0

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, tap Approve, and that's it! No fiddling with codes from an authenticator app or SMS, and definitely much more secure than SMS authentication. It also doesn't introduce the complications U2F does (specialized hardware, a browser that supports it).

Google already implements it for both Android and iOS with Google Prompts, Authy already provides support for it also on both Android and iOS using Google's and Apple's push channels. So why are we still using SMS's as the main form of 2FA (especially at BANKS)? I mean, it's so user-friendly, I don't see why the movement to get rid of passwords hasn't hailed this as the replacement for passwords when using only 1FA; it seems viable even for that.

3
  • "why are we still using SMS's as the main form of 2FA" -- who's "we"? SMS certainly isn't standard. I enable MFA on all my accounts and I have never had to deal with SMS in quite a while. Do you mean, "why do some places not transition from SMS to push MFA?" – schroeder Sep 3 '20 at 19:01
  • "Why don't all services use the latest and greatest technology right away and why does it take some services a long time to transition?" -- that's basically what you are asking, and that's not a security question. Just because something should be done does not mean that everyone can do it. – schroeder Sep 3 '20 at 19:06
  • @schroeder I'm asking this question because I don't know if it's a security question or a business question or both. That's what the question is about: is it really just because push MFA is so new or is it something else? Push notifications themselves certainly aren't new, so "how much newer" is push MFA? – hilltothesouth Sep 4 '20 at 6:01
1

SMS works on any phone. Push notifications require installing an app and configuring the account in that app.

5
  • SMS requires installing a SIM card, that SIM card having cellular service, and paying the bill for the SMS. Push notifications require an internet connection, and don't always require an app. – hilltothesouth Sep 3 '20 at 17:18
  • How does one get push notifications without an app? – schroeder Sep 3 '20 at 18:59
  • SMS does not require a smartphone. If you have a functional phone, you can get SMS. You can't always get Internet. – schroeder Sep 3 '20 at 19:11
  • Have you tried getting a large, general population to scan a QR code to set up MFA accounts in apps? I have. I needed a dedicated help desk team for a week, and that was after lots of instructional documents and videos. – schroeder Sep 3 '20 at 19:13
  • @schroeder The Google app is what's used for Google Prompts. It's still an app but one that comes with the Android OS. About QR codes, I'd bet that help desk didn't have to worry about forgotten passwords after that week. The fact is: a new change always brings some friction. We didn't become familiar with usernames and passwords overnight either. I think the shift would be worth it, though. – hilltothesouth Sep 4 '20 at 5:45
1

While there are pros with push notification MFA like the convenience and getting rid of SMS based authentication, it's not necessarily more secure at all. The problem is that it makes it easier for an attacker to make the user accept an authentication request that wasn't actually from himself trying to log in.

  1. When security prompts are starting to flood, people will eventually start accepting them just to get rid of the messages.

    • There's science behind this, e.g. Anderson, B., Vance, T., Kirwan, B., Eargle, D., & Howard, S. (2014). Users aren’t (necessarily) lazy: Using neurois to explain habituation to security warnings. [PDF].
    • David Kennedy (DEFCON22) shares his experience on how users always tapped allow during his penetration testing.
  2. When the user is trying to log in at the same time as the perpetrator, it's hard to distinguish these attempts from each other. It might help to make the login page show a code one must compare to the code shown in the push notification, but how many of the users will actually do that? If the user is required to type a code from the app, instead, it would take more effort to trick him give the code away.

3
  • I think push is inherently more secure than SMS as push channels are much more secure than GSM channels, but you have a point: humans will be humans. I suppose it's easy enough to start ignoring it when it's mixed in with all their Facebook push notifs. Having said that, I do think people should take responsibility for their actions. It's the one notif. they should pay attention to. It could also be designed to be harder to ignore: forcing the user to accept or reject the login from within the app and not from the push notification itself, or allowing the user to customize that setting. – hilltothesouth Sep 4 '20 at 7:22
  • The Time-based One-time Password algorithm (TOTP) doesn't require a communication channel at all, making it better than both SMS and push channels. – Esa Jokinen Sep 4 '20 at 20:52
  • Yes, but it requires a shared secret between the server and the client, and also doesn't require the client (phone) which holds the secret. You only need the TOTP secret to pass TOTP. With passwords, a breached database means bad guys get hashed and salted passwords (when implemented correctly). With TOTP, it means bad guys get plaintext TOTP secrets. That's the problem with TOTP - you only need the secret; you don't even need the phone. With push notifications, you need to at least pretend to be the phone; the common breached database won't mean much. – hilltothesouth Sep 6 '20 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.