Is 2FA using SMS Secure?

January 19, 2020 1 Comment

In case you were still in doubt after this SIM port horror story from back in May:

We examined the authentication procedures used by five prepaid wireless carriers when a customer attempts to change their SIM card, or SIM swap.

We found that all five carriers use insecure authentication challenges that can easily be subverted by attackers.

We reverse-engineered the authentication policies of over 140 websites that offer SMS-based authentication, and rated the vulnerability level of users of each website to a SIM swap attack.

We found 17 websites on which user accounts can be compromised based on a SIM swap alone.

Is SMS 2FA Secure? →

🔐 Do note that 2FA using an Authenticator App/Device – I use Google Authenticator – to get a TOTP still is secure. The problem with SMS is the carriers that swap your phone number to another SIM without properly verifying things.

Published by Bramus!

Bramus is a frontend web developer from Belgium, working as a Chrome Developer Relations Engineer at Google. From the moment he discovered view-source at the age of 14 (way back in 1997), he fell in love with the web and has been tinkering with it ever since (more …) View more posts