Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku:
Is phone/text based 2 Factor Authentication generally weaker than using an authenticator app? I'm trying to work out why a major site would not offer 2 Factor Authentication via phone/text, but offer other methods (authenticator app) instead?
As of now, it is way safer to enable MFA with an authenticator app compared to SMS, mainly because this specific network technology (SS7) is vulnerable for interception, but also to SIM swapping attacks.
App-based 2FA is much stronger than SMS/Phone based 2FA.
The reason being that 2FA code sent to SMS and phone call can be intercepted by your mobile phone network provider. By design, because phone number assignments are controlled by your mobile network provider. What this means is that you're subject to any vulnerabilities in the phones network provider, which you have no control of. A government three letter agency can ask your phone provider to make copies of your text available to them, a hacker that managed to hack into your phone network provider or a rogue employee can snoop and read your text messages/phone conversations, a social engineering hacker can convince a customer support staff to do a SIM swap attack, etc.
On the other hand, app-based 2FA would only be subject to how well you manage your code generation device's security and some clever piece of mathematics. These are all factors that you can control.
However, SMS/Phone does have the benefit of being easier to use especially for non-technical users. The phone number being assigned by your mobile provider means that if you lose access to your phone, you can ask your mobile network provider to redirect your SMS/phone calls to a new phone to regain access to the 2FA code. This usability factor is why SMS/Phone 2FA are often provided as an alternative for products targeted for mass market consumption especially when security requirement isn't very high. For products targeted towards more sophisticated technical users or businesses, and when the security requirement are high, it can make sense to require higher level of security afforded by app-based 2FA.
Is phone/text based 2 Factor Authentication generally weaker than using an authenticator app?
Yes.
I'm trying to work out why a major site would not offer 2 Factor Authentication via phone/text, but offer other methods (authenticator app) instead?
Because of the reason explained tersely above.
Namely, using phone/text 2FA is less secure than using a good authenticator app, such as Google's Authenticator App or Microsoft's Authenticator App.
