I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as an attacker might be able to trick my phone company to redirecting my number or porting it to another provider.
To better protect against this I have considered using Twilio or another service to create a number that can receive text messages. I would then have those numbers posted to somewhere secure that I can check when I expect a SMS message. Probably the easiest way is to configure Twilio to post to an AWS Lambda endpoint that posts to SQS.
This strikes me as a more secure method and I will probably do it but I don't know if I have a complete understanding of all the risks. The issues that I can think of are as follows:
- It's effectively security by obscurity as an attacker wouldn't know my 2FA phone number but if one site's database is compromised then the number is known. ** I guess I could generate a number for each site but that seems like it could get expensive!
- Could the number be ported without Twilio's (or my) consent?
- Can someone intercept a SMS message in some other manner?
Effectively, it seems like mitigating this all hinges on the 2FA number being unknown. Perhaps I might use unique numbers for highly critical services like e-mail and a standard number for less important things.