A lot of people say that. But SMS 2FA is better than nothing.

Is it though? Implementing SMS 2FA often means a site will never bother implementing anything better.

Not implementing SMS 2FA doesn't mean a site would implement anything either.

No, but it's increasingly becoming the expectation that 2FA should be available.

Going from no 2FA to some 2FA is a more likely transition than going from bad 2FA to good 2FA (since bad 2FA still checks the 2FA box).

Not really, it becomes very difficult to remove a phone number from an account and anyone who gains access can use various account recovery mechanisms which rely heavily on access to that number for authentication.

Nope, not if it introduces common customer support backdoors.

If it is enough with access to the phone number, no password needed, then it is no longer 2FA.

Sure, but 17 websites do this. For those websites you introduce significant weaknesses if you enable SMS 2FA.

https://www.issms2fasecure.com/

Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA?

Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option.

Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That would be news to me.

The back door is either automatic or human account recovery tools.

These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched.

Phone numbers are very public and easy to steal in ways which are difficult to defend against.

Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how hard would it be for that person to recover and retain access to their accounts and services?

With SMS 2FA someone who knows you personally and has control of your phone number is nearly impossible to escape.

All the adversary has to do is say "oh this was linked to my old number" and account support is super likely to just give access away.

You would have to be somewhat of an opsec expert to escape that hell, and even if you know everything it becomes impossible to defend yourself against the owners of your accounts giving access away.

The only real defense is to never associate your phone number with personal accounts which even then is often not possible.

You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA.

I agree with everything you said about SMS for account recovery.

Account recovery that uses a phone number is weak. There was a paper on HN this week that detailed this.

However, if we are going to compare SMS 2FA (I.E. password plus code sent over SMS) against just password, SMS 2FA wins. In both cases I need to steal your password, the SMS part is an added challenge although it's easier to bypass than many people want.

Given SMS 2FA and any other 2FA option, SMS 2FA loses.

In an idealized sense, sure. But not for a practical situation.

SMS as an authentication factor weakens the security because of all of the additional behaviors associated with the account provider which are inescapable.

Edit: looking again, I see what I missed.

> The only real defense is to never associate your phone number with personal accounts which even then is often not possible.

Yes that's exactly right. If I don't trust a website to not use my phone number as the sole factor for recovery, then I should not use SMS 2FA on that site and I should not add my phone number to any part of my profile. If I know (how?) that the website won't use SMS for recovery, then SMS 2FA is better than nothing.

As a website owner, if I offer SMS 2FA auth and use SMS in isolation for recovery, then I'd want to stop using SMS for recovery. After that, removing SMS 2FA and not offering any second factor would weaken my security. I.E. SMS 2FA is weak but better than nothing. SMS single factor recovery is terrible, fix that ASAP.

It's one of those things which, technically, can be done correctly. However, it isn't. It provides an incentive to do bad security which is bad for providers because their security will have a tendency to devolve into bad-factor recovery and it's bad for users because it makes them comfortable with a security factor which is easily defeated.

It might be good for your use case, but systematically SMS is bad for security in a global society sense.

> Imagine someone in a domestic abuse situation

Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think all 2FA can be bypassed with that, if not most of modern cryptography.

https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis

> having their phone taken

Keep in mind that other 2FA methods also are phone based, like TOTP / Google Authenticator. Those also fail if your unlocked phone is taken. SMS is even weaker than those, but still better as a second factor versus nothing.

It is, in many ways, a worse vulnerability than rubber-hose cryptanalysis. When you run away from the person with the hose, you can change your passwords and they won't be compromised any more.

If somebody has your phone, a physical address associated with you, and some basic biographical information, they can continue recovering access to your accounts in a way which is difficult to escape, especially because of the misplaced trust in using phone numbers for security.

The threat in that situation is being vulnerable and having to digitally escape as well as physically escape, and if you don't do both simultaneously you can be continuously compromised in a way which is very difficult to succeed.

SMS 2FA introduces problems that no 2FA doesn't have. Sites can start spamming my number with notifications, or using my number for ad targeting.

Twilio offers a service to send SMSes via an API. Of course they're going to tell you to use this.

SMS 2FA is still stronger than no 2FA.

Sure but SMS 2FA is almost always SMS 1FA with a password that can skip the SMS on saved devices.

SMS 1FA isn’t stronger than a good password or a pw manager but I think it’s fair to say that it’s better than the typical password.

Recycled phone numbers makes that untrue.

For low-stakes auth or simply duplicate user prevention SMS is sufficient. E.g. dating apps, sharing economy services, e-commerce sites.

Taking over accounts is mainly American thing, the rest of the world is using same method to identify yourself to a telecom company - by providing your ID card or passport.