Hacker News Reader

Comment by addingnumbers | Hacker News Reader

The problem is with most online services, the only second factor allowed is SMS.

If you see it as "don't bother, they can just steal your SMS number" instead of "that's slightly better, at least now they can't get in without stealing my number" then you're not thinking about this reasonably.

It's inane to neglect to use SMS where it's the only second factor available. The exception is when a service allows you to use SMS alone for password resets, which isn't MFA, is 1FA with a weaker factor than a password.

What would you think if someone took you for a joyride in a classic car and said "shoulder belts would be so much better than these lap-only belts, so don't bother buckling up!"

View on HN

SMS is the only "second factor" that you can't control at all, your phone number can be changed from the phone company at any point, disabled, or suddenly refuse to work in a foreign country (all of those three happened to me).

For those reasons, even as a second factor it's a terrible one. SMS is just not a good method of authentication at all and has no place in a login form.

At it's best, SMS is only useful as a read-only notification system for non-sensitive purpose.

Basically every service I've used that requires SMS will use it as the sole authentication factor for resetting your password.. It's brutal

I didn't say it was worse than just password, I said it was a bad second factor, which it is.

SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer the case.

What's the recovery process when your phone gets stolen, or you drop it?

For me, for TOTP, I use one that backs up to iCloud. that obviously weakens the security, but increases the availability.

With some applications, you can add additional devices, so you can add multiple, if you have 'em.

A bad second factor is better than no second factor.

I enabled TOTP on every account I have that supports it, which comes to about 2 out of every 5 services. I'm not going to leave the other 60% with only one factor just because SMS can be exploited, which the consensus in this thread seems to be advising everyone to do.

If someone can exploit your SMS, it's possible they can use that to social engineer their way into a password resets with services. (I forgot may password but I still have my phone.) So I would say a bad second factor can be strictly worse than no second factor.

You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.

Except you have no way of knowing if that will be the case ahead of time. Unless the first thing you do after enabling 2FA is to social engineer a password reset for your account? Even then that doesn't guarantee that there isn't a more clueless service rep that will make a mistake.

Asking before you sign up, "will you allow my account to be hacked through social engineering?" isn't going to an answer other than no. Even if the answer is possibly yes.

But then let's please move the discussion from "Is SMS a good or bad second factor?" to "SMS is a mediocre second factor, and a terrible single factor. For this service, is it a second or single factor?"

You're incorrectly assuming that you can predict a site will never allow password reset via SMS only.

You can check if they appear to allow it today. Not perfectly, as they may have multiple variants and depending on other factors you might get presented with one or the other.

But you have no way to predict if next month a PM there decides their current password reset was too cumbersome and they change it to SMS-only. If you had a phone# on file, you're now suddenly vulnerable.

others may have suggested that, I did not :)

Reply on news.ycombinator.com