I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet )

However, NIST seem to advise against this. If the code for SMS were to expire (say in 20 minutes) would this mitigate the risk of using SMS. Or is SMS frowned upon completely in its current state?

  • 1
    A 2FA authentication app could be used such as Google's or Microsoft's. SMS is insecure (look at the SS7 routing hacks) but risk is relative and unless you are dealing with very sensitive data might be suitable for you. You could also consider voice call systems – iainpb Sep 18 '17 at 12:22
  • 1
    Also 2FA hardware tokens (like Yubikey) are really good. – AstroDan Sep 18 '17 at 12:50
  • NIST does not advise against SMS anymore. – Reinstate Monica - M. Schröder Sep 20 '17 at 5:37

Expiring your SMS token in 20 minutes will not mitigate the attack. Bad actors can either use SS7 routing attacks, or social engineering to gain access to your text messages. The social engineering attacks are much lower tech and easy to do. They essentially involve:

  1. Calling your cell phone provider
  2. Authenticating as you, or just convincing the customer service rep to help them. (See: https://youtu.be/lc7scxvKQOo?t=30s). The recent Equifax breach makes this even easier since bad guys can now answer your security questions as well (in many cases).
  3. Changing the IMEI of your phone to their burner phone (like what happened here: https://carpeaqua.com/2017/07/07/hack-the-planet/).
  4. Initiating password resets (to your email or other services) with text messages, which are now routed to the burner phone.

Once they have gained control and access to a few key accounts (your text messages and your primary email) they have the keys to the kingdom, and can take over - resetting passwords and locking you out of accounts as fast as they can. Typically, it takes people around 1 hour to figure out they got hacked. But, even if you notice in 15 minutes, it's very possible you've already lost control of key accounts, and it will take some time to get back in. During that time, the bad actors are routing around in your personal information collecting data and planning the next move, which includes further locking you out.

For strong, out of band 2FA, very little exceeds the security of time based one-time passwords, which Google authentication Yubikey utilize.

There are a number of libraries you can use to generate the 2FA keys. Here are some examples:

I'm a little concerned OWASP hasn't updated their list in light of both the NIST recommendations as well as the Equifax breach, which puts people's security questions at risk. Perhaps they have their reasons. Speculating on what those reasons are, it could be that security questions don't have to be answered truthfully. Example: when asked: "What street did you grow up on?" I typically answer with a GUID. This, of course, requires the use of a password manager like LastPass and / or KeePass to keep track. But, security requires effort. Also, social media is a gold mine of security questions and answers. So, perhaps the recommendations don't need to change ... yet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.