Re:Tell HN: SMS-based two-factor authentication is not secure
by jsnell on Wednesday June 09, 2021 @03:26PM
(#27452021)
Here's the same story without 2FA:
"You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course. It was a phishing website. Your bank account will be emptied."
It did not reduce security.
Re:Tell HN: SMS-based two-factor authentication is not secure
by tialaramex on Wednesday June 09, 2021 @03:48PM
(#27452258)
But in your revised story I don't receive reassurance that everything is going as planned. That's what I'm getting at, the SMS step is reassuring even though it actually shouldn't be.
Re:Tell HN: SMS-based two-factor authentication is not secure
by jsnell on Wednesday June 09, 2021 @05:47PM
(#27453683)
If there is no 2FA, not being asked for a confirmation code is things going as normal. Also, it's totally irrelevant whether the user gets cold feet since in the password-only world they've just handed away the keys to the kingdom.
You are forgetting social engineering. Humans find it reassuring that the security process happened as usual, even if in fact the apparently "usual" process was them being being phished. This can mean they're actually less alert than they would be otherwise.
You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course, and then it tells you that you'll get an SMS and to type in the code so you do so. Phew! Disaster averted! Right? This must have been real, you even got an SMS from the bank.
Alas the SMS was from your bank, and the bad guys didn't have a way to intercept it, but they didn't need one because you typed it into their phishing website. That unexpected $500 transaction wasn't real, but their emptying of your bank account will be.