News for hackers. Stuff that matters.

A comment on Reddit Security Incident. Parent comment

Re:Reddit Security Incident by mikeash on Wednesday August 01, 2018 @01:31PM (#17664748)
It should be noted that using SMS as a second authentication factor is always more secure than just using a password. As long as you understand its limitations, it makes things more secure.

Where so many companies go wrong with SMS “2FA” is by treating it as an alternate authentication method, rather than as a second factor. If you can reset the account password over SMS then you’re boned.

[ Parent | on HN ]
Re:Reddit Security Incident by foepys on Wednesday August 01, 2018 @01:53PM (#17665018)
Not necessarily. Some services allow you to reset your forgotten password with a 2FA token. If your 2FA token comes by SMS, your account security relies solely on SMS. Yes, this bad practice. Yes, you should not do that. Yes, you actually only have a single factor then. But some do it that way, so don't use SMS.
[ Parent | on HN ]
Re:Reddit Security Incident by mikeash on Wednesday August 01, 2018 @02:12PM (#17665230)
That’s the whole point of my second paragraph. SMS 2FA is fine, but SMS recovery masquerading as 2FA is not.
[ Parent | on HN ]
Re:Reddit Security Incident by ReverseCold on Wednesday August 01, 2018 @03:30PM (#17666115)
> Some services allow you to reset your forgotten password with a 2FA token

Don't do this either. It makes 2FA into 1FA.

[ Parent | on HN ]
Re:Reddit Security Incident by tptacek on Wednesday August 01, 2018 @01:38PM (#17664838)
It's not more secure if you use SMS as a 2nd factor and then reuse passwords everywhere, which is a thing a lot of people do.
[ Parent | on HN ]
Re:Reddit Security Incident by nolok on Wednesday August 01, 2018 @03:07PM (#17665873)
I'm not sure I fully agree, in a situation where you reuse passewords everywhere, having SMS 2FA on top of it is still more secure that no 2FA at all, it makes it harder/more costly to break through.

My understanding of it is if you can use anything other than SMS 2FA then use that and remove SMS, but if your choice if between no 2FA or SMS 2FA then go with SMS. Also, use it stictly as 2FA, not as identity.

This is not my area of expertise so if I'm wrong I would genuinely like to understand why.

[ Parent | on HN ]
Re:Reddit Security Incident by tptacek on Wednesday August 01, 2018 @03:26PM (#17666076)
I don't think I'm being clear. I'm saying that in the presence of SMS 2FA, people use weaker passwords than they would otherwise. The SMS 2FA itself weakens their security: they remain vulnerable to targeted attacks and gain a vector for targeted attacks.
[ Parent | on HN ]
Re:Reddit Security Incident by reitanqild on Wednesday August 01, 2018 @04:03PM (#17666434)
Do you have hard data?

My feeling after supporting end users on and off since '95 is they won't differ if they have 2FA or not.

[ Parent | on HN ]
Re:Reddit Security Incident by SpaethCo on Thursday August 02, 2018 @12:44AM (#17669276)
You find examples like this all over the place:

https://security.stackexchange.com/questions/49521/does-two-...

It gets worse if you search around for people talking about how they use 2FA codes to protect their accounts when logging into services on public computers.

The perception of the security added by 2FA emboldens people to make all kinds of poor security choices.

[ Parent | on HN ]
Re:Reddit Security Incident by alex_anglin on Wednesday August 01, 2018 @03:00PM (#17665809)
I'd suggest that it is, but not as secure as alternatives others have discussed.

.. which isn't to suggest either password reuse or SMS TFA is a good idea.

[ Parent | on HN ]
Re:Reddit Security Incident by SaltySolomon on Wednesday August 01, 2018 @02:00PM (#17665094)
Yeah, because not using a second factor is less secure than using even a middling one?
[ Parent | on HN ]