0

You create an account on an online service X with login=your email + password. Compare these 2 situations:

  • No 2FA enabled. The only risk is if your email is compromised: the "I lost my password" feature can be used, and then the account on service X is also compromised.

  • 2FA enabled with SMS or another second factor. Let's say only the second factor is compromised. The malicious actor can use the "I lost my password" feature, then choose "I don't have access to my email", then "Recovery: enter your phone number". Then they receive a code by SMS, and can set up a new password and bypass the email.

Then 2FA becomes 1FA if you choose the option "I don't have access to email, send me a recovery code by SMS": you can recover the access with the second factor only, and totally bypass the email.

If the email password security is better than the phone security, isn't 2FA strictly weaker than 1FA? The email provider is probably less vulnerable to social engineering than the phone company.

Are there examples of 2FA not becoming 1FA when using "Recovery" for well known services? (Gmail, Facebook, ...) It seems it is always the case.

9
  • This is now how a property "I forgot my password" system works. They don't just let you put any phone number and receive a token.
    – ThoriumBR
    Mar 24 at 10:07
  • @ThoriumBR Of course not any phone number, but the user's phone number (which might be compromised, stolen...). Then 2FA becomes 1FA.
    – low78
    Mar 24 at 10:12
  • It's possible to compromise or steal everything: your phone, your computer, your RSA physical token, your smartcard, your thumb for fingerprint...
    – ThoriumBR
    Mar 24 at 10:48
  • @ThoriumBR Of course but the point is that email with strong password is probably more secure than a phone number. Social engineering is less likely to happen with Gmail than with your phone number provider. So in this case adding a 2nd factor weakens the security because 2FA+Recovery feature=1FA with a less secure factor.
    – low78
    Mar 24 at 10:57
  • 1
    @low78 Yes. That's not proper 2FA. That's 1FA. Many websites claim they do 2FA without doing it in practice.
    – A. Hersean
    Mar 24 at 12:19

1 Answer 1

2

Your premise is wrong.

The situation you described in your "2FA" situation isn't how MFA works in real life. Or rather, if a MFA system is built like that, then it's not MFA. As A. Hersean said:

You are describing two 1FA systems, with the choice of the weakest link by the attacker.

Let's have a look at a possible way MFA via SMS (the worst way) can be implemented:

Upon registration, you entered your phone number, received an SMS with a six-digit code and entered it. You now confirmed that you own1 the phone number.

Upon authentication, you first enter your username and password. If successful, you are told to enter the code, which has been sent to you via SMS. The code is valid for 5 minutes and you have either one or three attempts before being kicked out and having to reauthenticate with username and password.

So, what happens if our username and password were compromised, but not our second factor? In this case, the attacker would make it to the "enter the code" stage and has a 1 in 1.000.000 chance to guess the correct randomly generated code. It's unlikely that that will happen, but not impossible. What should happen is that the service sends an e-mail to the user, saying something like

Someone (possibly you) logged into your account, but did not enter the security code sent via SMS. If this was not you, please log into your account and change your password immediately. If this was you, please disregard this message.

So in this sense, 2FA is strictly better than single-factor.

But what about the second factor being compromised? After all, there are plenty of ways to compromise a phone account, transfer ownership of a number to a new SIM, etc...

In this case, not much. You'd be able to click on "I forgot my password" and that's it. There is no "I don't have access to my emails" button. No application I've ever tested implements that.

If you presume that the attacker already has access to the e-mail account of the victim, then you have successfully compromised the account, no matter what.

And other MFA solutions, such as authenticator apps or hardware keys, are even more secure, since they cannot be compromised by a third party through social engineering.


1 Actually, you confirmed that you have access to SMS received by the phone number. However, it is presumed that each phone number is only accessible by one person.

4
  • Thank you. So 2FA with Recovery option: "I have lost access to my account => I have lost access to my email => Send code on 2nd factor (SMS) => Enter correct code => Thank you now you can login and set a new password" doesn't work like this? I thought it was the case for some services. Are you sure Facebook or similar services don't allow account recovery with 2nd factor only and a few easy questions (where is your mother born), and bypass the email?
    – low78
    Mar 24 at 13:34
  • @low78 Yes, that is awful. "I have lost access to my email" is not the application's problem, that's your problem with your email provider. For example, SE doesn't offer that option, nor does Amazon, PayPal, my local bank, etc... Facebook does allow recovery with the mobile number, because you can set up an account with that. And those security questions are finally falling out of favor after decades of experts warning that they're shit.
    – user163495
    Mar 24 at 13:44
  • @low78 But as A. Hersean said: Just because a company claims they do 2FA doesn't mean it's actually 2FA.
    – user163495
    Mar 24 at 13:45
  • It seems Gmail takes phone as recovery option, security.stackexchange.com/questions/120106/…. This means someone who has access to the phone number can do "I lost my password, send a SMS to my phone, code correct, set a new password" on Gmail. This is awful, what do you think? The second option "Another email" as 2nd FA is not really better.
    – low78
    Mar 24 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.