Doesn't 2FA increase the vulnerability of an account?

Question

You create an account on an online service X with login=your email + password. Compare these 2 situations:

• No 2FA enabled. The only risk is if your email is compromised: the "I lost my password" feature can be used, and then the account on service X is also compromised.

• 2FA enabled with SMS or another second factor. Let's say only the second factor is compromised. The malicious actor can use the "I lost my password" feature, then choose "I don't have access to my email", then "Recovery: enter your phone number". Then they receive a code by SMS, and can set up a new password and bypass the email.

Then 2FA becomes 1FA if you choose the option "I don't have access to email, send me a recovery code by SMS": you can recover the access with the second factor only, and totally bypass the email.

If the email password security is better than the phone security, isn't 2FA strictly weaker than 1FA? The email provider is probably less vulnerable to social engineering than the phone company.

Are there examples of 2FA not becoming 1FA when using "Recovery" for well known services? (Gmail, Facebook, ...) It seems it is always the case.

Answer 1

Your premise is wrong.

The situation you described in your "2FA" situation isn't how MFA works in real life. Or rather, if a MFA system is built like that, then it's not MFA. As A. Hersean said:

You are describing two 1FA systems, with the choice of the weakest link by the attacker.

Let's have a look at a possible way MFA via SMS (the worst way) can be implemented:

Upon registration, you entered your phone number, received an SMS with a six-digit code and entered it. You now confirmed that you own¹ the phone number.

Upon authentication, you first enter your username and password. If successful, you are told to enter the code, which has been sent to you via SMS. The code is valid for 5 minutes and you have either one or three attempts before being kicked out and having to reauthenticate with username and password.

So, what happens if our username and password were compromised, but not our second factor? In this case, the attacker would make it to the "enter the code" stage and has a 1 in 1.000.000 chance to guess the correct randomly generated code. It's unlikely that that will happen, but not impossible. What should happen is that the service sends an e-mail to the user, saying something like

Someone (possibly you) logged into your account, but did not enter the security code sent via SMS. If this was not you, please log into your account and change your password immediately. If this was you, please disregard this message.

So in this sense, 2FA is strictly better than single-factor.

But what about the second factor being compromised? After all, there are plenty of ways to compromise a phone account, transfer ownership of a number to a new SIM, etc...

In this case, not much. You'd be able to click on "I forgot my password" and that's it. There is no "I don't have access to my emails" button. No application I've ever tested implements that.

If you presume that the attacker already has access to the e-mail account of the victim, then you have successfully compromised the account, no matter what.

And other MFA solutions, such as authenticator apps or hardware keys, are even more secure, since they cannot be compromised by a third party through social engineering.

---

¹ Actually, you confirmed that you have access to SMS received by the phone number. However, it is presumed that each phone number is only accessible by one person.