Hacker News Reader

Comment by jwr | Hacker News Reader

Here's the missing bit of advice, which you won't get, because Twilio makes money from you sending SMS messages:

Do not use SMS for 2FA.

Seriously — just don't. It is not secure, it is susceptible to fraud, it is not a good second factor.

Yes, I do realize there are other uses for SMS, but this is the prevalent one, and I'd like people to consider seriously if they really want to use it before they blindly follow what others do.

Remember that there are companies that use SMS 2FA not to make anything more secure, but to get your unique tracking identifier (your phone number) and tie it to online targeted advertising.

View on HN

Need to yell this as loud as possible to the goddamn banking and healthcare industry face then. Cause those dinosaurs don't even let you have an online account without an SMS (and only SMS in most case) as a 2FA mechanism.

Just to shame a few out there right now: Chase, Fidelity, Bank of America, American Express, United Healthcare, Signa and many more.

Ally Bank used to allow 2FA through SMS or email, if I recall both were optional. But they eventually required everyone to use 2FA, and it had to be SMS -- email 2FA doesn't work anymore

> it is not a good second factor.

but it is better than not having a second factor. If your only choice is a password or a password & SMS, use SMS.

I think that depends on how it's implemented and how their account recovery process is done. If they give SMS special status and use it with few or no other data to recover accounts when you're locked out, then adding SMS 2FA might actually significantly decrease your security for that account by allowing someone to gain access with just the SMS capability.

That's hopefully very rare, but of the companies that would do so, I imagine the ones that only support SMS 2FA are likely to have a higher occurrence.

> I think that depends on how it's implemented and how their account recovery process is done. If they give SMS special status and use it with few or no other data to recover accounts when you're locked out, then adding SMS 2FA might actually significantly decrease your security for that account by allowing someone to gain access with just the SMS capability.

Very true and very dangerous. Do account recovery procedures technically count as a authentication factor? I've always though about them as a separate thing. For example alterative email addresses, physically visiting a building, etc can be used to recovery an account but may never part of the actual login process.

Yes, but if I lose/break my phone, I can legally resurrect my phone number.

For 2FA apps I need to securely store backup keys, and take them with me when travelling.

In my company we set up Duo, so at least IT Admin can bypass 2FA for me. But it doesn't work with all services, regular type-in OTP are still lost.

India has been enacting regulation enshrining SMS as 2FA for their entire Digital payments infrastructure. They even require storing all biometrics (FaceID etc.) on gov servers and not on-device. We are in for a decade+ of this at minimum.

SMS also comes with no deliverability or latency guarantees, and hard to scale globally as rules and regulations are different in every country. Acquiring IDs is slow and you need multiple for backup routes and different use cases.

Reply on news.ycombinator.com