This is a crazy problem. Even Apple requires you to use SMS 2FA, and does not let you opt out or use any alternatives.
My employer uses this as well and I was locked out (couldn’t do any work) for an entire day because their SMS messages were not being delivered.
As a side note, Apple is also the only platform I’ve ever used that requires you to type your password in without seeing it, which makes using an actually-secure-password really fucking difficult.
2FA isn’t the issue. The issue is single factor logins with only text messages, no password and often no username. Those messages allow anyone who intercepts them to login, no username or password is involved at all.
2FA via SMS is a perfectly fine solution, though there are more secure options like yubikeys or TOTP generation apps.
2FA via SMS is a perfectly fine solution
Completely disagree
How so?
It’s a second factor. It’s “something you know”, “something you have”, and/or “something you are”. The username and password is the “something you know” and the sms message is “something you have” (I.e. the phone). There’s no need for the second factor to be secret as long as it is single use and time sensitive and is only used as a second factor, not the only factor.
This article was about single factor messages that are the entirety of the login flow, so not about 2FA, but I’m still interested in the concerns for second factor. It is still adding security over a password alone which is the only goal in the 2FA subject.
All of the same reasons for single factor also apply to MFA.
It’s also dependent on other services, is a privacy violation, and a giant fucking pain in the ass if you ever want to change your phone number, or like me, you have service issues.
There are many other alternate, more secure, more convenient, more resilient options.
Problem is finding something that is universal that is a “something you have” is difficult to find that almost everyone has. Almost everyone has a cell phone these days, so it’s a good option to use as that kind of factor. Email is a second “something you know” factor (I.e. via the password to your email account) and could be the same something if you use the same password. And getting someone to carry yet another device even if it’s simple like a Yubikey or something like that can be difficult. And unless biometric devices become universal on computers as well as phones, the “something you are” factor is hard to accomplish universally as well.
So, what options do you think are better that can be a “something you have” for use as a second factor to a password or other type of “something you know” factor?
TOTP or passkey are my preferred MFA options
SMS 2FA is TOTP, just the code is sent via SMS and the key is never shared with the user. But the issue with those apps seems to be even more problematic than SMS from the issues mentioned, e.g. changing phone numbers is not as common as changing phones or other catastrophic events that might cause the keys to get lost. And if you store passkeys or TOTP generating keys in the cloud, then the factor is no longer “something you have” because anyone can get the keys if they get the password to the thing storing the keys. SMS based TOTP leaves the keys only with the site you’re logging into and only the time sensitive TOTP codes are ever sent out. And although the lifetime period for sms TOTP has to be longer, they are additionally expired on single use (assuming it’s implemented properly).
I messaged my bank and they were unable to opt me out of it…
Same. Most of them don’t allow it.
I don’t know if this is something that I’ve set up somehow but I get a spiffy 2FA pop up on my Apple devices when I sign into my account. It’s not an app or whatnot but a part of the OS.
Yeah that only works if you have an Apple device signed into your account and in front of you. Aren’t walled gardens fun?
