13

I want to enable Two-Factor Authentication for my outlook account, but I'm not sure which method should I choose or in other words which method is more secure?

Like I said there are two options: text and call and I think there are some advantages and disadvantages of both methods.

  • 3
    The right way is to not send the OTP over what essentially is an unencrypted link (your carrier can see and intercept the call/SMS) and use TOTP or HOTP with an authenticator app. – André Borie Jun 20 '16 at 15:13
17

Call is safer, for reading your sms you only need a simple program whereas for monitoring your calls, you need an actual person, thereby increasing the effort needed by a lot.

Reading sms is something you can do on as many phones as you want whereas listening to that many calls at the same time is impossible (unless you're the NSA I guess). Even if you found a way to just record the call and then send it, the programming effort here is much greater and you also need a lot more processing power and bandwidth, once more lowering the chance that you're gonna be caught by it.

edit: I just want to add, of course the other guys talking about your threat model are right. If you leave your phone lying around and people can just take it and listen to the code, of course sms would be better. But then again, if you don't even have a lock on it, it wouldn't matter.

As you can see, yeah, it depends, but if you do have a passcode and you're not leaving your phone lying around, calls are better.

  • 2
    You don't need actual people monitoring calls, you can set up speech recognition. It's just a lot more expensive and can fail sometimes. – Jon Jun 19 '16 at 19:34
  • Yeah, sure you can, but that's where the second part of my answer comes into play: It's a lot more work and you need a lot more hardware and money to do it. – user2765654 Jun 19 '16 at 19:47
  • The problem with text messages is that they can be intercepted by other programs much easier, than the call. AS @user2765654 stated: The call is probably safer. – cornelinux Jun 19 '16 at 21:16
14

It really will depend on your threat model.

SMS may be easier to sniff, or to be intercepted by an malicious app on your phone. So if you are worried about those kind of attack, it may be the better to use the call option.

However, most phones will not require a device unlock to accept a call, so if you leave your phone unattended, ex on your desk, (or it is stolen) one could use it to get a code, while for an SMS you could lock it. Of course most people nowadays never leave the smartphone unattended, but this is only an example on how defining the threat model is important.

For me, as a SECOND authenticator factor, if I cant choose an OTP generator like Google Authenticator, I use SMS for the sake of not needing to answer calls, that is not always convenient, and also because I do not see SMS sniffing as a real possibility in my usage cases. However, as pointed out on the comments by @cornelinux, Google authenticator is vulnerable to certain attacks on the "secret agreement" phase, so again: define and check your threat model.

  • 3
    The Google Authenticator still keeps the shared key in the phone. The shared key is imported in plain text from the QR code. If you can choose, pick a hardware token like the yubikey. netknights.it/en/the-problem-with-the-google-authenticator – cornelinux Jun 19 '16 at 21:18
  • +1 for mentioning that SMSs are likely protected by phone passcode (unless it is shown in the notification area of course). – Ayesh K Jun 19 '16 at 21:38
  • @cornelinux I'm unsure why that is relevant. The blog says it's not a way to prevent people sharing accounts - just share the code, but OP won't do that. And the whole concept of 2FA is something you know, something you have. I doubt the key could easily be retrieved from any modern phone remotely, so it's still a thing you know thing you have situation. – Tim Jun 20 '16 at 3:20
  • 2
    @tim the quality of the thing-you-have depends on (a) how easy it is to be copied; (b) how easy it is for you that you realize it has been compromized and (c) how you can revoke and reenroll it. There is no black and white. I am just pointing out, that the Google Authenticator concept is suboptimal as far as enrollment and key storage is concerned. And in case of (b) the user is probably completely blind. The OP asked for advantages and disadvantages. So I am pointing out this disadvantage. – cornelinux Jun 20 '16 at 7:08
6

Neither. Both SMS and phone calls can be forwarded to a phone of an attacker's choice if that attacker can trick your mobile provider into believing he or she is you. Mobile account hijacking attacks like this aren't extremely common (yet), but they are definitely on the rise.

The better option (as @Jedi briefly mentioned) is to use an authenticator app to generate one-time codes that can be used as a second factor to sign-in to your MS account. (Whether to access Outlook.com or any other consumer Microsoft service.) Information on exactly how to set that up can be found here. In terms of the security of this approach, at worst it is dependent on how easily an attacker can either (1) gain physical possession of your phone and steal the shared secret that the authenticator app uses to calculate one-time codes from the phone's storage or (2) thoroughly compromise the phone via remote attack and do the same. The difficulty involved for an attacker to do either of those things depends quite a bit on the phone's OS, configuration, and hardware security elements. But it is highly likely that, across the run of things, taking this route would make an attacker's job significantly harder than using SMS or in-call audio codes.

(Now, of course, that doesn't necessarily mean that the phone authenticator app approach is better than every other possible authentication technology that now exist out there. A smartcard or hardened USB key approach would likely be more robust, as would a high-security challenge-response mechanism implemented with a dedicated hardware token [example], as would.... But here we're talking about 2FA options that Microsoft Account authentication supports today.)

  • 1
    The YubiKeys (4 and NEO) can partially generate Authenticator Tokens in hardware. They don't have a clock, so they use the time from the host system. This way, an attacker could send e.g. "12:00 tomorrow" to the key and get a token that is valid at that time and date. Still, unlike with only an app it is impossible to get the key to generate unlimited tokens. The beauty of that is, this works with every provider supporting this authenticator apps (HOTP/TOTP). I am not aware of any other hardware that does this. – Josef Jun 20 '16 at 15:06
3

It depends on how often you need to authenticate and what your perceived threat model is. Whether the call is eavesdropped or the SMS is sniffed shouldn't really matter as long as you protect your password and keep a close eye on your account activity.

Personally I find the SMS mechanism arrives faster and less intrusive (esp. in class or meetings). As @user2765654 says, call sniffing is harder to automate, but the tools will become more common if it gains popularity (recognizing numbers is the simplest voice recognition task). Even better would be to use an authenticator app- I believe Outlook supports this now too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.