0

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, tap Approve, and that's it! No fiddling with codes from an authenticator app or SMS, and definitely much more secure than SMS authentication. It also doesn't introduce the complications U2F does (specialized hardware, a browser that supports it).

Google already implements it for both Android and iOS with Google Prompts, Authy already provides support for it also on both Android and iOS using Google's and Apple's push channels. So why are we still using SMS's as the main form of 2FA (especially at BANKS)? I mean, it's so user-friendly, I don't see why the movement to get rid of passwords hasn't hailed this as the replacement for passwords when using only 1FA; it seems viable even for that.

Improve this question
3
  • "why are we still using SMS's as the main form of 2FA" -- who's "we"? SMS certainly isn't standard. I enable MFA on all my accounts and I have never had to deal with SMS in quite a while. Do you mean, "why do some places not transition from SMS to push MFA?"
    – schroeder ♦
    Sep 3, 2020 at 19:01
  • "Why don't all services use the latest and greatest technology right away and why does it take some services a long time to transition?" -- that's basically what you are asking, and that's not a security question. Just because something should be done does not mean that everyone can do it.
    – schroeder ♦
    Sep 3, 2020 at 19:06
  • @schroeder I'm asking this question because I don't know if it's a security question or a business question or both. That's what the question is about: is it really just because push MFA is so new or is it something else? Push notifications themselves certainly aren't new, so "how much newer" is push MFA?
    – hilltothesouth
    Sep 4, 2020 at 6:01

2 Answers 2

Reset to default
1

SMS works on any phone. Push notifications require installing an app and configuring the account in that app.

Improve this answer
5
  • SMS requires installing a SIM card, that SIM card having cellular service, and paying the bill for the SMS. Push notifications require an internet connection, and don't always require an app.
    – hilltothesouth
    Sep 3, 2020 at 17:18
  • How does one get push notifications without an app?
    – schroeder ♦
    Sep 3, 2020 at 18:59
  • SMS does not require a smartphone. If you have a functional phone, you can get SMS. You can't always get Internet.
    – schroeder ♦
    Sep 3, 2020 at 19:11
  • Have you tried getting a large, general population to scan a QR code to set up MFA accounts in apps? I have. I needed a dedicated help desk team for a week, and that was after lots of instructional documents and videos.
    – schroeder ♦
    Sep 3, 2020 at 19:13
  • @schroeder The Google app is what's used for Google Prompts. It's still an app but one that comes with the Android OS. About QR codes, I'd bet that help desk didn't have to worry about forgotten passwords after that week. The fact is: a new change always brings some friction. We didn't become familiar with usernames and passwords overnight either. I think the shift would be worth it, though.
    – hilltothesouth
    Sep 4, 2020 at 5:45
1

While there are pros with push notification MFA like the convenience and getting rid of SMS based authentication, it's not necessarily more secure at all. The problem is that it makes it easier for an attacker to make the user accept an authentication request that wasn't actually from himself trying to log in.

  1. When security prompts are starting to flood, people will eventually start accepting them just to get rid of the messages.

    • There's science behind this, e.g. Anderson, B., Vance, T., Kirwan, B., Eargle, D., & Howard, S. (2014). Users aren’t (necessarily) lazy: Using neurois to explain habituation to security warnings. [PDF].
    • David Kennedy (DEFCON22) shares his experience on how users always tapped allow during his penetration testing.

  2. When the user is trying to log in at the same time as the perpetrator, it's hard to distinguish these attempts from each other. It might help to make the login page show a code one must compare to the code shown in the push notification, but how many of the users will actually do that? If the user is required to type a code from the app, instead, it would take more effort to trick him give the code away.

Improve this answer
3
  • I think push is inherently more secure than SMS as push channels are much more secure than GSM channels, but you have a point: humans will be humans. I suppose it's easy enough to start ignoring it when it's mixed in with all their Facebook push notifs. Having said that, I do think people should take responsibility for their actions. It's the one notif. they should pay attention to. It could also be designed to be harder to ignore: forcing the user to accept or reject the login from within the app and not from the push notification itself, or allowing the user to customize that setting.
    – hilltothesouth
    Sep 4, 2020 at 7:22
  • The Time-based One-time Password algorithm (TOTP) doesn't require a communication channel at all, making it better than both SMS and push channels.
    – Esa Jokinen
    Sep 4, 2020 at 20:52
  • Yes, but it requires a shared secret between the server and the client, and also doesn't require the client (phone) which holds the secret. You only need the TOTP secret to pass TOTP. With passwords, a breached database means bad guys get hashed and salted passwords (when implemented correctly). With TOTP, it means bad guys get plaintext TOTP secrets. That's the problem with TOTP - you only need the secret; you don't even need the phone. With push notifications, you need to at least pretend to be the phone; the common breached database won't mean much.
    – hilltothesouth
    Sep 6, 2020 at 4:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .