For _them_ easy phone number porting, customer service reps being able to "fix" a paying customers message problems, and making it as easy as possible to have their customers send and receive more SMS messages are all directly bottom-line positive things.

Making any of that _harder_ for their customers will only reduce their profits and increase their support costs - at zero benefit to the Telco.

Your bank or ISP or email provider's security is not the Telco's problem - and they can't be expected to invest effort into it on behalf of non-paying 3rd parties...

This is what my local Telco Alliance told the banking industry here in .au back int 2012 (and 've kept it bookmarked ever since for all these discussions...):

"Stanton told iTnews that the telcos have decided not to extend the security mechanism protecting the mobile number portability database for reasons of competition and database performance.

Apart from making the porting process more time-consuming and less convenient for hundreds of thousands of Australians every year, additional ‘security’ may be seen as a tool to lock in customers, hinder number portability and thus be deemed to be anti-competitive," he said"

http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...

It also introduces yet another 3rd party reliance and avenue for attack - Brazil and Turkey have blocked Whatsapp recently, and India and the UK have discussed it as well. I doubt Id want to rely on my Whatsapp 2FA tokens arriving in China either...

Almost all the newspapers in Germany have WhatsApp newsletters, and you can get TV news as video message every hour via whatsapp, and so on.

WhatsApp announced some API for those use cases though.

Nope, this is the answer to the recovery question ;-) which amounts to a password anyway. I wish recovery questions would just die finally.

A pattern I've seen often is people not remembering their password and just resetting it via SMS each time, making SMS 1FA. Although very real, taking the real-world risk of SIM cloning is pragmatically still better than reused, ridiculous passwords and/or ones that end up in leaked lists which amount to no auth.

TFA has been empirically proven to be effective, why is this recommendation being made? I can't find the answer in the article or the Github.

Phone 2FA is, to me, a bad idea as SMS was never designed as a secure transmission and there's a number of known unfixable weaknesses as a result

1) many OS's are allowing SMS to be viewed on the user's computer. so a standard malware attack can get both the password and access to SMS

2) Web sites exist to provide access to a users SMS messages for a number of providers. So an attacker who compromises the PC gets access to SMS messages as well.

Whilst app based 2FA (e.g. google authenticator) isn't perfect, it's better than this, and should be what companies are aiming at in 2016...

Sure Google allows you to port authenticator data with an easy 5-step process. Almost nobody else does even this.

Without portability, it means losing access to your Facebook, Instagram and Pokemon Go when you change your device? People would revolt if you do that.

So what's the alternative? We either use SMS, or we use email (which will have like order of magnitude higher failure rate with no added security) or we don't use 2FA at all. Or we think really hard and invent better 2FA than SMS that works on every mobile device and is simple for the user. Then we can deprecate SMS.

Proper implementations of TOTP do not just rely on expiring the codes. From chapter 5.2 of RFC 6238: "Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."

If it accepted the same token more than once, it couldn't possibly be called a "one-time password".

Oh wait, what was this article talking about again?

That said, Authy is pretty convenient for most users as far as backups are concerned, and I'd imagine its at least as secure as storing the database in iCloud/Google Drive. They at least do ensure two factors (albeit a soon-to-be deprecated SMS factor) to get the raw data.

For my phone, at least, I can get a program that does all the rooting for me with a click.

Does such a think really exist?

More to the point wouldn't adding an (optional) standard push notification API to TOTP clients be a better solution. You login, your phone pops up a notification, you hit accept on the notification, done. Way less annoying than even SMS.

How would that work when you're trying to login on your desk/laptop?

For banks, for example, I already have a banking app on my phone (which was originally authenticated via, ahem, SMS), so they could very easily put the OTP generator there.

Secure to-device messaging over IP would work. Perhaps if you narrowed it to authentication the telco providers wouldn't see it as a threat to the very, very profitable SMS feature.

It was a bit of a hassle, but not enough to be a showstopper.

I wonder how this is implemented - when Apple sends me an SMS 2FA code, do they pay extra because I'm abroad?

That's mainly a texting fee since that only gets you unlimited SMS, not data or voice. If you don't get the Passport plan in advance, sent texts go from free to 50 cents each.

When I travel Europe, when I'm in the country that issued the SIM in my phone, sending texts are maybe 3 cents, if I leave that country they're maybe 9 cents. Receive was always free.