You don’t need SMS-2FA

http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html

by beefhash • 6 years ago

33 66 6 years ago

blog.cmpxchg8b.com

He's arguing not just against SMS-2FA, but against 2FA itself, and his simple solution is to "just use a strong password".

The author completely misses the point about the value of 2FA itself. I agree SMS-2FA is not good, but that doesn't mean 2FA is worthless.

UncleMeat10• 6 years ago

Sort of. He discusses the benefits of phishing resistant approaches like u2f later in the article.

pkulak2• 6 years ago

I guess he was trying to specify 2FA that's NOT u2f, or other very strong options. But yeah, in principal, he's really talking about SMS, TOTP, et all. Bit of a shame, because TOTP itself is far better than SMS. It's all a sliding scale of security vs convenience.

packet_nerd3• 6 years ago

Except it's not really a sliding scale with SMS being "easy" and U2F being "hard". U2F is SO much more convenient than either TOTP or SMS. SMS might be a little easier than TOTP, but with either one you still have to (1) find the phone, (2) unlock it, (3) hunt around for and open the app, (4) manually type the code in, often looking back and forth between the phone and webpage 2 or more times before you get it. Compare to just taping the U2F key with the side of your finger (assuming it's already plugged in, which is what I do). There's just no comparison in terms of UX between U2F and anything else I've ever seen.

jsnell2• 6 years ago

There are security dimensions on which TOTP is worse. It's plausible for the SMS code to contain enough information about the login attempt to make the user realize they're being phished.

"Are you trying to log in from Ukraine? If yes, the code is 123456."

"Bank tranfer of 10000 EUR to account XYZ: verification code 987654"

TOTP obviously can't do this.

hprotagonist• 6 years ago

SMS 2-factor is wrong and bad and NIST has been yelling about this since 2016 or before. Simjacking is real and fairly commonly used in targeted attacks.

2-factor as an idea is great, and this author seems very confused.

jandrese2• 6 years ago

SMS should only ever be used as a proof of investment. IE making sure a bit setting up hundreds of thousands of accounts (because they broke your CAPCHA) needs to buy tens of thousands of real phone numbers with service.

It’s a one time thing at account creation and should be immediately deleted afterwards.

Real 2FA should be set up afterwards to actually protect the account. A yubikey or even a simple TOTP app is a lot of protection against account takeover. The only big weakness left at that point is the help desk.

UncleMeat10• 6 years ago

TOTP app

This is only very marginally more effective than SMS. Phishing is way more common and can be automated much more easily than SIM-swapping. With TOTP you close a small window but leave the big door open.

Yubikeys prevent phishing, which is enormously valuable.

frei2• 6 years ago

All the arguments in the post against SMS 2FA are also arguments against TOTP

lostmsu3• 6 years ago

I did not get the explanation for why SMS 2FA does not work against credential stuffing. It clearly does.

UncleMeat10• 6 years ago

He is thinking of it from the user’s perspective rather than the service. If I reuse my passwords I still get owned even if some of my services use 2fa, because others won’t.

It’s an unusual way of thinking about it and I think the weakest part of his argument but it is interesting.

lostmsu3• 6 years ago

Yeah, that basically destroys his argument. If I use the same password for a random internet forum with no 2FA and my bank account with SMS 2FA, then a person, who breaks into the forum DB still can not access my money.

33Backpack334• 6 years ago

It doesn't stop it but delays it. The attacker seeing a SMS 2FA screen doesn't mean they give up, it just means the user is now more valuable. This explains it https://passwordbits.com/dont-need-sms-2fa/

scott_s4• 6 years ago

I believe the arguments that SMS-2FA is not effective against phishing. (Or, at the least, I can't provide a compelling counter-argument.) But I had always thought of SMS-2FA against a more banal problem:

1. You have a unique, long password with Foo.

2. Oh no! They store your password in plaintext, and their security is terrible, so your username and password are part of a giant data breach from Foo.

3. Before you know about it and can change your password, someone that is not you, who does not have access to your phone, tries to log into the account.

4. While out living your life (or in, these days), you receive an SMS from Foo, and then ignore it.

5. There is no step 5, as no one else is getting in.

6. Okay, fine, you caught on, and now you log in and change your password with Foo, or maybe just drop the account, because really.

It seems to me that SMS-2FA helps in this scenario. Am I missing something obvious?

UncleMeat10• 6 years ago

Tavis discusses this explicitly in the article. His claim is that there will be some other service that doesn’t do this so the user is still vulnerable to credential stuffing - just not on your service.

I don’t fully buy the argument, but he didn’t just ignore this.

More valuable, I think, is the claim that we only get so much bandwidth to educate users and that spending time educating people on unique passwords is more effective than working on sms 2fa.

toomuchtodo• 6 years ago

Users are lazy. You can educate all you want, they will still use the same passwords everywhere, or weak passwords. You have to bake the security into your workflows, processes, and code if you want it to matter.

This is from infosec/opsec awareness training experience I get paid to provide. Not all users are lazy, mind you, but enough to be emotionally depleting. Incentives matter.

scott_s4• 6 years ago

But I'm already immune to credential stuffing because I have long, unique passwords, no? And credential stuffing would be taking my username and password from Foo and using it with Bar, right? But I'm talking about the username and password from Foo being used with Foo.

OrderlyTiamat• 6 years ago

there will be some other service that doesn’t do this so the user is still vulnerable to credential stuffing - just not on your service.

"If they don't practice good security, why should we?"

The other points would have been stronger if he'd just admit that there is this small advantage to sms2fa. As is, he's making a ridiculous argument in an attempt to make the issue wholly black and white.

jedimastert• 6 years ago

It seems to me that SMS-2FA helps in this scenario. Am I missing something obvious?

It's not necessarily scalable, but sim-swapping[0] is still an unfortunately serious issue. Phone numbers are not proof of identity

[0] https://en.wikipedia.org/wiki/SIM_swap_scam

RcouF1uZ4gsC• 6 years ago

But sim swapping is more a targeted attack. There are probably several orders of magnitude more opportunistic attacks than targeted attacks.

If you can make opportunistic attacks fail and require targeted attacks, you still have a big advantage.

ldiracdelta• 6 years ago

Security is an economic effort. They have to have two things now, which at least doubles the difficulty if not even more. We dont drive tanks and wear helmets and use a 5-point harness while driving at 15 mph to get around, because we have to actually get things done with our tools and systems without going bankrupt or starving to death.

wolco3• 6 years ago

What I see happening in real life is..

Hacker has access to Foo that's how they got your creds. If they want more access they will use the admin account to gather all info Foo knows.

Hacker picks a global service. Paypal, gmail, appleid, godaddy and tries all usernames/passwords.

When they hit 2fa they attempt a code. 99% of times it fails. You get a warning/change the password and get scared.

User receives an email saying that you have beenhacked. They have proof you did something illegal or something illegal has been planted. Send bitcoin here or this video will be sent to all of your friends/work/family.

----

2fa usually locks you when you need it the most (no battery/texts not going through/paid bill latertexting is turned off can cause this)

basch• 6 years ago

My problem with SMS-2FA is when it becomes a single factor back into the account.

It should never be the only factor required to reset a password. It should always be an option to disable. (Smaller financial institutions seem particularly to fall into this one, "its for your security.") It should be granular enough to give the customer control of what it can and cannot be used for.

The big thing being missed here is that all organizations should be expected to block any leaked password in the wild from being used. Banlists are rarely used by any entity except the largest. SMS-2FA is a step in continuous improvement, not a destination. It is also being used to either check compliance boxes or as a part of security theater. The hoopla, range, and witch hunt energy should be repurposed to get everybody using password banlists.

33Backpack334• 6 years ago

If they made it that far to get your password why do they need to log into your account? Having multiple locks on your door don't matter if they got in through a window.

wyc• 6 years ago

Yes, it's true that SMS-based authentication has its flaws, but it's far from useless/harmful in many contexts. The same strawman arguments used here would also find TOTP "wholly ineffective" which is an absurd conclusion.

A main goal of security engineering is to increase the difficulty level for attackers. SMS authentication has demonstrated its ability to do this in a highly accessible, albeit imperfect, manner. I feel that the author severely underestimates the practical difficulties of widely deploying "Unique Passwords and U2F".

I strongly disagree with the conclusion that "SMS-2FA is not only worthless, but harmful" and highly recommend consulting a security professional before entertaining any of the arguments or following any of the suggestions in this article. I don't like leaving negative comments, but this is at best borderline misinformation that has the potential to create severe consequences.

Some more context, if you want to consider a more balanced perspective: https://doublepulsar.com/infosecs-fantastic-fear-of-everythi...

exabrial2• 6 years ago

I would argues SMS is worse than "nothing at all", as it moves the responsibility [unwillingly|unknowingly] to the person's carrier, who likely [demonstratively] are not hardened against attack.

packet_nerd3• 6 years ago

Regarding the "SMS-2FA is not only worthless, but harmful" claim, it's true, but only in the sense that widespread "lazy" SMS 2FA deployments stifle U2F, which, I believe, should just be the standard across the board[1]. Of course SMS does help, just not as much or in as many attack scenarios (and is more of a UX pain too).

[1] The common HN objection which you alluded to is "but it's so hard!" It's really not. Passwords are hard! If only I could have back all the hours I've spent trying to help my grandparents remember their passwords. I have a U2F token plugged into the side of laptop and nothing could be easier than tapping it to get in. Implementation might be hard, but come on, that's our job.

jolux• 6 years ago

Tavis Ormandy is definitely a security professional, he works for Project Zero.

exabrial2• 6 years ago

SMS 2FA exposes a person's cell phone account to attack, and the carriers aren't hardened to handle it. Jack Dorsey getting hacked proves how stupid using SMS for anything. Please, implementing this. Use FIDO U2F or TOTP. It's not that hard, my 70 year old mother has it enabled and has no issues with it.

freeone3000• 6 years ago

Okay, the argument about credential stuffing is fairly weak. 2FA on a given service makes it an ineffective attack against that service. If you have 2FA on all of your services, credential stuffing won't work on any of them, so you're then immume. Moreover, not all services are identical - Email merits two distinct hardware keys, my Steam account warrants an emailed password, my BeerAdvocate account... probably doesn't need anything.

jsnell2• 6 years ago

Unfortunately, it doesn’t work like that. When a service enables SMS-2FA, an attacker can simply move to a different service.

That argument is just nonsensical. If you're a provider, the user being compromised on some other service doesn't really matter (and there's nothing you can do to prevent it anyway). While preventing the compromise protects the platform from abuse, saves on customer support on having to help the hijacked user recover, etc. While if you're a user, obviously it's better to be hijacked on as few (and as unimportant) services as possible.

Instead, why not simply randomly generate a good password for them, and instruct them to write it down or save it in their web browser?

The users don't know how to save a password in the web browser. They'll lose the piece of paper. They'll be unable to log in, and effectively end up in an eternal loop of recovering their account (with SMS!) every time they log in, and getting a new password they can't remember. If you end up sending the user an SMS anyway on every log in, might as well use the version where you get to use knowledge of the password as a gating factor.

If we spend all that good will on irritating attackers, then by the time we’re ready to actually implement a solution, developers are not going to be interested.

I'm really not sure what this is referring to. Other than this comment, I thought Tavis was railing against forcing users to do SMS 2FA. But then it turned out that the resource he is concerned about is developer goodwill, which doesn't really make sense.

There are a few classes of developers.

1. Huge companies with security teams that are willing to entirely implement their own authentication systems. Their goodwill is not going to be exhausted, since they're implementing what those teams think is the best for their platform's security.

2. Companies with potentially sensitive data who outsource some or all of the authentication to some kind of identity provider or identity platform. Their goodwill won't be exhausted: they'll just expect the provider to implement whatever the best practice is at any time.

3. Companies that don't care, and just roll their own username + password auth. They aren't going to implement SMS 2FA any more than they would implement U2F.

shawkinaw• 6 years ago

> Unfortunately, it doesn’t work like that. When a service enables SMS-2FA, an attacker can simply move to a different service.

Yeah I really don't understand their argument here, to the point that I feel like I must be missing something.

radlad2• 6 years ago

> Unfortunately, it doesn’t work like that. When a service enables SMS-2FA, an attacker can simply move to a different service.

Furthermore, the suggested alternatives of U2F, WebAuthn, and FIDO would behave exactly the same! (Excluding perhaps passwordless authentication utilized by the hacked website.)

tialaramex3• 6 years ago

The stored credentials for WebAuthn aren't useful for impersonation. They consist of an opaque identifier useless except for triggering the verification on that particular site, and a public key which is... public.

So this (quite deliberately) renders it immune to credential stuffing.

If your system stores both WebAuthn credentials and a password (e.g. to enable cheap FIDO dongles as a second factor to the password) then the passwords could be used in a credential stuffing attack against other sites. But if you don't store passwords and use WebAuthn to handle both factors (e.g. Touch ID plus physical possession of the iPhone = two factors) then you don't have any credentials that can be used by an attacker, none at all.

FabHK2• 6 years ago

But then it turned out that the resource he is concerned about is developer goodwill

I think he's concerned about user goodwill (to comply with "annoying" security stuff).

33Backpack334• 6 years ago

This article goes more in depth and answers the questions you bring up https://passwordbits.com/dont-need-sms-2fa/

zachrip• 6 years ago

The thing I find odd about sms 2fa is I sometimes get multiple services texting me through the same short code. Isn't that a security hole in itself? If a user recognizes a number as the "security number that texts me sometimes" and I as an attacker know this, couldn't I somehow abuse this?

For example: "Please go to x url and enter your password" -> user enters pw -> show new form with 2fa code input (and in the background, try logging into their account with the pw supplied) -> user gets another text from the same number, enters in your site -> profit???

7786655• 6 years ago

After multiple experiences where I couldn't log into an account due to not having a phone signal, I refuse to use SMS-2FA on any service. Given that I already use strong passwords, the marginal security advantages are far outweighed by the potential lack of availability.

thoraway1010• 6 years ago

I've got the dual yubico key thing going. It seems to work fine. I don't need to pick overly complex passwords if I don't want to.

Google does this well. Yubico Security Key + they seem to monitor my logins / rate limits etc.

I deal as do many folks with relatively to extremely sensitive info (yes, also have stuff on auto-delete).

Complex passwords require a password manager - if those get updated and rooted then my yubico seems to save me again.

In fact, with yubico I have a few passwords I memorized that aren't TOO crazy long - with a 2FA hardware key you may be able to SIMPLIFY passwords and still have good security.

And the yubico is EASY! Clip it to your keychain and go.

frei2• 6 years ago

The prescriptions in "If you’re a security conscious user..." make sense to me. If you use a unique password, sms/totp adds very little benefit.

However the section for "If you’re a security conscious vendor..." doesn't make sense. Credential stuffing is so common, and sms/totp is a great tool against it. You could prevent users from setting their own passwords, but that seems a little "too different" from existing sites that it could harm usability.

tbp105• 6 years ago

I think this misses the point... do you need your own auth at all?

Security is only as strong as the weakest link. If you have a "forgot password" that emails you a login or a "lost/changed phone" that removes the sms, don't bother even having the password or sms.

Falling back to email means you've just pushed your auth behind the email's auth. Just use it directly by using oauth with google, o365, facebook or whatever makes sense for your target audience and be done with it. If you are b2b, use saml.

haecceity• 6 years ago

It could be used to deter users from making multiple accounts. It won't stop determined spammers though.

You don’t need SMS-2FA

Related Stories