SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a phone number (and one that can receive texts at that; landlines do not, and some people disable SMS). Also, if I understand correctly, while spoofing outgoing emails is quite simple, receiving emails intended for someone else is virtually impossible (unless you are the user's email provider, of course). Also, sending emails is free, while sending SMS is not. With these considerations, why does email-based 2FA not have the widespread support that SMS 2FA does?
9
-
Email can be slow, very slow. Waiting 5 or more minutes for a 2FA token isn't practical. SMS usually is faster.– ThoriumBRCommented Jul 21, 2022 at 2:29
-
2There are a lot of services that use Email 2FA, especially all the game market places I know like Steam, Origin, Epic, ... use Email 2FA, so in my opinion E-Mail 2FS is already common, may be not on the services you use as the security gain is not that high as often e-mail accounts are what is hacked.– RobertCommented Jul 21, 2022 at 9:15
-
Email 2FA is so common that most services don't even ask you to turn it on. Try logging into your various accounts from a new device, and I suspect at least 1/3 of them will do some form of email 2FA. It's usually not used for logins from known devices though, since it can be slow.– Miles BudnekCommented Jul 21, 2022 at 18:20
-
I don't think I've ever had a password reset or other confirmation email take more than thirty seconds to arrive. Is my private email server just a lot faster than commercial services?– SomeoneCommented Jul 21, 2022 at 18:24
-
1@ArtemS.Tashkinov I don't use any of those services; it seems quite common in the video game industry?– SomeoneCommented Jul 21, 2022 at 21:23
|
Show 4 more comments
1 Answer
There are a few things going for SMS when compared to email:
- SMS is generally delivered more quickly. Some 2FA challenges expire in 5 minutes or less.
- SMS is more likely to be tied to a specific person.
- SMS is more likely to be tied to a physical object.
While there have been plenty of times someone's phone was accessed without their knowledge, that usually requires physical access or malware/viruses.
Another thing is that the phone number itself is valuable. Some companies force SMS in order to collect user's phone numbers. Sometimes this is for benign purposes, sometimes not so benign. For example, Twitter was recently hit with a big fine for misusing phone numbers(and emails).
Email from commercial entities also has a tendency to get trapped by spam filters, which is pretty rare for SMS.
All that said, email has some benefits over SMS:
- Email is often completely free for users. SMS might incur charges.
- Email can be accessed from multiple devices.
- Email can be accessed if a phone gets lost or damaged.
- Email addresses are less likely to change over time. People aren't as locked in to ISP supplied email these days with alternatives like Gmail, Yahoo, Hotmail, etc...
- It's frequently the same as the account name, thus it's already on file.
Some of these benefits can also be drawbacks. An email account can often be compromised with just a password and accessed silently, without the account owner's knowledge. People are also terrible at picking passwords, and password reuse is a serious issue.
Personally, I think the value of the user's phone number is probably the biggest reason companies lean on SMS so much, but I don't have any statistics or hard data on that.
