-1

A sim-pin safeguards against sim-swapping, which is the primary advantage of using an authenticator app instead of SMS, is this not so?

1
  • Have you looked up why everyone says not to use SMS 2FA? That will answer you if SIM protection alone is enough.
    – schroeder
    Commented Jan 27, 2022 at 21:31

1 Answer 1

0

Yes, a 2FA app using something like TOTP is always better than SMS 2FA. The reason is that SMS 2FA is subject to attacks where the attacker convinces your telephone company to route your SMSes elsewhere. This attack has nothing to do with the SIM card in your phone, which merely authenticates you to your provider's network. Because your provider controls the provisioning of your number and the routing of all voice calls, texts, and data to your phone, they can also redirect it elsewhere without any action on your part, and SMS 2FA is insecure because this can be done without your knowledge or consent. This is true regardless of the state of any SIM card anywhere.

In addition to the above, SMS messages are plaintext and can traverse multiple networks with no encryption or other protection, and as such they are subject to snooping or tampering like all messages sent over insecure channels.

Assuming you have provisioned the TOTP secret securely to just a single device, a valid TOTP code is good evidence that you are in possession of that single device, since TOTP codes cannot be guessed more easily than brute force. Because a secure website will limit the number of tries (usually to around 3) and use TLS for the connection, an attacker will usually be unable to gain access. TOTP is still vulnerable to phishing attacks, but then again, so is SMS. For security against those scenarios, you need WebAuthn or FIDO2.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .