SMS-based Two-Factor Authentication is not Secure

SMS-based Two-Factor Authentication is not Secure SMS-based Two-Factor Authentication is not Secure 311 points by Zolt 4 hours ago | hide | past | favorite | 130 comments SMS-based Two-Factor Authentication is not Secure. I’ve read this before but brushed it off. It wouldn’t happen to me. It did.

I am with Boost Mobile. On Sunday night I received a text message that my PIN was changed. Within minutes I confirmed this to be true on my PC. I used the Boost application on my phone to change the PIN and received a confirmation text.

A few minute later I received a text message welcoming me to Metro PCS.

A few minute later I received emails to my business email that my account security information was deleted from my person email account. They used SMS authentication to my mobile number, that they now have control of to gain access.

A few minutes later I received an email there was an account recovery attempt on my coinbase.com account.

It took less than 30 minutes for these events to transpire.

I've spent about 15 hours trying to get my phone number and my email address back to my control.

I've accumulated a list of eight other people in the Boost Mobile Reddit.com forum where the exact same thing happened to them.

I filed a police report and filed a report with the FCC. I received a response from the FCC that they have started the inquiry and contacted Boost.

I finally did get my cell phone number ported back to Boost. I have not gained control of my Microsoft email address.

I didn’t realize I could only have messages of 2,000 characters. So I will wrap this up.

When account settings were changed, Coinbase gave me a link to lock my account, Microsoft gave me a link to log in to my account, which I no longer have control of.

Unlike competitors, which allow pins from 6 to 15 characters and for accounts to be administrative locked, Boost offers none of these options. The last Boost operator suggested I pick a more secure PIN.

I am calculating my losses and documenting all interactions.

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor.

The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number.

Even in a situation where the attacker would have needed the password too, consider how much more vulnerable you are now that they have a significant piece of your auth - could they leverage that to social engineer an account recovery?

Phone numbers are terrible at conveying identity, unfortunately, so bringing them into the "who are you" heuristic is kinda just a net loss.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe

Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I'm glad someone is bringing this up.

I witnessed so many people lose access to their accounts because they wiped their phone that had an authenticator app, or they lost their physical 2FA tool.

I keep an old phone around with a duplicate Authy setup. I also photograph the 2FA code or QR code and print it to a safe place.

Services like Authy address some of the loss of device issue, and always a good idea to have a backup token (e.g., yubikey) physically escrowed somewhere like a safe-deposit box.

But it is a whole lot of extra work to set up and maintain long-term, even with the best intentions.

What about an authentication app? Google Authenticator or something similar can be installed on the phone which is necessary for SMS, improves the security more than SMS, and doesn't suffer from the problem of losing it, at least not more than SMS auth does.

And the site has to support U2F. U2F is a great standard but almost none of the businesses I interact with support it. There are maybe 3 banks in the US that support it, but not mine.

Its generally not "second factor authentication" but 2-factor authentication. The idea is that you have 2 separate authentication factors. Preferably both with decent security.

Besides, I don't believe coinbase does SMS only account recovery. So here SMS really did fail as a second factor. Since it seems attackers must have had a password and SMS. (I am not 100% on the coinbase account recovery process)

No, it sounds like coinbase used email recovery, but his email provider used SMS recovery.

So the hacker only needed to hijack his SMS.... with that, they gained access to his email, and then with that gained access to coinbase. No password required.

SMS is better than nothing, but you have a bunch of other better fallback alternatives before you should rely on it. You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person). You can have online push login approvals. You can have a TOTP code generator.

TOTP is the one that makes the least sense to me. It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). It also has almost all of the downsides of U2F (a pain in the ass if you lose your device).

> You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person).

How many services do that today? And since so few people have fallbacks what is their recovery process like? Because the hackers will find the weaknesses.

> Yeah, and it requires me to use a U2F token, which I can loose, etc.

In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes.

> and SMS as a second factor seems like a perfectly reasonable balance.

My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's super shitty. That doesn't mean that SMS 2FA is a good idea - the fact that it can actually reduce your security is very problematic.

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security.

There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch.

For most of the world, SMS is it. The Nordic countries have the bank if system. But the market is too small. Hopefully the EU-wide identity verification systems solve the scale problem.

> Some form of trust that can be bootstrapped again from scratch.

This is not using it as a second factor. It is using it as the only factor. Having SMS as the only factor is not purely additive. As such it can (and obviously does) reduce security.

Account recovery is hard, SMS is quite usable there, but way to insecure to be the only basis for bootstrapping account recovery.

I don't really understand why you think I'm advocating for SMS as the only factor, when I very clearly wrote the exact opposite.

Let's say that you remember your password, but your house just burned down. You cannot replace the U2F keys and backup codes that were lost in flames. But you almost certainly can bootstrap your real life identity far enough to get a replacement SIM.

Which, in combination with your password, should be enough to get your digital identity back.

> SMS as a second factor is purely additive. It cannot reduce security.

I responded to this in another post.

> There is pretty much no form of second factor that users are worse at passing than backup codes.

Agreed, I also mentioned backup U2F. At this point modern smart phones package TPMs that can also do attestation, so we're really not too far away from being in a situation where the vast majority of people have a U2F token in their pocket.

> In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes.

Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.

> Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.

So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.

Most people don't own two phones though, and wouldn't think to have two separate U2F tokens.

A phone's TPM is the only U2F token that 99% of the world owns, assuming they own one at all.

Yes, as I've said, availability is the problem to solve. We should be shipping U2F tokens wherever we can. I'd like to see schools that require students to use GSuite and other U2F supporting sites giving students tokens for free. I'd like to see banks giving their customers tokens. I'd like to see companies giving them to employees.

IMO the problem is not "let's get some kind of 2FA" it's "let's get U2F in the hands of as many people as we can".

> the fact that it can actually reduce your security is very problematic.

The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP.

> The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP.

I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else. Every piece of information the attacker can get is valuable for forging auth.

What SMS is good at is being available. At this point cell phones are distributed to a massive portion of the world. But at this point smartphones can also act as U2F devices, I believe, so I'm not sure that benefit is so meaningful anymore.

Instead of companies wasting time on SMS 2FA they should be figuring out how to help their customers set up U2F.

I'd like to avoid being in a situation in 10 years where we have great options for end users available but 2FA SMS is still supported for legacy reasons, and unwitting users end up using it because it seems easier and they don't understand the risks.

> I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else.

So it's better to not consider that information at all?

What is better? (1) Requiring a password to login or (2) Requiring a password and a code sent via SMS?

The problem you're describing is that services accept SMS in leu of other forms of verification, such as an actual password. Personally, I would very much like it if I could turn off any and all forms of "I forgot my password" flows. There should at minimum be a one-week waiting period or similar.

> So it's better to not consider that information at all?

Exactly

> What is better? (1) Requiring a password to login or (2) Requiring a password and a code sent via SMS?

They're equivalent in my mind - SMS is such a weak 2FA mechanism, and it's so easy to get wrong and have it decrease your overall security, any benefit is lost. Rather than pushing SMS because it's what we have we should make greater efforts to leverage technology that we know is considerably better in every regard except availability today - IMO that is the problem to solve.

SMS adds friction to password stuffing. Given that a gazillion people do not use unique passwords, this has some value.

It is possible that if we spent more time as a community encouraging the use of password managers that the net improvement in security posture would be greater, but this does remain a nontrivial benefit of SMS.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe

Not only that, but you can remove the username too: WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.

But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.

Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine.

I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p.

Just don't get your password manager stolen, I guess, but that's already the case.

You can only use a U2F token at the only factor when it's acceptable for you to temporarily lose control of the account.

I've posted before on here about my experience getting SIM swapped and how quickly someone was able to gain access to a bunch of my accounts. If I hadn't been at home and looking at my phone while it was happening, it could have been much worse, but thankfully I was able to get in and terminate most of their login sessions before too much damage was done.

The one thing I distinctly remember was two of my GMail accounts starting the recovery process. Thankfully, that process apparently gives either 14 or 30 days to stop the recovery and secure my own account. Had I not been connected, that may have been my only saving grace, as I was able to secure those accounts and subsequently use them to recover other compromised accounts.

The larger lesson for me was to always use TOTP tokens where possible over SMS, and to completely disable SMS recovery for accounts that didn't have a delay on SMS-only recovery.

This. SMS is a great second factor and is perfectly suitable to prevent the main attack that you want second factors to prevent: that is if your password appears in a password list for any reason it should stopp anyone from just running away with your account. Note that if you are targeted directly SMS is not going to help you much but in this case maybe your password can (depending on the capabilities of the attacker).

Now is SMS the best second factor? Of course not and a proper U2F token will be a lot more secure in many cases but for most people SMS should be perfectly suitable. All this of course requires the auth provider to be somewhat competent and not use SMS as an only factor in any circumstances.

FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker.

Where it's used as a second factor, this still has an impact which is, if an attacker can get the password (and there's been enough breaches and keystroke logging for that to be common) they can then grab the number to get full control of the account.

TOTP or hardware tokens don't generally suffer from the same problem.

> TOTP or hardware tokens don't generally suffer from the same problem.

But how many hardware tokens or TOTP tokens are users willing to deal with? I currently have eight for various clients and systems at work. If each online account required a TOTP token or a custom hardware token it would be a confusing mess of tokens.

I don't know if there's a safe and easy way of reusing the same token across sites. Until then SMS really is the only "solution".

The problem is with most online services, the only second factor allowed is SMS.

If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably.

It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use SMS alone for password resets, which isn't MFA, is 1FA with a weaker factor than a password.

What would you think if someone took you for a joyride in a classic car and said "shoulder belts would be so much better than these lap-only belts, so don't bother buckling up!"

I didn't say it was worse than just password, I said it was a bad second factor, which it is.

SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.

A bad second factor is better than no second factor.

I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.

others may have suggested that, I did not :)

If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.

You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.

Except you have no way of knowing if that will be the case ahead of time. Unless the first thing you do after enabling 2FA is to social engineer a password reset for your account? Even then that doesn't guarantee that there isn't a more clueless service rep that will make a mistake.

Asking before you sign up, "will you allow my account to be hacked through social engineering?" isn't going to an answer other than no. Even if the answer is possibly yes.

What's the recovery process when your phone gets stolen, or you drop it?

TOTP is phishable, which is a way way way more common attack than sim swaps.

phishable how? "your account has been hacked, please provide us a TOTP code"?

1. Somebody loads fakebank.com.

2. It pops up a username/password screen. The user types in their credentials for realbank.com.

3a. The owners of fakebank.com use your creds to log in to realbank.com and are presented with a TOTP page.

3b. fakebank.com loads another page that asks the user for their TOTP. The user enters it, still thinking they are logging in to realbank.com

4. The owners of fakebank.com use the TOTP to authenticate as the user with realbank.com.

Entire SDKs to automate this are sold on the black market.

Exactly this. Here in Israel, SMS is used extensively as part of a multi-factor authentication system. I also require my National ID.

To move my phone number (consent or not) between any phone companies requires an SMS, my National ID, and verification of my ID, and personal details in the government database.

SMS by itself is not secure.

You can’t control some random guy in a provider store giving out a new sim for your account, whether maliciously or because they were deceived.

And still numbers are being hijacked even in Israel [1], and even in Sweden, where I live now, I swept my SIM without my ID being properly checked

[1] https://www.gov.il/he/departments/news/sim

Absolutely. This is the problem - it's not the ideal method.

> The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

No, SMS shouldn't be a single factor, period. It doesn't prove much, and is insecure, as the current post shows.

The option for a delay of is great. The option of adding a custom security question/password etc. is even better. The option of completely turning off recovery is also great. The ability to have your solution on multiple devices without a need for a mobile phone number based recovery is great as well.

I hate it that Twitter forces you to enter a mobile phone number even when you set up an authenticator code generator as 2FA.

Oftentimes the weakest link in most of these services is the account recovery part.

When we set up the self service account recovery in saas pass password manager and authenticator we added all of these customizable options to mitigate against potential SIM Swap attacks.

There is no situation where it is good at anything.

This kind of arrangement is often mockingly, but accurately, called 1/2 factor authentication.

SMS will remain vulnerable as long as the mobile accounts that hold them upstream remain vulnerable.

One option I’ve heard might be different is to not your your mobile sms on accounts, but to get a voip based sms number. It might leave things at the mercy of a different system but the footprint might be different.

I've tried this, but many companies block VoIP numbers for MFA/2FA. Some don't. This works with LinkedIn, but not any companies I have purchased things from.

As others have said, it is not that SMS 2FA is insecure; it is that thieves have figured out how to defeat it using SIM jacking and a bit of facebooking and googling. It is now trivial to figure out your home town, your favorite pet, etc. Also as others have said, the current alternatives have their problems. What if you lose all your Yubi keys? What if your phone was accidentally wiped and you never got around to backing it up? You cannot prove you are you and so customer support cannot help you. Google, Microsoft, and Apple are not known for helping consumers get themselves out of this catch-22.

It is a mistake to ask consumers to protect, backup, and secure their digital lives themselves. Consumers don't have the time or skills to keep up with the hackers. If Apple, Google, ATT, Verizon etc. cannot provide digital security, this is an opportunity for someone else to step in. My personal suggestion is this is a ripe opportunity for someone like the US Post Office or Department of Motor Vehicles. Consumers would go to the US Post Office or DMV and purchase a Yubi key from them. The additional value they add, is they can verify the identity of the consumers who is purchasing the Yubi key and replace the key if it is lost/stolen. Similar to how they process driver licenses or passports. This service is optional and would actually cost money. I would gladly pay a monthly fee for this peace of mind.

Absolutely this, but the service should act like a driver's license if you want people to actually use it.

Pay some $ for the key, renew it every 2 years for a fee, pay for a replacement if needed.

No one wants another monthly fee, taxes should keep the infra up like any other license.

I lost my Microsoft account years ago. I still get emails from Microsoft stating that there's suspicious activity on the account. I got two just yesterday.

Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the account with help from support or even after visiting a brick-and-mortar store.

It's one big reason that I've long since refused to purchase anything more from Microsoft and have ditched Windows.

Good luck recovering your stuff.

>Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the account with help from support or even after visiting a brick-and-mortar store.

This happened to me. I was briefly a contractor at MSFT and was able to escalate the issue -- after a few years, these accounts get automatically deleted. It's likely that your account is completely wiped and no longer exists.

What really grinds my gears is the seemingly unstoppable global transition towards SMS to a mobile phone number as means of identifying an individual, conflated with "security" through 2FA, with this as the only option.

This is especially popular within Fintech.

Wise (formerly Transferwise) recently started requiring 2FA for signing in - SMS is the one and only option. Revolut requires it for acknowledging transactions and changing/viewing debit card info.

That legacy banks do this is expected, but I'm really concerned about this trend among newer global and big actors who otherwise present themselves as modern.

I strongly urge other users here to reach out to customer support of these companies and request them to supplement this with some other more secure means of 2FA, such as TOTP (hey, we gotta take what we can get), U2F, or Webauthn.

That isn't 2FA. That is a single factor recovery process. SIM-swapping only defeats SMS-based 2FA if the attacker also has your password, which is difficult to accomplish if you are using good passwords that are unique.

I had to remove this detail from my original post as it was too long:

Boost mobile is negligent and not following industry standards. Their whole security model is based on a 4-digit pin. At first I thought somebody had a script working its way up through all the combinations at the login screen, but I no longer feel that is the case. The fact that at least nine of us had this same issue within days makes me think there is a wide-spread issue here.

I don't have a source to hand, but I've heard from other post-mortems that in SIM-jacking attack the carrier has been socially engineered into not bothering with the pin, ongoing court cases RE negligence perhaps on-going.

If they're able to issue a new SIM card without the system requiring them to enter the PIN first, then it's a very terribly designed system.

The "industry standard" is that SIM-swapping it not difficult. Arvind Narayan's group at Princeton demonstrated this pretty convincingly. This isn't unique to Boost.

Does coinbase really allow account recovery with just an SMS? It seems to me like the attacker must have had more than just control over your SMS number.

Yeah the attacker now also has email control.

With just a SIM swap, isn't it possible for an attacker to reset the password on your main email account (e.g. gmail) via the phone, then from there reset the password on your money account through the stolen email?

Sorry you went through all that, and even more sorry that you'll probably be dealing with the fallout for quite some time.

I agree that SMS 2FA is not secure and a terrible idea. I've moved countries and my old mobile number has been given out to someone else. I don't even know what accounts I have might be tied to that phone number and I don't have any way to find out.

I have had friends message that person without knowing it as well. He could easily impersonate me on WhatsApp and fish for my personal info from those contacts.

Luckily, he seems to be a decent person but I not only have to trust this stranger to be honest, but also need to trust that the number stops at him or goes to another honest person if he drops it.

Phone numbers are not identity and using it for verifications of this sort is a horrible idea.

Not only is it not secure, it's not a constant for everyone.

I moved countries and I am now locked out of my bank account abroad since they verify logins via OTP over SMS.

I've signed up with voip.ms, which provides me a pay as you go sms number for basically $0/mo. since I only use it for auth.

Many services go out of their way to detect and block the use of VoIP numbers for SMS auth :s

What's the reasoning behind that? Maybe to prevent bots?

I'd start with VOIP numbers being so easy to spoof... and move onto the entire telephone network being insanely insecure and unverified, despite decades of efforts to link people to telnos -- until they implement actual caller-recipient full verification, they've effectively got nothing.

Maybe look into whether you can get a Skype number set up to receive the SMSs. Some countries/banks will work with this arrangement.

But I feel your pain. It is very frustrating situation to be in.

For some countries (USA) you can forward your number to a google voice number and retain incoming sms. Call forwarding isn't possible to my knowledge.

Why cancel your old phone number in that country when you still have a bank account there?

I suggest a bank which doesn't suck, such as bunq.

I would never think my phone # was the only proof of identity.

If that's what your bank had been using during the login flow...

Maybe they didn't know they needed a phone number to maintain access to the account?

Let's not blame the victim here.

The bank is at least equally at fault, if not more so.

if you immigrate, like I did, but still have some pension funds or saving accounts in your home country. Why would I want a local phone line?

So your bank can send you the SMS you need to sign in (which in itself indicates their security is poor).

One of the protections enforced in my country is this – for 24 hours after mobile number porting, all incoming/outgoing sms are blocked. And on both the current sim and new sim, notification sms are sent to inform the user that mobile number migration is occurring. This gives you the opportunity to notice and put a stop to it if it was triggered fraudulently. But of course there are corner-cases to this. If you are personally targeted in the meatspace, then all bets are off.

I forgot to include this in my original post. I use the Microsoft authenticator application to authenticate my account. My mistake was also including my mobile number as an alternative way to authenticate my account. I don’t know if I was aware of this or if Microsoft prompted me for my phone number at one time and I did not think through all the ramifications.

We set up multiple different types of recovery and backup and restore options for the saas pass authenticator and password manager to let you the individual be able to customize it as you wish.

The threat model is increasing for personal use as solely SMS based account recovery is becoming more widespread. The increase in crypto usage is another accelerant.

Good luck solving this unfortunate incident.

TOTP is the best.

The problem is how to effectively store the secrets for recovery.

This continues to be debated by so many, but like this person, the debate is meaningless in the face of realities. I'd refer everyone back to @taviso's work up of SMS "2FA". [0]

The amount of 'splaining going on in this discussion helps illustrate the trouble. If SMS2FA were actually fit for purpose it would not require so many internet defenders.

[0] https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm...

This is really interesting because of a few things:

* SMS authentication is not the same thing as 2FA, but people think that it is.

* SMS account recovery is convenient for the bad guys.

* The fact you got a welcome text from Metro PCS. If that was sent to your Boost device, someone from TMobile (they operate the networks that both Boost and Metro ride on) needs to take a look as that should not have been able to happen.

* In order to port a number you have to know the account security question's answer. Boost does have this. Was this bypassed?

SIM jacking is pretty easy. In Australia if you know someone’s mobile number and date of birth you can port a prepaid mobile. For postpaid accounts all you need is a bill.

The barrier is higher than random automated port scans but the value of being able to get access to financial accounts is high enough to justify the investment.

I use Authenticator apps wherever I can. Where I can’t, I use a completely private number for 2fa (I run a virtual number product that is like Google voice for Australians to do so http://www.benkophone.com)

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Not sure if the yay is sarcasm. Heroku will remove existing SMS as second factor from all accounts, effectively making those accounts less secure. Yay Heroku! (Sarcasm intended)

Yep. They've been planning that for awhile, hopefully a case of "leading by example". For me hardware keys (U2F) with TOTP as a backup are really essential. I've purged SMS where I can. Unfortunately, too many (like banks) have stopped at SMS and email as options -- and that only recently. My (insert name of wildly popular open source password manager here) vault is secured by U2F with TOTP as a fallback, and I use its TOTP feature to secure logins for less sensitive services. Someone mentioned building in delays for resets: that's actually how both the US IRS and Social Security roll. Last time I reset SSA I had to wait for a physical letter with further instructions. Inconvenient, but probably a step in the right direction. If government intel agencies weren't so uptight about crypto, we could all have our own officially issued crypto keys by now. But no. The prols can't be trusted -- and don't deserve it anyway.

Making existing accounts less secure by removing a second factor is not “leading by example” in my book. Just make me pick a different second factor on my next sign-in.

For whatever it's worth, the US government has shown itself to be spectacularly bad at keeping secrets (proof left as an exercise for the reader).

Unless they are requiring everyone to use 2FA, isn't that objectively worse than having the option of SMS 2FA? I'm sure there are a significant number of people who would just switch back to using a password instead of SMS 2FA rather than having to get a non-SMS second factor, since it is much less convenient than just putting in a phone number.

Well... I think that if they don't require 2FA, then, well, they don't require 2FA, and not having SMS is neither worse nor better.

If they do require it, then I believe the consensus is that 2FA via SMS is a very bad choice. And since Google Authenticator (and other such apps) are free to download and use, it's not really a burden.

Nothing is secure against a determined targeted attack. That's why we have layers of security. SMS 2FA adds a layer of protection against random attacks, and for that it works great. It should never be solely relied upon for high value accounts.

To the OP,

Please don't use cheap providers like Boost. I have done audit and I found Sprint to be superior; however, they got merged with T-Mobile now. Sprint was the best provider that prevented most hijacks.

That's pretty neat, can you describe what you check when auditing a network?

I think crypto companies should block withdraws for a period of time after a password recovery.

(OP, you are calculating your losses, but didn't specify what those losses were. Did the theif get your crypto?)

Coinbase has extensive access to mobile provider data. They can see when number ported and what phone the thief uses, but it's really hard to make decisions.

I have not regained access to my bitcoin account, in part because I have not contacted customer support to do so. I’ve been too busy regaining access and continuing to support my client base.

My account is locked, and I am pretty sure my funds are still there. It will be a significant loss, but not devastating as this was my non-primary investment account.

I still don’t know the full extent of my losses.

So far, my losses are primarily loss of billable time. I am not a litigious person, but I am also going to educate myself as to what ‘pain-and-suffering’ means. Both my personal and business bank accounts are ok. I now understand why banks do not use email addresses as the login id. The thief would not (easily) be able to align my email address with my bank login id.

Once through this, I plan disassociate any portion of my login id with my name.

> I now understand why banks do not use email addresses as the login id. The thief would not (easily) be able to align my email address with my bank login id.

This is an important point and one I've been thinking about for years. There's so much discussion about using password managers and good password practices and 2fA but almost no discussion on how using a single identifier to log into all these various services is in itself a huge security vulnerability. If we had different login usernames for each service, gaining access to people's accounts would be that much more difficult.

Email should be reserved for communications and not double as a means for authentication.

If your crypto was stored on an exchange then this is par for the course; rule number one is that if you don't control the private keys, the coins are not yours.

You haven't even tried to regain access to it? Instead of spending time on HN you might want to reach out to Coinbase.

Agreed. Done. "Thanks for taking the time to contact us. We're currently receiving a high number of requests so we may take longer to respond, but our team is working hard to get to every inquiry quickly."

i thought coinbase did just this.... either made recoveries a multi-day thing, or disallowed transfers afterwards. maybe that was blockfi.

Recently Mozilla started requiring 2FA for their AMO site used to publish addons. I have a few private addons that I develop and use, nothing big yet, but I really didn't want to link anything up with 2FA over SMS and I'm also trying to reduce my "Google footprint" so instead I selected their only alternative that doesn't use a centralized third party.

It was a bit complex, but I eventually got Keepass to generate the TOTP codes which so far are pretty awesome.

For anyone in the US wondering, Ting and Google Fi both allow authenticator-exclusive 2FA. I’m very happy with Ting.

But the banks and crypto exchanges are blocking VOIP numbers like Google's

Very true.

I think it's a shame most banks (at least here in the UK) implemented 2 factor auth with sms only just to comply with "strong" auth regulations.

Authy on your phone or multiple u2f tokens are definitely better than SMS.

I wish computer manufacturers started including tokens with computers, so that at least people would start using them.

Yet Apple, SendGrid, any many other require it.

Not only is SMS two factor authentication not secure, it weakens the security of accounts it is enabled on.

Experts know this (because it's obvious) but large companies like Google continue to insist on using it either because they like the data collection or because they're just covering their asses.

The unstated point here is that SMS as a second factor very often leads to companies using SMS as an alternative factor. This is what makes giving companies your mobile number for SMS 2FA a risky proposition.

I'm not sure it's true that Google insists on using it. Sure, they'll use it as a second-factor by default - but you're not obligated to use it, can use app-based authentication, and can use MFA with a hardware key too.

Yup. My Google account will not use SMS as a recovery method. U2F with backup codes is all I have enabled.

Can you explain how I'm weaker with 2FA via SMS than without 2FA? I agree SMS is not good 2FA but your statement is more extreme.

Because companies routinely and silently use SMS 2FA as SMS 1FA.

But that's not an inherent problem of SMS 2FA. It's just bad implementation.

No, the inherent problem of SMS is that it can be stolen/redirected. Given that, and given that companies are too eager to use it as 1FA, you shouldn't use it.

If I'm giving advice to companies, I say "don't use SMS 2FA as 1FA" (well, I actually say "don't use SMS 2FA at all, it's too tempting for a support person to use it as 1FA"), but this thread is about the user, and as a user, you shouldn't use SMS 2FA.

If I didn’t have SMS-2FA enabled, they would not have been able to take control of my email address without guessing the password.

SMS 2FA isn’t secure, but what about a small retail/delivery business that uses SMS as the only means of authentication?

Payment is not done over SMS but separately through cash or Venmo, so it seems like the worst that could happen is a delivery gets nefariously ordered for someone who didn’t want it.

It all boils down to the fact that the states don't have a reliable identity verification system. Can't securely recover accounts, have to resort to silly 2FA methods, and so on.

I made a point about this previously and unfortunately, your situation is exactly the reason why SMS authentication should be avoided, since these sort of attacks are now becoming common. [0]

[0] https://news.ycombinator.com/item?id=27311641

I had to go look for how people might be able to hijack the SMS system. This led to [0], which was discussed on HN about three months ago [1].

Interesting, yet an attacker would have to spend some amount of money per attempt. Unless they are targeting high value individuals this does not seem a likely threat for the average person.

Other methods exist, such as SIM-jacking [2]. I wish the article included a list of phones that might be vulnerable to this attack. Are iPhone's vulnerable?

And yet, while "free" this still requires a massive automated net to be deployed in order to gain some information and then socially engineer your way into gaining access to sites and services that might be of value.

I guess my question is: How common are these attacks? What's the scale of the activity? I have never heard of anyone in my immediate and even extended circles having any such issues. OK, I have indoctrinated most of my family into not clicking links in SMS messages and most of my extended circles are technically savvy. What does this look like in the general population?

[0] https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... [1] https://news.ycombinator.com/item?id=26468892 [2] https://medium.com/auedbaki/how-hackers-hack-phone-using-sms...

Too bad there are those that still only allow SMS, e.g. Sony. Patreon used to be the same.

You're thinking about this wrong.

SMS 2FA is not for you.

They say it's for you (for your security or your protection or your ease of use or whatever) but that is a lie.

In cases where SMS 2FA is forced, to the exclusion of all other proofing mechanisms, it is generally because the provider has a brutally difficult spam/scam problem that is complicated to solve.

So, instead of solving their spam/scam problem, they just throw some sand in the gears (of their users) and very loosely attempt to piggyback on the physical phone / physical SIM / physical ID confluence that constitutes a "normal user".

This is, of course, a very leaky mapping and anyone determined can, of course, work right around this. But it does seem to lessen their (again, brutally difficult) spam/scam problem.

The most ironic deployment of this (desperate) technique is Twilio whose own numbers cannot be used for SMS 2FA auth[1] and yet they require a true, mobile (non-VOIP) number to use their own service.

[1] Twilio numbers are not mobile numbers. Most SMS 2FA is sent from "short codes" and short codes cannot SMS non-mobile ("voip") numbers.

Recommend

Two-factor authentication

Is It Really Two-Factor Authentication?

Tutorial: Two-factor authentication with Meteor and TOTP

What is Two-Factor Authentication (2FA) and Why Should You Use It?

How to Set Up Two-Factor Authentication in Slack

Why TOTP is better than SMS for two-factor authentication

How Secure is Two-Factor Authentication (2FA)?

Two-Factor Authentication With SMS in ASP.NET Core

Twitter’s SMS Two-Factor Authentication Is Melting Down

Twitter's SMS two-factor authentication is now a paid feature | TechSpot

About Joyk