0

I am looking for a technical explanation from a security standpoint why SMS is, seemingly by principle, made impossible to read online whereas it looks it should be easily implemented. I have recently gone through some trouble in another country with a temporary SIM card and phone number, being locked out of some accounts because they were sending me SMS for 2FA and I couldn't get the messages. One would think, if I were able to forward my US-based number's SMS somewhere online, I could easily retrieve them anywhere.

Alternatively, why is 2FA often SMS and not, for example, email, which can be read from other countries. The need to shift phone numbers makes SMS-based 2FA kinda stupid and inadequate.

3
  • 1
    Since you offer others to choose which of the questions to answer: "Alternatively, why is 2FA often SMS and not, for example, email, which can be read from other countries." - This is explained in Why is email 2FA not common? which compares SMS with email based 2FA. Apart from that - there are factors which can also be bound to a device but don't rely on the SIM card in the device - like TOTP. Commented Oct 19, 2022 at 19:48
  • The question isn’t if Sms could be read online. The question is: what is preventing others from getting the same sms message. And the awnser is, not a lot. It’s not considered sensitive so it’s not treaty as such…. Meaning anyone can just pick it out of the air if the have enough information and the hardware.
    – LvB
    Commented Oct 20, 2022 at 4:28
  • This is like asking why phone calls can't be read online. Look up how SMS works.
    – schroeder
    Commented Oct 20, 2022 at 11:02

1 Answer 1

1

First and foremost: SMS-based 2FA is in fact bad. It's not very secure (SMS is sent over poorly-secured channels and often leaks in a bunch of places) and greatly raises the risk of SIM-hijacking attacks. If you can, you should use almost any other method even before considering the issue when traveling.


There is not any technical reason why SMS can't be read online. Indeed, it can be, with some mobile providers (notably Google Fi). The only requirement is that your mobile service provider implements the feature, either through a web-based or app-based interface. Most providers haven't bothered to do this, but they could.

There's also the option of using one of the many apps that will sync messages between your phone and your PC, such as the "Your Phone" built into all recent Windows versions. However, these apps only can see what your phone sees; if the phone is off, out of service, or using a different SIM than normal, it won't see messages sent to your usual number. The thing described above, where the mobile service provider gives access to the messages, is different; your phone doesn't even need to be on or functional.

2FA typically uses SMS (bad), an authenticator or push-notification app (OK), or a hardware token (good) because these are all considered a "thing you have". Meanwhile, passwords - including both the password to the 2FA-protected site, and the password to your email - are considered "thing you know". Multi-factor authentication should always use different types of factors, rather than just multiple instances of the same type of factor. (There is also a third type - "thing you are" - which is generally biometrics like iris or retina scan, fingerprint, voiceprint, etc.; unfortunately, there's no reliable way to use those over the Internet so all online biometric authentication is really a "thing you have" situation where the device holds an authentication token or key, and releases it after you prove your identity to the device.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .