Is two factor authentication broken?

Question

In a comment to this question it is asserted two factor authentication doesn't really improve security, and this Security Week article is referenced. I find I lack the necessary background to understand the article and found it didn't really give any concrete explanation as to why this would be the case, except for referring to Man in The Browser attacks but these seem unrelated.

I realize good security has layers and just because 2FA has flaws doesn't mean it's no good, but is it really that vulnerable it is more of a waste of time to turn it on?

Answer 1

The article you are referring to is talking about SMS as the second factor. A better practice is to use an authenticator app (like google authenticator) as the second factor. This gives you a code that is only valid in a small window. Anyway if they have access to your phone this want help you either.

The problem with SMS as a second verification step is that it has several risks. NIST no longer advices to use sms-based 2 factor authentication (https://pages.nist.gov/800-63-3/sp800-63b.html section 5.1.3.2. Out-of-Band Verifiers)

So where possible use 2FA but with an authenticator APP.

Answer 2

So why would you do two factor authentication? It is about raising the bar for the attacker. How can you raise the bar for the attacker? By introducing a challenge which is not within the skill profile of the classical attacker. ...like needing the attacker to physically steal something.

This is the originial idea behind 2FA like it was introduced e.g. in 1986 by RSA with their RSA securID token. Unfortunately this proprietary algorithm was not implemented very good, so it needed to be improved continously. Plus: If an attacker steals the secret keys of the hardware devices, again the physical possession is useless.

As John and the NIST stated, SMS is not the best idea to implement 2FA. Obviously it is still better than using no 2nd factor and only a weak password.

But also smartphone apps have their attack vectors. Not only on the smartphone but also during the enrollment process. I wrote shore blog article about that. https://netknights.it/en/the-problem-with-the-google-authenticator/

Finally - if you are speaking of man in the browser, of course 2FA only protects you in the short momemnt of authentication. If you are using an unencrypted protocol, the attacker can simply sniff and steal the data without compromizing your login. If your computer is full of trojans, the attacker can also directly target your data without the need to target the authentication process.