Tell HN: SMS-based two-factor authentication is not secure

Re:Tell HN: SMS-based two-factor authentication is not secure by jjav on Wednesday June 09, 2021 @03:25PM (#27452003)

You can also "loose, etc" the phone so it is equally weak on that front. Except the SIM can be hijacked, so SMS is strictly worse and never better.

Best compromise between usability, access and recovery is to always use TOTP but be sure to always securely back up the secret offline. Don't ever just scan it into a single device, as then you're back to being able to lose it and be locked out.

[ Parent | on HN ]

Re:Tell HN: SMS-based two-factor authentication is not secure by tgsovlerkhgsel on Wednesday June 09, 2021 @04:19PM (#27452636)

The advantage with the phone is that the web site operator can pawn off the difficult recovery part on your mobile provider (go there, show ID, get a new SIM).

IMO both the mobile provider and the web site operator should be jointly liable for damages resulting from SMS 2FA abuse. The mobile operator for giving access to your phone number to an unauthorized person, the web site operator for using a known insecure technique.

Both the number of successful hijackings and companies using SMS 2FA would drop drastically.

[ Parent | on HN ]