Hacker News Reader

Comment by kerkeslager | Hacker News Reader

Disagree.

SMS is not perfect for security. But SMS is better security than no 2FA at all, and for many (most?) situations, more-secure alternatives aren't viable. The deprecation of Authy or loss of keys has left me permanently locked out of a few accounts. YubiKey and similar aren't ubiquitous enough or usable enough for many users. I've experienced these problems personally and I'm likely in the most technical 1% of users you're likely to encounter. SMS is ubiquitous and users understand it, and is secure enough for many situations.

If you're running a service that requires a high level of security, fine, force users to use TOTP/HOTP or something, but be aware you're going to be excluding some users and adding to your support costs by doing that.

View on HN

I disagree that SMS two factor is more secure than a password alone. I have found that once you enter your phone, it is more trusted than your password (meaning it alone can reset your password). A phone number is as secure as the least competent support person at your phone provider.

A password, with email reset is better. My email has two factors of authentication, rather than whatever my phone provider requires as proof.

> I have found that once you enter your phone, it is more trusted than your password (meaning it alone can reset your password).

Sure, but my answer to that is simply, don't trust users' SMS more than their password. You should require two factors of authentication to change settings on any authentication factor (i.e. SMS and email to change password, password and email to change SMS).

Notably, email is arguably less secure than SMS.

What you describe isn't 2FA, though. "SMS two factor" fundamentally precludes the idea that the second factor can be used as a primary factor as then it isn't "two factor" it is "one factor".

Yes, it isn't technically an issue when it is purely a second factor. But it almost always ends up being trusted enough that the support team will reset your account with just that info.

The article isn't about 2FA though, it says "It’s time to stop using SMS for anything"

(I can't read much more than that, Medium won't let me)

This is a MANGA+ problem. I even have my password (and user and IP), but I cant login because google wants me to confirm a phone number I no longer have.

LifeHack: Dont setup a MANGA account with a phone number. Leave phone# for banking and other important logins.

Just use BigTech™ and stop trying to prop up a silly, ever-shifting acronym.

But that's a funny acronym, though. I wonder when ANIME+ is coming out.

>But SMS is better security than no 2FA at all

Maybe for some users, but to many like me, this is an annoying assumption for a service provider to make. If I'm forced into adding an insecure method like SMS, I feel that it needlessly weakens my overall security posture. With effort and diligence, it's possible to manage a single strong password securely, but there is absolutely nothing I can do to use SMS securely, so the degree of security I can aim for is limited.

I think the right approach should be to allow the user to opt into such insecure methods, but to never force them to lower accept a lower standard.

Sure. To be clear, I'm not saying "force users to use SMS". The ideal solution for most (not all) situations, in my opinion, is to require a password and one of HOTP|SMS as a second factor.

Yes. SMS is completely about raising the insecure people to some base level of difficulty to compromise. This is often at the cost of more secure individuals.

The problem is that you can't force users to use a decently strong unique password. You can force them to set up SMS 2FA (with very minor exceptions of people without SMS access). Moving the base bar from credential stuffing to SIM swapping is a huge upgrade for big services.

> you can't force users to use a decently strong unique password

unique is the key word. you can certainly force users to use a decently strong password, but not keep them from using the same password at every other website.

SMS haters make it seem like there are tons of vans with antennas stealing banking credentials left and right, but somehow this just isn't happening.

The cyber criminals that want to log in to my Microsoft account just don't live anywhere near me and don't have fake companies with SS7 access.

None of that is required to compromise SMS. A SIM swap is much easier to accomplish because the cellular carriers have historically had woefully insecure policies and their support agents could easily be socially engineered into moving your phone number to an attacker-owned SIM card.

I believe that this is only a USA problem.

In Europe I have never heard any stories about SIM swaps, so I do not believe that they have high chances of success, like it is said to happen in USA.

Therefore, at least here I find SMS as a 2FA more convenient than the alternatives and I believe that it is secure enough for most uses.

Reply on news.ycombinator.com