because phone numbers transfer all the time and emails rarely do. Further, almost all account recovery ends up falling back to email natively, so there's no additional attacks added.

At the end of the day:

1. Every modern browser supports a synchronized password manager, which makes all non-FIDO2 MFA basically useless

2. SMS 2FA adds additional attack surface through SIM jacking

3. Every modern phone is a FIDO2 compatible token

SMS 2FA is simply a technology that has no place. Attacker tooling has already started to adapt to non-FIDO2 MFA so the time for that approach is just over, the best thing we can do is stop pushing for adding new vulnerabilities just to fail to solve a problem that has trivial solutions.

In short, it adds nothing over other techniques and it strictly increases attack surface.

> SMS is a terrible solution that really only solves "you used the same password across two sites

Right. That’s the sole purpose. People pick bad passwords and reuse them, but you already know that.

As much as tech tries to make this easy people, it’s a horse-vs-water problem. Even smart people refuse to use to use password managers. Most of those people have figured out how to receive text messages.

Seriously, go find someone who owns a JitterBug phone and watch them create a new account on the website of your choice. We’ve got a long way to go.

Instead of pushing a non-solution that trades one issue for another we should be educating people on password managers. Every major browser has built-in password management.

>> Yes, absolutely. Recovering lost TOTP keys in a secure way is a difficult problem, and this happens all the time when people get new phones. With SMS the code is tied to your account, not the device.

> You can store your backup codes in any number of ways. The easiest being to just download them and have them automatically backed up to Google Photos/ iCloud.

As soon as the lost TOTP keys was mentioned, this is exactly the type of response I was expecting, and it shows how far out of touch tech people are with “normal” people.

MFA login is needed because general people are so bad at managing their passwords (using simple ones, re-using ones that have been leaked, etc) that the tech side had to just give up asking and start forcing everyone to use what is essentially a one time password.

If users were conscientious enough to know how to store backup codes, etc, then we wouldn’t have the problem of bad passwords to begin with. So you’re expecting people with bad habits in one area to magically have good habits in another area that only exists because they couldn’t properly solve the original problem.

> So you’re expecting people with bad habits in one area to magically have good habits in another area that only exists because they couldn’t properly solve the original problem.

Not really, no. I'm actually advocating against non-FIDO2 2FA entirely because a strong password is just as good and every browser has a password manager built in now. 2FA doesn't add security, SMS 2FA makes things worse.

Built-in password managers (at least Chrome's) suck:

1. These days, most people use passwords across browsers and native apps. In-browser password managers don't really support this use case well, at all.

2. At least in Chrome's, you can't manually add a password or add any notes.

3. Sometimes login domains change, and since the password is only tied to the domain (not a generic name), it's easy for passwords to get lost.

Again, nobody is really disagreeing with you that the situation is less than ideal or that there are more secure alternatives. But you seem unwilling to accept that a huge swath of the population sucks at secure password management, which is why SMS 2FA is a "lowest common denominator" option to improve security.

I think the main contention here is that I'd say users should just do nothing. SMS 2FA sucks and it's going to be a horrible tech debt that we're paying off for decades. We have better alternatives that, for a huge number of users, are perfectly acceptable. For everyone else, yes, they will have to use stronger passwords.

I really don't believe that there's some huge cross section of users who simultaneously:

a) Will go through the hassle of enabling and using SMS 2FA

b) Won't go through the hassle of using another 2FA method - email, totp, any smart phone for u2f, or a dedicated token

c) Won't use relatively unique passwords for high value websites, password manager or not

IMO SMS 2FA is, however, likely convincing users that they are safer than they truly are, and gives companies an excuse to do what's easy and not what's safe.

I mean, some banks even hand out hardware tokens to customers. I'd suggest that instead of SMS 2FA being treated as acceptable we add more pressure to improve the other systems, lower their prices, etc. Hardware keys should be effectively free.

The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part.

Having to scan a QR code is too much friction compared to just asking for their phone number which will then send a code that a modern phone OS will then be able to autofill all without leaving the app and going into the messages app to retrieve that code.

Edit: I have 4 YubiKeys and a Ledger Nano S that I use for critical services, such as my Google accounts and domain registrar, and I _still_ use SMS 2FA out of laziness for most services.

> The thing is, SMS 2FA is still way better than no 2FA

You describe using the same device as second factor as the device you use to log in. What's the security benefit in this case compared to a password manager with a strong stored password alone?

If I log onto a webpage my password manager fills in the details on my desktop

If I have SMS, I then get a message on my phone which I have to enter

Thus something hijacking my machine can't log on silently, even if it pulls the password out of my password manager

The security advantage is that an attacker using a completely different device doesn’t have your phone.

Except that SMS messages can be intercepted, e.g. by having a proper access to the SS7 backbone, by abusing services provided for other reasons, or by SIM swapping attacks. All of this has already been done, so it's not just theory.

See e.g. https://arstechnica.com/information-technology/2021/03/16-at..., https://arstechnica.com/information-technology/2017/05/thiev..., https://arstechnica.com/information-technology/2016/08/congr...

Yes, of course, the Ask:HN is basically about that! The parent comment asserted that having an SMS in addition to a password is functionally no different from having a password only. Which is not the case.

For me, the bigger risk of SMS-only 2FA is being locked out of my own account.

I sometimes travel to Iran to visit relatives. For obvious reasons, there are no roaming deals between US carriers and Iranian carriers, so I am unable to receive SMS messages while there. I’ve been bitten several times by websites that see I’m logging in from a scary IP address, and force me to authenticate via 2FA SMS to proceed. Whoops, guess I can’t check my bank account for a month now!

> What's the security benefit in this case compared to a password manager with a strong stored password alone?

Nothing, except the reason companies use SMS 2FA is the vast majority of people still don't use a password manager with a unique strong stored password.

Sure, by all means, I am happy about companies offering SMS 2FA as an option (as long as they don't block VoIP, that is).

What is annoying is making it the only option, or almost as bad, a mandatory recovery option bypassing all other factors.

I think even Google is highly suspect of allowing a bazillion fallbacks to different MFA options.

What’s the alternative, if you don’t want people to get completely locked out when they fuck up?

Agreed.

If you use a password manager to generate a high-entropy password, come up with similarly-secure answers to the “security questions”, and make sure your email is also secure, then SMS 2FA is a significant downgrade to your overall security.

Note that using SMS-OTP as a second factor besides the password/security questions, 2FA is never a downgrade, but using SMS-OTP as a single recovery factor (for a forgotten password) definitely is. Only the latter is a problem.

It’s still a downgrade because it’s an avenue for social engineering the customer service/support reps

Agreed. My day job is in fintech. Our average customer age is > 60.

Explaining 2fa via SMS to that age group is hard enough. Adding authenticators or QR codes into the mix would blow their frail minds.

60 is not old. And I don't think age is particularly relevant here.

Today millions of people are using PSD2 compliant SCA (that should not rely on SMS tokens only) in Europe. Usually implemented by a push notifications that you need to approve using biometrics on your smartphone.

> I don't think age is particularly relevant here.

“What technology you grew up with” is definitely a factor (not the only factor, but a big one) in “what technology you feel comfortable using”.

I used to say that I'm determined to not let technology pass me by with age, but now I suspect that it will happen someday anyway, despite being a technologist. I'm recognizing my aversion to newer, trendy things more and more. I often wonder where the line will finally be drawn and when I'll cross it. Maybe if companies start pushing something like video and gesture-based authentication in virtual or augmented reality, I'll be the old guy saying "you can pry passwords and email from my cold, dead hands."

Why do your other users need to suffer just because you have 60+ people too? How is that for an excuse to not provide better options?

A physical key is much more intuitive than typing a code. It's directly analogous to a locked room.

1. And physical keys get lost all the time. So then you need to solve the "lost key problem", and proving identity then means you're often vulnerable to the same types of things that make sim jacking a problem in the first place (to be clear, though, I think the much bigger benefit of physical keys is their resistance to phishing, not their resistance to sim jacking).

2. Actual physical keys are expensive. The margins on many types of depository accounts are razor thin, and giving everyone a physical key would be significant.

3. So an option to #2 is then to use the physical key built into nearly all smartphones these days. But I can definitely say that, at present, that option still doesn't work that great. Have had loads of problems using a phone key with Google's Advanced Protection, many times bugs on Google's part. Also, this normally depends on bluetooth, which can have a ton of connection issues.

> users are more likely to use it since it requires very little effort on their part.

I use my tablet and laptop way more than my phone. I hate having to walk to another room to pickup my phone from its charger just to get one of these SMS codes. When I'm doing phone support I often hear, "hold on, I have to get my phone" when this step is required.

Setup your laptop and tablet to get SMS messages forwarded to them from your phone.

Good idea but I can't seem to find a built in way to do this. Everything I've found involves third party apps which have all the usual problems that make me not want to use them: permission, ads, in-app purchases, battery drain, etc. Do you know of any way to do this that's already built into Android?

Google Messages and Google Messages for the Web.

> The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part.

(SMS 2FA + Strong Password) is worse than (SMS 2FA + Weak Password).

SMS 2FA doesn't solve phishing and it muddies your identity with a weak, transferable identifier. If you've taken the time to set up SMS 2FA for yourself you could have just used a strong password, especially since password manages are now built into browsers.

At least with TOTP you aren't adding additional vulnerabilities, but frankly most 2FA is pointless unless it's FIDO2, assuming you just use a password manager and use strong passwords.

Techies can best influence by understanding why sms otp is popular and come up with something better.

Not only do you need to understand what shortcoming sms has, but non cynically understand why other solutions are worse.

I kind of feel like this is being done already with Webauthn and Passkeys. Another couple years of user's upgrading/updating devices, and the option to use a passkey may be as ubiquitous as using SMS for MFA.

It will take a while but I'm hopeful that Passkeys--some variant of which has been being discussed for well over a decade--will finally get mainstream adoption. I'm not convinced tokens ever will at least outside of particularly high value accounts.

Can't upvote this enough. People who say "we should all just use WebAuthn" need to understand:

1. Theoretically, they're right

2. Realistically, it feels like they've never interacted with the non-tech public, and all the issues and problems that need to be worked around with hardware keys.

There is a good reason companies are trying to move us to a "passwordless" future, but there is also a good reason they are going very slowly - they know there is no silver bullet.

The best solution I've seen is third-party bank authenticators. Its only popular in Finland (and I think Norway) due to some sort of mandates. It solves the biggest problem of using SMS for this: RECOVERY. If you lose your phone or number, you can stop in to your local bank with your passport and have it reset. They'll actually scan your passport so social engineering attacks won't work.

https://www.nordea.fi/en/business/our-services/mobile-online...

>understanding why sms otp is popular

Exactly this. I bet you'd have less than a 25% success rate of getting the average user to even know that SMS and "texting" are the same thing. Now try to get them to understand what "OTP" is.

Having to register a phone number with a service is bad enough. Forgetting what weirdo password you were forced to come up with--"a capital letter, a special character (but not % or *), and a smiley-face Unicode character"--is bad enough. But for those people who just get a new phone and phone number for whatever reason, now you have to get that changed as well.

The big problems with SMS is 1) it is insecure, and 2) it does not have any sort of guaranteed delivery mechanism. These are problems that are readily solvable with a combined technical/governmental solution. Develop a standard, say "all mobile companies must adhere to this in 12 months," and then use that. Even if it isn't perfect, i.e. somebody finds a small flaw in the implementation, it's better than it is now.

Losing access to a phone means losing access to your TOTP codes as well. So that's no different than losing access to SMS.

TOTP codes can be shared between multiple devices - which makes them less unique than an SMS to a specific MSISDN. Your ability to back up a code doesn't necessarily mean you have the ability to store it securely.

FIDO tokens can also be lost.

I don't know why you're asking for your congress to fix this. You live in a free market, so move your business to someone who you think takes security seriously.

Didn't you hear? Free market's out of style. Goverment mandates and bloated legislation are the new norm.

Changing banks is not free market just like Changing Insurance Companies. Most banks in US enforce SMS 2FA. I would rather want the choice of not doing SMS 2FA. If you cannot implement better 2FA, dont force me to use SMS 2FA and I assume the risk on my end. That's Free Market.

You basically need a backup token of some sort. Which, of course, makes them an even tougher sale to a mainstream audience.

For SMS auth, you can get the cell company to re-issue a sim if you lose your phone. This is a feature and a bug, thanks to social engineering attacks. Also, the SMS transport layer isn't secure.

With TOTP, you can put the TOTP code in your password manager with all your other passwords, which is probably what I will do it it catches on. It's effectively one factor at that point. (Do you know my password manager's password?)

"so move your business to someone who you think takes security seriously."

For banks, it is not that easy and convenient. I like my banks for many reasons except the 2FA thing. Most banks at least in US are still doing SMS 2FA. I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way.

> I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way.

Start a coordinated shitstorm against these banks because of this. Banks (as many companies) are often very concerned about their reputation.

>Banks (as many companies) are often very concerned about their reputation.

Haha. Banks are only concerned about their relative reputation. If all their peers are screwing the consumer, they don't care at all.

https://arstechnica.com/tech-policy/2022/10/zelle-fraud-is-o...

> I am done with the whole "If not happy, move"

That's literally the point of capitalism. Organisations are free to offer any service they like and customers can choose which one best meets their needs. If enough people move to the one offering better 2FA then the others will follow.

Having the government force companies to behave in a certain way sounds dangerously close to socialism to me.

> You live in a free market, so move your business to someone who you think takes security seriously.

Adorable. Please show me a bank, utility provider, brokerage, widely-used P2P money transmission service, and phone provider that each offers WebAuthN (without a mandatory fallback to SMS-2FA).

There is absolutely no "free market" for authentication methods: Everybody does almost exactly the same thing, as authentication probably does not even make their top 10 business priorities.

I don't know where in the world you are but...

Bank: Most banks in the UK use an industry standard Chip Authentication Program - which uses the bank card's chip rather than SMS 2FA https://en.wikipedia.org/wiki/Chip_Authentication_Program

P2P Money: Coinbase https://www.yubico.com/gb/works-with-yubikey/catalog/coinbas...

Brokerage: Vanguard https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar...

It would be a bit odd to have a mobile phone provider who doesn't support SMS. But looks like Vodafone is hiring someone with WebAuthN experience https://opportunities.vodafone.com/job/Dusseldforf-Solution-...

Hope that helps.

> I don't know where in the world you are

Ah, your earlier statement ("you live in a free market") implied otherwise. Maybe something worth considering before asserting that there is free market choice in all of these industries.

Sure, let me just move my brokerage accounts to a provider that supports FIDO. I am sure that is a real thing that the free market has provided or will provide soon.

I'm sticking with Schwab for now because they are at least vish resistant. I have a 'verbal passphrase' and support will not help "me" unless I provide it.

Vanguard offers FIDO https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar...

so move your business to someone who you think takes security seriously.

That is exactly what I did. I was with a major bank but they would not take my security seriously and only did 2FA. I moved to a small local bank that allowed me to lock down my accounts so that from the internet they are read-only. I have to physically go into the bank and show ID for most of my accounts. That leaves one account I can use for small online purchases.

I am working with them to implement better security around ACH/wire transfers. That's not even a discussion I could have with the bigger banks.

> Who are these people in the tech. departments making these decisions ?

It is not the "tech. departments" making the decisions.

It is a PHB [1] in the "security department" following a checklist of "recommended practices" and one of the checkboxes on the list is "add SMS 2FA".

I.e., you are looking at it as a technical decision where the pros and cons security wise are weighed and the better technical solution is selected.

Which is not at all how these decisions occur in the real world in real businesses, and esp. in stodgy ones like banks/finance. Instead the decision is driven not by technical merit but by what "options" are provided on the checklist they must follow, that checklist often being sourced from whatever govt. regulator provides their oversight.

The technical people building the solutions likely know all the problems, but are powerless to do anything but implement the directed solution, because the directed solution is the only one available on the "checklist" from which they are allowed to select.

[1] PHB = Pointy Haired Boss -- Dilbert cartoon reference

One way that you can influence the situation is by addressing the PHB directly, in a language they understand: NIST 800-63B [0].

To reach Authenticator Assurance Level (AAL) 2, there are restrictions placed on PSTN-delivered OOB verification as described in Sec. 5.1.3.3. They explicitly state (in Sec. 5.2.10) that the validity of restricted authentication can change at any time, AND that organizations "SHALL" offer alternative MFA options that are not restricted.

Specifically: "The use of a RESTRICTED authenticator requires that the implementing organization assess, understand, and accept the risks associated with that RESTRICTED authenticator"

So now when you go to the PHB and say, the government says that we are potentially opening ourselves up to legal liability according to such-and-such document subsection whatever, you're much more likely to get allocated resources to implement alternative options. Plus, the government could potentially disallow phone-based 2FA at any time! Imagine how the board will react when they find that we didn't plan for this contingency and suddenly can't comply...

[0]: https://pages.nist.gov/800-63-3/sp800-63b.html

Since the document you link to is applicable to federal government systems only and neither opens you up to any legal liability nor implies the government will ban SMS 2FA for non-government systems at any time, the PHB will likely tell you to take a flying leap.

And it's also driven by solutions that will cause the least customer friction even at the cost of some (acceptable) loss of security. We need the tech equivalent of PHB for techies who think it's just about the best solution from a purely technical viewpoint.

Companies are weighing security vs convenience for the users vs support costs. They do know they could be more secure but the goal is not max security but rather some kind of balance between the three mentioned above. And sometimes it is in fact just sheer incompetence.

Trouble is, most people do not know what to do with a physical second factor. They don't know you need more than one and that you need to keep one offsite. They don't understand the way to make second factor work well is to deny ability to recover your access without it with all the nasty consequences of it.

For a company that provides service to the customers, this is nightmare. Unhappy customers, high support costs of trying to somehow securely give the access back to people who lost their tokens.

I think much easier solution is to go to your mobile carrier and get arrangement where they require you to go through special hoops to get the sim card if you loose it or to port the number (which is what I did).

Also if you really care about security, put that number on a separate phone where you absolutely don't install any extra software. And do not use this phone for normal communication, do not put it in any contacts, try to avoid associating it with your name. This phone becomes your second factor so you might just as well get something cheap and small.

As long as the only viable alternative to SMS 2FA is some kind of Authenticator app on your phone, and as long as most people change or lose their phone FAR more often than they change their phone number, I really don't see how anything other than SMS has any realistic chance of being accepted as 2FA.

In fact, most services that allow you to configure a different 2FA still fall back to SMS if you say you don't have access to your Authenticator app anymore.

And no, yubikeys or other self-acquired hardware tokens are not a viable alternative.

Edit: just for reference, I've been using the same mobile number for ~15 years, back when I had a Nokia 3310. I have probably had 10 different phones in the same period - which would have meant I would have had to go to each service I used 2FA on 10 times in the same period to switch to the new 2FA if I had been using Authentication apps (and if anyone had been offering 2FA ~15 years ago). Note that one of these 10 phones was stolen, so recovering the accounts after that would have been a joy.

I tried to die on this hill once...

An "Architect" was pushing SMS 2FA for our application, and only SMS 2FA. Like you I pointed out all the issues. The response I got was "well if it's good enough for $BIGCORP it is good enough for us" and I didn't win. Cargo culting at it's finest.

Perhaps by influencing developers and architects directly? Everybody searches for something like "how to implement 2FA nodjs" or "2FA best practices."

Flood the web with search-engine-optimized articles and tutorials around such phrases. Publish them on high-traffic sites and make them rank high. Content copycats will then organically spread those best practices through the web over time.

SMS-based 2FA has its simplicity/security trade-offs. But what really gets on my nerves is when websites don't even offer better 2FA options like software tokens and hardware tokens to power users.

For that problem, the articles can include content templates with instructions to users about buying hardware keys or installing 2FAS/Authy/GoogleAuth. Front-end devs can then just paste those templates in their HTML.

> But what really gets on my nerves is when websites don't even offer better 2FA options like software tokens and hardware tokens to power users.

The number of users on most B2C businesses who want this and would use this as a differentiator when choosing a product would be minuscule.

How do you recover your account if you lose the 2FA device? If the service offers email or SMS recovery then it’s not any better than SMS 2FA.

As a regular “power user” consumer all you should need to do is use a randomised password generator and password manager, not reuse passwords and use 2FA if a available.

> How do you recover your account if you lose the 2FA device?

All TOTP apps provide backup codes and export options. Store them in my password manager. If my phone gets stolen, I just import them into the new device.

> If the service offers email or SMS recovery then it’s not any better than SMS 2FA.

I've explained this in another reply. Briefly, in some countries, losing SMS-based 2FA is much more of a hassle than losing device-based 2FA because of government and private bureaucratic hurdles.

> all you should need to do is use a randomised password generator and password manager

No complaints there. Unfortunately, my bank forces me to use 2FA and, worse, forces me to use SMS 2FA.

Are you advocating for OTP 2FA? If so, your concern about losing your phone and losing access to your accounts is still an issue.

At the end of the day, OTP is more secure for the obvious issue with mobile carriers being phished into SIM jacking. But, I've personally had 0 luck convincing any business person that OTP is the best thing to use because (and this is a true statement) users are dumb and lazy and don't want to go through the process of downloading an app on their phone and setting up OTP. Plugging in your phone number for SMS is way easier.

You mean TOTP in an authenticator app right? To my knowledge SMS 2FA sends you an OTP

Yes sorry TOTP.

TOTP can be stored in things like 1password and shared between devices, if you want.

I don't mind if SMS is an option, but I would prefer it not be the only option and certainly not the only backup option (weakest link and all that).

Nobody has actually tried a concerted effort to banish SMS 2FA (that I know of). Here's how I'd do it:

1. Figure out what the alternative is ("X"). It must be one thing that is dead simple, and it must work for 90% of people without annoying the fuck out of them. "Technically superior" is bullshit, it must be superior to an industry, organization, and an individual lazy user.

2. Get a coalition together of corporations who depend highly on SMS 2FA. Get them to all agree to be involved in changing to X. There are big financial and legal implications here, this is not easy. People have probably signed long-term contracts and those will need to run out or be written off.

3. A big marketing push to tell people that you are spearheading change; SMS 2FA is old and busted, X is the new hotness. You have to convince users to give it a chance, organizations to stake their reputation and security on it.

4. An organization needs to exist whose sole purpose is to make money off the new alternative. Partly this is because orgs want to pay for "premium support", partly it's to offer indemnity to customers, partly to provide a white glove service during transition, and of course, any company that makes money off something gives it legitimacy, which is needed to make people take it seriously.

5. Get official standards bodies, the government, consumer protection agencies, etc. to all make official proclamations that SMS 2FA is a danger to the nation and should be abandoned in favor of X.

6. A long period of transition. Years. A lot of support for people during the transition. Bug-fixing, figuring out edge cases, adding support to every platform on the god damn Earth.

7. All this needs to be paid for. Get the money, get it to the right people at the right time.

You won't because people are married to their phones now. Anything else is an alien concept. Cars don't use keys anymore, people are going to be dumbfounded why their computer suddenly does.

You could solve 90% of this by having a yubikey be built into the phone itself. Non-techies would be "using their phone" and people who care could get a stand-alone yubikey thing.

This is basically what you are describing: https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-...

It's not widely adopted, unfortunately.

What's the advantage relative to a soft token? (Though it's arguable that Apple/Android should have an installed soft token out of the box.)

It can be a hard token utilizing the secure features of the phone itself.

This has the downsides if you lose the phone you lose the token, but that downside exists for a physical token, too.

The goal is to encourage them to support the tokens so that those who want to can go phone-free (by using a hardware yubikey instead).

Isn’t a “yubikey built into a phone” just equivalent to a password manager? What threat is actually prevented by that? You have to have some way to sync the “yubikey” so that the phone can be restored if it is lost.

Not necessarily - it could be the Secure Enclave thingy and yes, if you lost your phone it would be like losing your yubikey, but the goal would be to get more support for yubikey like things.

The point is people don’t buy just one yubikey. You are supposed to buy them in pairs at least. So whatever you put in a Secure Enclave needs cloud backup for normal people to be able to use it, at which point it’s not functionally a yubikey anymore.

I am talking about SMS specific. You could still do TOTP based/Authenticator app (not perfect but much better than SMS) and then have backups on multiple phones or even password managers as needed so that it is not tied to one single phone number.

How does my Aunt who only has a flip phone use an Authenticator app? She doesn’t even know who to use sms but understands the call verification on online banking.

> Is it time to try and force a legislation through Congress because I don't think these companies give a shit until forced to.

Yes. Without regulation, nothing will change in the short term; perhaps in the long term with Google and Apple pushing passkeys in their ecosystems.

You will still need a solution for those without a mobile phone or a smartphone, such as a hardware PIV/smart card like DoD CAC and other digital ID cards with crypto primitive support.

SMS/Voice MFA must go. Call your representatives.

https://www.congress.gov/bill/117th-congress/house-bill/4258

https://www.cisa.gov/sites/default/files/publications/fact-s...

This is such a lazy take. First of all, no legislator is going to take this up, this would be such a stupid issue to die on. Second, we don't need the government to tell people to switch, they will if there's something just as easy. Third, all the other solutions are currently shittier to use, so even if we did use the government to force people to change, everyone would hate it and it would destroy any good will people have to do a little extra work for security.

It was Google that championed 2-step verification a decade ago (2011), including SMS message as an option. I presume few people anticipanted sim-swap attacks at the time.

"After entering your password, Google will call you with the code, send you an SMS message or give you the choice to generate the code for yourself using a mobile application on your Android, BlackBerry or iPhone device." [1]

Until someone comes up with a SMS 2FA alternative that is simpler and easier than all the SMS alternatives, then SMS 2FA will continue.

[1] Advanced sign-in security for your Google account (2011) https://googleblog.blogspot.com/2011/02/advanced-sign-in-sec...

I feel like there's an analogy between cryptocurrency and MFA where the strongest proponents of each ignore the human / social factors that landed us in the regime we're in now. If the replacement doesn't accommodate for those same concerns, it's not likely to take hold.

In the same sense that transactions need to be reversible, credentials and IDs need to be recoverable. People lose their devices, forget their passwords, undergo physical change, etc. I can't wait for the day we have something ubiquitous, trustworthy, secure, recoverable, and simple.

>Who are these people in the tech. departments making these decisions ?

They aren't in the tech department; it's being forced downwards in many cases, often by the company "selling" the 2FA "solution".

Some cases you get a rare CTO who actually understands and cares, but that's rare.

The main point of attack would be the companies selling 2FA solutions to enterprise; they need to add non-SMS options and market on them - which may require a few more high profile SMS hacks to get it in front of everyone.

So maybe the solution is for techies to hack SMS 2FA (don't actually do this).

It's cybersecurity departments that mandate these policies. In my organization a lot of these people come by way of the U.S. Air Force and NSA. They literally have seats at the table in the White House for DHS (Department of Homeland Security) meetings. Can you guess for what the advocate? Yep - SMS 2FA!

Now imagine you're the CEO of my company (a Fortune 200 company), a company that's responsible for infrastructure that's been deemed vital to the security of the United States. Who do you think the CEO is going to listen to, me or the Air Force guys and guys hailing from American's top three letter security agencies?

Now, if that's what our CEO is doing then what do you think your CEO is doing? That's right - they're looking at what we're doing. They know we have our personnel engaged in meetings at the White House. They know we're managing nationally critical infrastructure. They know how we're securing our customer-facing applications - and that's SMS 2FA.

My advice is to keep your mouth shut unless you're a recognized security expert. You're just spending political capital for naught.

I've often wondered if companies prefer SMS over TOTP for multi-factor authentication because it provides them with a reliable phone number for each customer.

At least one company promised that phone numbers will be used only for authentication, but was caught using them for marketing (which is exactly why I don't trust most companies with my phone number in the first place).

I'm currently struggling to get access to an account for which my daughter lost the number (it was a prepaid phone number, went back to the pool).

The biggest issue with 2FA, is that everybody allows you to set it up with just a single second factor, so losing it, means you're out.

In enterprise contexts, it's not an issue, there's another factor that you can use in an emergency, which is basically contacting IT.

But for things like Google, Apple, etc. you should not be allowed or required to setup 2FA unless you can provide two distinct second factors, one for regular use, and another for recovery in case the first one is unavailable.

This is such a glaring usability omission that I cannot fathom how the heck we're still pushing for it.

It took a long time to get companies to adopt 2FA. It'll take time & continued effort teaching & explaining to get more companies to move off. Each company is unique in their own reasons to not improve security.

Not really unique. It ultimately comes down to laziness. Which isn't even necessarily a terrible thing all the time. Companies need some level of laziness on certain things to actually profit. But a large chunk of the time it manifests itself in security.

"People losing access to their phone is a scenario and puts users at significant risk of losing access to key accounts"

You'd go to your network provider, show ID and in hours you have your SIM back. What is this hyperbole..?

In my country, you can buy a pre-paid SIM in a store without providing any kind of ID, making it impossible to retrieve the phone number once you lose it.

I'd be very surprised to learn that such things are not possible in the US.

I don't doubt your claim, I think it's more common to have ID verification across the world.

That aside, I think at one point if people make dumb choices, they're screwed, can't do anything about it..

> I think at one point if people make dumb choices, they're screwed, can't do anything about it

I don't think that a single "dumb" choice should result in people being screwed. Especially if the "dumb" choice is not really a dumb choice, except for "this one particular scenario in which it's dumb", like pre-paid SIMs. Quite a convenient way to blame the party damaged by big corp's bad decisions.

What I meant to say was, there needs to be a cut-off point for company responsibility. Agree, there should be other alternatives to SMS incase a user get locked out.

Oh, my bad. In that case, I agree with what you're saying.

Professionalism and quality of bureaucracy vary by country.

In mine, my provider invalidated my SIM twice during their technology upgrades (2G->3G, 3G->4G) without any notice, warning, or hint. Was it an upgrade? Was I phished? It's all left to the user to infer what happened. And if it turns out to be a crime, our rules expect us to interact with an even more apathetic and corrupt police department.

What may look like hyperbole in one country is daily ground reality in another. I'd much rather prefer something under my own control, like TOTP, over anything SIM-based.

Fair enough, but, you then have the problem of not being able to cater to people with feature phones. I think a combined email or SMS based options solve most problem cases.

I don't understand the hate for SMS, like "how are these people in tech?" -- most banks I know of work on SMS based OTP. SMS also gives you a sorr of a real identity to work with and physical location in most common cases (not the app provider, but investigative authorities if they get involved).

I'm personally fine with SMS-based 2FA for others. I just want banks and companies to give me my preferred alternatives.

See this earlier discussion on problems that homeless people face re 2FA https://news.ycombinator.com/item?id=33120534

Have your SIM back is not always easy:

https://news.ycombinator.com/item?id=33434153

https://news.ycombinator.com/item?id=33120534

This has been a struggle at the company I work for. Its not really the technies that need convincing, its the Product Managers who somehow have established this thought in their head that anything beyond SMS would be too hard for our customers to use as stuff like TOTP requires a separate app or push notification or something else that is too out-of-band. For employees we already use TOTP/Yubikeys based MFA.

>Product Managers who somehow have established this thought in their head that anything beyond SMS would be too hard for our customers to use as stuff like TOTP requires a separate app or push notification or something else that is too out-of-band.

And what makes you think that they are wrong? It wouldn't surprise me if your PMs have actually talked to customers who went "Huh?"

I just hate that I need a mobile plan now to use most services that require SMS 2FA. I want to be able to down everything without a phone number.

There is legislation, the secure digital identity act making it's way through congress. It would task NIST to create a standard.

NIST has a standard(s?) that says password strength rules are dumb and regular rotation is not necessary. Great, except we all know both are still widespread even by US sites. There's no 'oi comply with the NIST standard' regulation (for most companies anyway).

The short version is to probably try to document the upsides and downsides of 2FA options and then petition NIST/CISA to recommend against SMS 2FA. Eventually that will make it to the auditors who certify institutions and force them to upgrade.

Congress isn't really going to be relevant. The auditors have far more control.

2FA is good and is evil.

Good because with a SMS you can get easy access to recover your password.

Evil because, loose your phone, loose your access to email, bank and other services.

Maybe use 2FA with at least 4 methods of RECOVERY like: password, email, secret question, OTP SMS, another secret question.

Stop 2FA with limit methods.

What if tcp/ip and the digital pangaea known as cesspool devises domestic protocols and retires tcp/ip for a national infrastructure on a modern 21st century protocol, without a billion illiterates (they can sit around all day and shake the tree for fruit and nuts)?

Most of the impediments are long gone at that point. Domestic jurisdiction/regulation has better options, customs and etiquette, similar to domestic speedlimits (that do not apply anywhere else).

Technology moves fast. Something similar to a VPN client would still have access to tcp/ip subscriptions, so online gaming and things like that could still flourish.

I don't see telehealth, remote learning and several other industries blossoming until domestic protocols are the norm.

Security with obscurity is elementary nowadays :p

Similar to phonograph, to reel-to-reel, to cassette, to CD, to DVD, to streaming, to 21st century mediums, the quality data goes with each generation. The cool music is still there

Also, the $BIG_CO implementing this Today likely put it on their roadmap like two or three years ago.

And whichever manager made the push then cannot change course now or they'll be "wrong" which impacts their pay.

So, push the project through and call it a success.

Do you really expect politicians to fix a technical issue that technical people don't know how to fix?

This reminds me the old quotation: "you only trust in laws and sausages if you don't know how they're made".

I suspect that for SendGrid, SMS is an important hurdle for filtering out spammers. Of course, that's relatively easy to work-around, but it doesn't feel shady to me if viewed with this context.

A question here is 2FA with e-mail considered better or worse than SMS?

It's not "better" or "worse", but rather should be up to the user. I've got a bank where them sending the SMS just silently fails, probably because my phone number is on GVoice. The web forms will allow me to do email challenge, but then calling customer service I've got to tell them about the hidden option in their own system to turn it into a voice call challenge rather than the broken SMS.

I myself generally prefer email, because the message comes in quicker going directly to my SMTP server rather than bouncing through GVoice and then to my SMTP server. But if the formatting of the email doesn't make the nonce readily visible and selectable, then I'll prefer SMS because the limited length forces them to leave off most fluff.

But really, all of this should be consensual at the behest of the user, not forced by the bank to push liability onto the user. The main security model of US consumer banking is to report unauthorized transactions within 60 days and they'll be reversed. So anything that hinders me checking my accounts every month is a negative for my own security. My preferred system would be straight password for a full-access login (to be stored by my password manager), and then a separate password for read-only login with a well-documented API (to be used by automated scripts).

Why? MFA via SMS is the most user friendly option at this point. Nothing else comes close.

The Apple flow... - Visit site/app - Clock "send code to phone" - Apple populates code field with code when it arrives

No 3rd party app, no extra subscription, no extra hardware. Couldn't be much easier.

Yes, I realize SMS can be attacked in a few ways that app- or hardware-based MFA cannot. But, it's probably better than nothing (I've not seen a good counter to it).

Now, should banks offer SMS + app/hardware options? Absolutely. No question. But please don't take away SMS unless you're offering something just as easy.

Because privacy. Name any company with an online presence that asks for their user's phone number and I'll give you five reasons why that company can't be trusted with it. Data of this nature is a liability and should be treated as such.

Fair enough, but I'm still waiting for an alternative that's as low-touch for non-techies.

And I'll still take SMS over "send the code to some other device that may or may not be within reach" which is one of the common alternatives. It's annoying enough at home, but if I'm on vacation or at the office, having codes sent to my iPad is a non-starter.

SMS 2FA is way better than 2FA via email. I can't convince that huge French company to add also an authenticator app besides their email 2fa.

Not saying you're wrong, but what's your logic? It seems to me that control of 99% of my accounts already reduces to having control of my email account, because account creation and password reset processes depend on my email. I've never understood why only a handful of my service providers let me select email as an option for 2-step verification.

I would love for my credit union to have SMS 2FA. Right now for web or mobile app access it is purely username and password.

Phone only 2fa is horrible if you do oversea travel and too get local SIM cards. I can’t stand companies that do this

Now why would we do that? SMS based 2FA works great in modern countries where SIM swapping is not an issue.

> "updated security measure"

The misconception that security is additive is deep rooted in a primitive view of the world that I can not imagine going away soon. If you have 10 cm of concrete protecting you, it's better than 5 cm of concrete. So if you have a grade 10 padlock and a grade 5 padlock (higher being better), it's better than just having the grade 10 padlock. Substitute padlock for any system that can be intelligently hacked.

My cynical view after having worked in regulatory compliance with so-called "security consultants" who are essentially paper pushers is that any security flaw can be fixed with the right wording in a document. In fact it might even be preferrable than fixing the flaw in software. This is comparable to activating a linter only on touched files, not all historical code.

You could blame incompetence, but a real assessment is made: You earn more if you allow some amount of holes, blame evil hackers, reverse transactions, apply insurance. Most cash is digital, and all banks are in it together. This is why banks hate blockchain: There are too many poorly made systems that assume we can undo transactions when we fuck up, and not fucking up is too expensive.

When you have zero clue how something can go wrong, and you don't even know the probability up front, all you can do is bet on insurance and transaction reversal.

tl;dr: I understand you want to reach through via tech, but the problem is: Lack of real security is a conscious decision.

Vote with your feet! I switched my primary bank and my brokerage to ones with hardware mfa support.

can you name them? doesnt seem to be something that is advertised

2fa.directory

I don't understand. What's your alternative to SMS 2FA?

Non-SMS 2FA, such as TOTP, FIDO - using an app like Authy or Google Authenticator or a device like Yubikey or Nitrokey or something on-device like Passkey or Apple's stuff.

There are problems with the other alternatives that can prove to be an insurmountable barrier, specially for end-user products/services.

Consider I have an app that can stitch your photos together in a panorama, and you can sign up to store your creations in the cloud for some fee.

> TOTP, FIDO, Yubikey or Nitrokey

No user is going to buy a hardware token, just for this app.

> Authy or Google Authenticator

Users are more likely to go with this, but many would still not be willing to, or simply might not understand why.

> something on-device like Passkey or Apple's stuff

I don't know about this, have never used anything like this.

Point is, SMS 2FA presents the lowest barrier to entry for most users, and it is genuinely better than having just a password. So for most applications that don't need to be super-secure, it is totally fine and probably the best solution.

I was just answering your question what are the alternatives. Didn't read to me like you were already aware of them.

I meant that there are no alternatives that are good enough to replace SMS.

Join the big tech companies and adopt support for passkeys.

if there's one thing I'm sure of, its that Congress getting involved will do anything but help the situation

All two-factor should be opt-in or opt-out. Users should have a choice between less security and getting locked out.

This isn't worth the effort to discuss. There isn't much point in fighting the surveillance state.

Reply on news.ycombinator.com