Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to enable Two-Factor Authentication for my outlook account, but I'm not sure which method should I choose or in other words which method is more secure?
Like I said there are two options: text and call and I think there are some advantages and disadvantages of both methods.
Call is safer, for reading your sms you only need a simple program whereas for monitoring your calls, you need an actual person, thereby increasing the effort needed by a lot.
Reading sms is something you can do on as many phones as you want whereas listening to that many calls at the same time is impossible (unless you're the NSA I guess). Even if you found a way to just record the call and then send it, the programming effort here is much greater and you also need a lot more processing power and bandwidth, once more lowering the chance that you're gonna be caught by it.
edit: I just want to add, of course the other guys talking about your threat model are right. If you leave your phone lying around and people can just take it and listen to the code, of course sms would be better. But then again, if you don't even have a lock on it, it wouldn't matter.
As you can see, yeah, it depends, but if you do have a passcode and you're not leaving your phone lying around, calls are better.
It really will depend on your threat model.
SMS may be easier to sniff, or to be intercepted by an malicious app on your phone. So if you are worried about those kind of attack, it may be the better to use the call option.
However, most phones will not require a device unlock to accept a call, so if you leave your phone unattended, ex on your desk, (or it is stolen) one could use it to get a code, while for an SMS you could lock it. Of course most people nowadays never leave the smartphone unattended, but this is only an example on how defining the threat model is important.
For me, as a SECOND authenticator factor, if I cant choose an OTP generator like Google Authenticator, I use SMS for the sake of not needing to answer calls, that is not always convenient, and also because I do not see SMS sniffing as a real possibility in my usage cases. However, as pointed out on the comments by @cornelinux, Google authenticator is vulnerable to certain attacks on the "secret agreement" phase, so again: define and check your threat model.
Neither. Both SMS and phone calls can be forwarded to a phone of an attacker's choice if that attacker can trick your mobile provider into believing he or she is you. Mobile account hijacking attacks like this aren't extremely common (yet), but they are definitely on the rise.
The better option (as @Jedi briefly mentioned) is to use an authenticator app to generate one-time codes that can be used as a second factor to sign-in to your MS account. (Whether to access Outlook.com or any other consumer Microsoft service.) Information on exactly how to set that up can be found here. In terms of the security of this approach, at worst it is dependent on how easily an attacker can either (1) gain physical possession of your phone and steal the shared secret that the authenticator app uses to calculate one-time codes from the phone's storage or (2) thoroughly compromise the phone via remote attack and do the same. The difficulty involved for an attacker to do either of those things depends quite a bit on the phone's OS, configuration, and hardware security elements. But it is highly likely that, across the run of things, taking this route would make an attacker's job significantly harder than using SMS or in-call audio codes.
(Now, of course, that doesn't necessarily mean that the phone authenticator app approach is better than every other possible authentication technology that now exist out there. A smartcard or hardened USB key approach would likely be more robust, as would a high-security challenge-response mechanism implemented with a dedicated hardware token [example], as would.... But here we're talking about 2FA options that Microsoft Account authentication supports today.)
It depends on how often you need to authenticate and what your perceived threat model is. Whether the call is eavesdropped or the SMS is sniffed shouldn't really matter as long as you protect your password and keep a close eye on your account activity.
Personally I find the SMS mechanism arrives faster and less intrusive (esp. in class or meetings). As @user2765654 says, call sniffing is harder to automate, but the tools will become more common if it gains popularity (recognizing numbers is the simplest voice recognition task). Even better would be to use an authenticator app- I believe Outlook supports this now too.
