Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by seanthemon | Hacker News Reader

Parent Full thread

seanthemon·

Impossible if your customers are enterprise.

View on HN

Weird. My fortune 100 company doesn’t use SMS for 2FA.

I assume that all of Fortune 500 (minus tech majors) use RSA hard and soft tokens.

Ref: https://en.wikipedia.org/wiki/RSA_SecurID

The world's largest employer (US Government) uses Smartcards (and no passwords).

Quite possibly with SMS as the fallback option in case the soft token is lost.

We have a human in the loop as the fallback. It’s just a different attack vector. Brute force becomes a lot harder, but social engineering becomes easier.

It is still very common for business clients of all sizes, in all industries (even critical infra) to request 2FA via SMS. Good for the company you work for that they dont :)

When they request it, they should receive pushback. SMS 2FA is a bad business decision with potentially severe consequences for customers.

"We recommended you went for X and listed SMS security problems as the reasons - here is the email chain"

You need to cover your ass, but you don't want to actively push back and risk losing the sale.

https://duo.com/product/multi-factor-authentication-mfa/duo-...

There are a huge number of app based solutions. Enterprises are against them because they can't expect their employees to install 20 different apps for 20 different vendors + the cost of reviewing and onboarding them.

So you either need to support SMS or several of the major 2FA app providers including the crappier implementations like Microsoft authenticator.

I work at an "enterprise" company and I'm not expected to install 20 different apps. Duo is just one example, but it supports both push based 2FA and onetime tokens, and those two modalities cover every vendor integration and SSO we have. There's really no excuse to be using SMS nowadays.

Reply on news.ycombinator.com