I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become more harmful and it might open holes, as opposed to being without 2-step at all.

For example: with 2-step SMS authentication, you need to set your mobile number in your profile. The mobile number in profile, are generally being used can be used as recovery method by most sites (including google). So, theoretically, if an attacker doesn't have your password, but can intercept GSM/SMS, then you are in more danger because he can click "password recovery" and then the website will try to send validation through SMS to reset your password.

So, that seems like a proof, that in this case, you are in more danger then if you were without 2-FA at all.

Is this theoretically true/possible?

  • "send validation through SMS". So, in your scenario, the attacker knows the account, is physically near the victim and has the ability to intercept SMS. And you are asking, in this specific alignment of factors, if the SMS 2FA opens a vulnerability? – schroeder Sep 6 '19 at 14:53
  • @schroeder yes, i ask that, and i have underlined the phrase "if it is possible" .. "in specific cases"... so, seems the answer is yes. – T.Todua Sep 6 '19 at 16:07

Having multiple factors of authentication are always more secure than any one of those factors apart.

A password and a token from an SMS message is harder for an attacker to circumvent than just a password or just a token sent through SMS.

However, SMS itself is currently considered the least secure authentication method, and there does not seem to be any way to make it more secure. It should never be used as the sole authentication method.

A person's cell phone number can be reassigned to a different device without the user being aware. This can be done either by social engineering against tech support representatives, or by malicious (bribed) agents at any cell phone store.

In your example, where validating account ownership for the purposes of resetting the password is conducted solely through SMS messaging, if the attacker can reassign your number to their phone, they can gain control of both factors. Google and several other large sites have additional steps to prevent this, such as sending emails to the account owner. However, this has been the basis for losing several accounts in the past, including a few where a couple million dollars worth of bitcoins have been stolen from people who use online exchange and wallet sites.

  • so, the answer is "yes" to my question, right? i meant "..in some case..", not always of course. – T.Todua Sep 6 '19 at 10:01
  • 2
    The answer is, password recovery through SMS defeats the purpose of 2FA. – Ghedipunk Sep 6 '19 at 15:49
  1. Getting access to your SMS is much more complex than getting access to your password. That's why even if resetting the password based on SMS is possible on some sites, it is still more secure than password.

  2. How can you password be hacked? For instance, there is some malware on your computer that can read your password database and thus knows web sites, user names and passwords. Hacker doesn't need anything about you in advance. You are just a random victim of the hack. Where as intercepting SMS does not give any information what sites and what user names you use. That's why hacking your SMS messages makes sens only if hacker knows your sites and user names in advance. It means when hacker wants to hack namely you, not just some random person. But if smb. wants to hack namely you, then you should expect also more serious measures like special hardware installed in your house and in your car. Then you have little chance any way.

  • 4
    i can take measures to protect myself if using a password, but avoiding a SMS hack is (mostly) out of my hands. It is fine to do a risk assessment and consider that sms are more secure for you, but for another profile it may not be (or they could simply weight it differently). – Ángel Sep 5 '19 at 23:34
  • 2
    First of all, being targeted doesn't mean you will be physically so, Mat Honan was targeted (actually weak targeted, since they only cared that it was a 'premium' twitter account) but I really doubt they would have entered his house to bug his devices. And second, if I am to be targeted at such levels, it is possible that I also have more serious measures, too, such as guards protecting my house or an alligator behind my computer desk. – Ángel Sep 5 '19 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.