Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Question

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns:

1. I travel frequently overseas and lose access to 2FA accounts any time the associated SIM card can't touch a network.

2. Your phone is inherently your least secured device. I install way more software and download way more files on my phone than anywhere else with much less ability to verify sources or control access. For example, nearly every app requests sweeping permissions to function correctly. Even apps that aren't granted explicit permissions have been found to backdoor those permissions through google services.

I feel like linking my phone to sensitive accounts (such as banking) would actually make them more exposed to attack and more difficult to maintain legitimate access.

Answer 1

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry especially for non-technical users.

What can be improved? You can use TOTP token using apps like Google Authenticator. This still uses your mobile phone, but it doesn't rely on the phone number, so you can still use OTP even when your phone doesn't have connectivity.

The next step after is to use dedicated hardware token that complies with either U2F or WebAuthn, like RSA token or Yubikey. Website support is fairly limited to some of the major sites, but it's a great alternative when it's available. Google Accounts is also an OAuth provider so you can use it for social network login.

Answer 2

SMS 2FA is not only a bad idea; it's worse than not having 2FA at all (password only). This is because virtually all services offering "SMS 2FA" are actually delivering SMS 1FA! That is, they allow full account recovery via SMS, with no need to have the account password. This means anyone who can:

• convince your mobile carrier to port your number
• convince your mobile carrier they're you and they lost their SIM card and need a new one
• setup an IMSI catcher
• steal or "borrow" your phone and get it unlocked
• install malware on your phone with SMS permissions
• etc.

can fully takeover virtually any account you have enabled SMS "2FA" on. In the past, these kinds of attacks have been limited to targets with high-value accounts tied to the number (accounts holding a large balanace on cryptocurrency exchanges, email and social media accounts of political figures and celebrities, etc.) but are growing to be a threat for everyone, possibly even random untargeted attacks.

If you need 2FA, use TOTP software or a hardware token. Not only should you not enable SMS 2FA; you should not even give your mobile number to services you hold valuable accounts on, since they inevitably will use your number as SMS 1FA if they have it on file.

Answer 3

It depends on what you compare to, what you have to protect and what your users can be billed and trained to use.

2FA with mobile phone is prone to phone theft, phone malware, phone operator's SIM replacement (mis-)procedures, mobile net vulnerabilities and so on.

It is, however, WAY better than 1FA of, say, user password. So it makes a good step at securing a great number of things. The attacker has to steal not only a password, but also attack your phone in some way or another. An attack against a phone is either easily noticed (a phone missing or not working) or complex.

My bank offers (along with a better options) SMS 2FA for a limited functionallity of their internet banking. They have to. A lot of their customers cannot be bothered to use something more complex and if you force them they will just find another bank.

Answer 4

Your first concern is a very real one, services who don't understand that sometimes, some customers may have no access to text messages – these services are wrong.

However, having other software running on your phone is not the worst concern regarding 2FA via SMS.

OK, some bad actor will read a one-time 6-digit authorization token. They cannot reliably hide this text message from you, so the scenario "fake access to your account on a different device, stealthly read the 2FA code on the legitimate device, and pass it (e.g. over internet) to the attacking device" is not very likely.

The worst concern is that it's rather easy to compromise this channel. A government may order your cellular operator to give them a back door to text messaging. A criminal actor can use human engineering to attain an illegal copy of your SIM card, or stealthly install equipment to intercept the text message that is intended for your eyes only.

Answer 5

2FA by text messages - Multi-Factor Authentication (2FA) by text messages are quite cumbersome, mainly because, as you said, replacing the sim makes it almost impossible to even authenticate yourself unless you own two phones or a dual-sim phone, and it is also less secure and more vulnerable to SIM hijacking attacks.

2FA through applications - Platforms like Blizzard and Steam, or Authenticator apps like Google Authenticator and Authy perform 2FA through mobile applications, does not take your SIM into account and is therefore more secure and convenient.

So, if your question is whether 2FA through mobile phones is a good idea, then I'd say it is, depending on the method of implementation. Changing sim cards aside, if you're concerned about security, my best advice would be to be more wary about the things you install - always check online for the credibility and security of the application, because although this maybe annoying to do, using 2FA is by far one of the best ways to ensure password security and it would be far less secure to not use it.

Answer 6

MFA via SMS is not the best form of MFA. In some ways it’s kinda the worst. Stay away from that one as much as possible basically.

MFA via other mobile sources - such as TOTP codes via apps like Google Authenticator - are great. I recommend using those as much as possible.