I did some research about how secure and private SMS messages are.
Providers and governments can see these SMS messages in plaintext,
but what is weird is that these messages are not encrypted in transit.
According to my knowledge, that makes the service vulnerable to MiTM attacks: a semi-skilled hacker who knows my location can intercept the connection and get a code to reset my Google account's password for example.
Yes, you're right. SMSes are not recommended in any two-factor authentication (2FA) process nowadays. They can be easily intercepted and modified.
That's why a lot of companies are recommending other alternatives:
SMSes are considered obsolete when talking about a secure way to verify your identity. They are also affected by SIM Swapping attacks. That's why some 2FA apps that use TOTP, like "Google Authenticator", are gaining more popularity in the market.
There are many examples on the Internet exploiting these weaknesses:
Even with all these examples, SMSes are still used because:
But no matter what technology are you using, attackers always take advantage of the weakest link, in this case, people, so they will use social engineering techniques to try to trick you so you end up sending the 2FA code to them.
SMS is not exactly plaintext.
The network operator has it in plaintext, but the attack surface there is limited and both organizational and technological measures limit the exposure.
Over the air, it is pretty much encrypted, unless one uses 2G which can be optionally unencrypted and vulnerable to downgrade attacks. Most modern phones can be forced to use 3G and above.
And yes, these encryption methods are considered weak in relation to e.g. TLS and sucessful attacks do exist. But these attacks require equipment, skills and have their own prerequisites (like a great deal of exchanged data, etc...).
SIM swapping and other social engineering attacks are also possible, but they are - again - attacks and they require luck, skills and effort. They are not ready to use access channel. They can fail miserably as well - all the way down to being arrested and prosecuted.
In short, SMS is not that bad for use as a second factor.
edit: There is no good and bad (by itself) method.
There are good and bad methods in relation to the risk spectrum, the stakes and the user base involved. SMS is bad for launching nukes, but good enough for the average Joe's online payments. It is bad as well in regard to the order of an attractive toy use in a kindergarden.
In the security field, "good enough" is quite often the best method, because the security always cripples the usefullnes of the resource in question.
Edit2: As per @Steve comment: the worst second factor is one that users refuse to use because it's "too complicated" or "doesn't work on my system". This will either lead to users having only single-factor authentication, or becoming ex-users as they cancel their service or similar. In that context, a "bad" second factor is still good, because it's better than losing customers or relying on only a single factor. Even more customers can be kept by offering a stronger alternative to SMS (or other weaker second factors) for those customers who appreciate the technical differences and prefer stronger security.
SMS has significant advantages to the user:
As yet there's no single standard to replace that across such a wide range of accounts and providers
One aspect of SMS as 2FA authentication that I feel isn't as covered is the availability of the method itself; you don't need a wifi connection or a data plan to run a SMS 2FA setup, nor do you need a 2FA specific app to set it up.
If you're working from an Ethernet connection in a remote area that has cellular reception, but would be considered roaming in your current mobile plan, a single SMS message is a cheaper cost than the data plan enabling you'd otherwise need.
It's also compatible with cheaper phones that don't have a full app store capability (i.e. flip phones and other non-smart phones).
Furthermore, if the phone/SIM card is stolen, it's revocable - you simply set the system to never send to that number again, and there's nothing an attacker can do from that point onwards short of social engineering to get the number added again.
In an early draft of NIST SP 800-63-3, SMS was listed as a deprecated 2FA mechanism. When the final draft was released, this paragraph was removed, but examples remain in 800-63B of compromising SMS via collusion with the mobile phone operator. Although not deprecated in the final publication, SMS (and PSTN out-of-band authentication in general) is listed as a "restricted" authentication method, meaning that more secure alternatives are supposed to be offered.
It is generally accepted that password + SMS is better than password alone. It is also generally accepted that SMS is not extremely secure, as it can be stolen virtually fairly easy, although efforts have been made to make this harder. (SIM swapping is only one method to do this.)
Intercepting SMS by physical means might actually be harder than other methods, as it requires close physical presence, sophisticated (but inexpensive) hardware and software, and good timing.
The general advise on SMS for 2FA (as with any security measure) is to carefully evaluate risks and determine if SMS is appropriate for your uses.
We use SMS as "something you have" authentication factor for the same reasons we are still using keys to unlock doors.
All our doors could have keyless smart locks with access history, clone proof tags and video surveillance, but security may not be the only concern. There is user-friendliness, maintenance, emergency/backup/shared access and possible more things to consider.
Of course, SMS is not the safest channel.
From easy to very hard/unlikely:
You can protect yourself from physical access by locking your phone and from remote access by paying attention to what you install or visit online.
For SIM Swap/Port Fraud, the entity generating the 2FA code could do a web API call to a service like the ones provided by the company I'm currently working for, TMTAnalysis (shameless disclaimer, proud of my coworkers, we are not the biggest fish in this pond), that checks with the mobile carrier if the number had been recently ported/swapped before sending the code. If the API result says number is high risk, stronger/alternative solutions could be triggered instead of SMS.
For the remaining attack types, well, there is not much you can do about those. Mobile carriers and government agencies have strict, audited policies regarding access to your communication. Also, there is great effort in firewalling the signaling networks, especially SS7, the attacks currently happening there will keep making interesting articles here on SE in the following years (spam,smishing,tracking,interception,bypass,fake ussd,dos,imsi disclosure,location/ati fraud,..).
I think it's worth mentioning that the second factor here is proof of "something you have" (as opposed to "something you know", or "something you are").
Simple TOTP applications (like Google Authenticator) allow you to prove that you physically have a device you had when you set up the security, by storing on that device a generated secret, and they deliberately don't allow you to transfer that "physical" thing to another device. Some TOTP applications weaken that slightly and allow you to back up that secret in an online account - so it's available across all your devices, or if you lose the original device - but fundamentally it's still proof of possession, the only difference is where that possession is stored. It's not the same as "something you know" because you're not expected to memorise the secret, you're expected to store it somewhere that others can't access.
SMS is proof of "something you have", but the thing you have is not a secret stored on a device, it's access to your own phone number / service. You could probably argue that's "something you are", but it's definitely not "something you know". Regardless of encryption, if you have access to someone else's phone service (because you can look over their shoulder or get a hold of their unlocked phone), you can prove that you have access to that phone number. Of course all the other (much harder) attacks that allow sniffing the SMS in transit exist as well. But all of that just means that the proof is less trustworthy, and all MFA proofs exist on a spectrum of trustworthiness (of which "no MFA at all" is at one end).
Why is it used at all? Because access to someone's phone service is easy to prove (both for users and services) and non-trivial to cheat.
