Yes. SMS Two – Factor Authentication Is Broken: Use It Anyway.
Hi everyone. Leo Notenboom here for askleo.com. In recent weeks there have been reports of a new
approach to essentially hacking SMS text messages. That means that SMS text messaging
may not be as secure as you would expect, and it actually means that SMS text messaging,
when used for two-factor authentication, could be vulnerable to getting intercepted.
And yet I still believe strongly that it is better to use this SMS two-factor authentication
than not using two-factor at all. Let's walk through some of the issues to review. Like I said,
from one number to another. Apparently it's legitimate. It is something that is used by
various businesses as part of their SMS marketing or SMS outreach for reaching their customers.
The problem of course is that while these companies are supposed to vet the people that
come to them and they are supposed to confirm that there is permission to do this for a given number
they don't. In practice they don't. In practice what it really means is just about anybody can
walk up to one of these machines, say yes please redirect the texts for this number to this number…
and honest I have their permission. I’m a good guy. It's a legitimate business reason,
even though none of that is true and they're hackers trying to intercept SMS two-factor
authentication. It's possible there are articles that have been published that describe
exactly how this happened as a proof of concept to at least one reporter. So it's actually easier
than the old approach that we've already been talking about for some time called SIM swapping
where you end up having somebody call your customer support number, impersonate you
and basically transfer your number to a different device. In this case, in this new approach there's
actually no indication that anything's wrong on your device. If you're a victim of sIM swapping
you know pretty quickly. Your phone stops working. But if you're a victim of this new approach
there's no indication whatsoever. And yet I still claim it's safer than not using two factor at all.
Let's use an analogy shall we? Let's say you've gone to the bank. You're at the bank
and while you're there a bank robber walks in with a gun maybe he starts shooting right away.
You dive behind a desk. Of course. Why wouldn't you? You wouldn't want to just stand there
and be a target? You'd want the protection of that desk between you and the gunman's bullets. Now
what if I told you that the desk actually only stops about 50 percent of the bullets
gunmen use, depending on what kind of ammunition the gunman happened to bring to the bank that day.
The desk may protect you or it may not. Do you now just stand up anyway? Or do you still
dive behind the desk? Of course you dive behind the desk. That's what SMS text messaging is.
It is a dive behind a desk that will protect you from most way more than 50%,
but not all of the people that potentially are trying to hack you. Like I said SMS two-factor
authentication is like that desk, except it protects you much better than 50/50.
So what does it mean to get hacked then? What does it take for a hacker to actually
get into your account? Well if you've got SMS two-factor authentication turned on
then they need to know your login id, fine. They need to know your password.
They need to know your mobile number, and they need to successfully make this hack happen.
So there are four separate things that come together before your account is hacked. If any one
of those is false: they don't know your account id, they don't know your password, they don't know
your number or they're unsuccessful making that hack happen? Your account is safe. You've dodged
a bullet (almost literally). Now let's say you're not using two-factor authentication. Let's say
you've heard that SMS is broken and because of that you've decided not to use two-factor
authentication at all. Well, what a hacker needs to get into your account is your login id,
and your password. If they have both of those they can get in. There is no additional protection.
Even though SMS is broken, it still provides protection above and beyond
someone simply knowing your username and password. Yes of course use better alternatives if you can.
That's the message behind a lot of the headlines. They're not saying don't use two factor,
they're saying use better alternatives. Better alternatives would be things like
Google authenticator or Google authenticator compatible applications. Email notification
is more secure. Account specific fobs that display an ever changing number. Or perhaps a hardware
device like a Yubikey. All of those are indeed more secure than SMS two-factor authentication.
Unfortunately not everybody offers them. In fact there are many services that offer only SMS as
two-factor authentication. In fact some of them offere SMS as your account recovery option. That
has the same vulnerabilities. The issue here though is that SMS two-factor authentication
is still better than no two-factor authentication at all, even if it's broken. Use something better
if you can. But use SMS two-factor authentication anyway if it's the only option available to you.
For links related to this video, for updates for comments, and more visit askleo.com/131589.
I’m Leo Notenboom. This is askleo.com. Thanks for watching.
you 1:00:30.029,1193:02:47.295 there is now apparently a service that you can go to whose job it is to redirect SMS text messages