SMS is not 2FA-secure (issms2fasecure.com)

Article summary

A study found that SMS-based 2-factor authentication (2FA) is not secure due to vulnerabilities in wireless carrier authentication procedures. The researchers analyzed the authentication policies of over 140 websites and found 17 websites where user accounts could be compromised using a SIM swap attack. Despite disclosures, nine websites remain vulnerable. The study's findings have influenced FCC rulemaking to improve the security of customer authentication processes.

Main themes

• SMS 2FA security
• multi-factor authentication
• SIM swap attacks
• FCC rulemaking
• token-based systems
• threat modeling

What commenters say

• SMS 2FA is not secure and should not be used due to its vulnerability to SIM swap attacks.
• Some argue that SMS 2FA is better than no 2FA at all, especially for the general public who may find other methods too complicated.
• Others believe that providers should offer true multi-factor authentication, such as TOTP or token-based systems, instead of relying on SMS 2FA.
• The use of SMS 2FA can create a false sense of security, and providers should not offer it as a fallback option.
• Token-based systems, like Yubikey, are considered a more secure option, but their adoption is limited by the lack of support from many services.
• The threat model of the user should be considered when evaluating the effectiveness of 2FA methods, with targeted attacks requiring more robust security measures.
• Some commenters argue that awareness of the vulnerabilities of SMS 2FA may encourage providers to switch to more secure methods.
• Others note that some providers are moving away from more secure methods, like TOTP, in favor of SMS 2FA, which is a step backwards for security.