NIST Prepares To Ban SMS-Based Two-Factor Authentication (softpedia.com) 150
An anonymous reader writes: "The U.S. National Institute for Standards and Technology (NIST) has released the latest draft version of the Digital Authentication Guideline that contains language hinting at a future ban of SMS-based Two-Factor Authentication (2FA)," reports Softpedia. The NIST DAG draft argues that SMS-based two-factor authentication is an insecure process because the phone may not always be in possession of the phone number, and because in the case of VoIP connections, SMS messages may be intercepted and not delivered to the phone. The guideline recommends the usage of tokens and software cryptographic authenticators instead. Even biometrics authentication is considered safe, under one condition: "Biometrics SHALL be used with another authentication factor (something you know or something you have)," the guideline's draft reads. The NIST DAG draft reads in part: "If the out of band verification is to be made using a SMS message on a public mobile telephone network, the verifier SHALL verify that the pre-registered telephone number being used is actually associated with a mobile network and not with a VoIP (or other software-based) service. It then sends the SMS message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change. OOB using SMS is deprecated, and will no longer be allowed in future releases of this guidance."
the phone may not always be in possession phone (Score:3, Funny)
recursive function overflow
Re: (Score:3)
I'm not quite sure what BeauHD is being paid for.
BeauHD is old and busted - two generations behind now. Clearly he needs to be upgraded first to Beau3D, then to Beau4K if we're to get good editing.
Re: (Score:2)
Yes, it also appears that biometrics are safe under either of two conditions--that you have another factor. Oddly they didn't specify which one. I would think that the biometrics would be the something you have (e.g. your voice, finger, or eye).
Re: the phone may not always be in possession phon (Score:3)
In that authentication paradigm, biometrics is usually called "something you are", while an authentication token/device/badge is "something you have".
Re: (Score:3)
With this new "knife" technology in the hands of the wrong folks, your finger/eye are suddenly much more like, "something you have."
Re: (Score:3)
Hackers can't steal your finger print or your eye, but they can steal the digital signature of it.
Re: (Score:2)
Hasn't it been shown that you can take a fingerprint left by someone (say, on their phone) and use it to fool a fingerprint scanner? If someone can do this, they are, in essence, stealing your fingerprint. And once someone has that, good luck changing your "password."
Re: (Score:2)
Hasn't it been shown that you can take a fingerprint left by someone (say, on their phone) and use it to fool a fingerprint scanner?
It has been shown that this works for old, cheap or crappy fingerprint readers. Modern, state-of-the-art scanners can check for a pulse, or use other techniques to detect tampering. Anyway, the whole point of multi-factor is that each individual factor doesn't have to be perfect. Two layers that are each 90% secure are as good as one layer that is 99% secure.
Re:the phone may not always be in possession phone (Score:5, Informative)
Hasn't it been shown that you can take a fingerprint left by someone (say, on their phone) and use it to fool a fingerprint scanner?
It has been shown that this works for old, cheap or crappy fingerprint readers. Modern, state-of-the-art scanners can check for a pulse, or use other techniques to detect tampering. Anyway, the whole point of multi-factor is that each individual factor doesn't have to be perfect. Two layers that are each 90% secure are as good as one layer that is 99% secure.
Biometrics are the worst factor; they reduce the efficacy of the other factors because they can never be changed while there will remain a nonzero number of devices that can be fooled (hence, they reduce the efficacy).
The "modern state-of-the-art" that you refer to doesn't yet exist, but I'm sure that it will be secure when they install it in the future, in my flying car.
Re: (Score:2)
Smart cards offer access to cash on my bank account and cell phone identity and have been around doing these very same things since the 90s.
I am sure it could go possibly very wrong, but so far some people must have done something good security-wise.
Re: (Score:2)
Unfortunately it's also pretty hard to change. If your fingerprint gets compromised, you can't simply change it as you would with a password.
Re: (Score:1)
They can steal your money directly, and your car (Score:2)
Suppose your car has a fingerprint scanner, along with a keyfob. That's something you HAVE and something you ARE.
Theoretically, could a thief steal your key fob and your fingerprint? Yes, of course. Would it be easier to just a call bring a trailer and steal your car directly? Yes, of course.
People will ALWAYS be able to steal. Security isn't about making it impossible. It's EASIER to steal a key fob than to steal both a fingerprint and a key fob. Therefore, adding the fingerprint increases security.
Re: (Score:2)
Still the same networks, a consumer OS that is wide open, a few extra trusted chips sold to anyone and some data set created by a user of interest.
A better way is for real world use would be https://en.wikipedia.org/wiki/... [wikipedia.org]
The change seems to be that the old idea was the that phone would be a text device that gets a message f
Re: (Score:2)
Re: (Score:3)
The phone with a phone lives mainly in a tome*...
*Assumes user has enough paper to print all recursions.
Typo (Score:1)
...because the phone may not always be in possession of the phone...
Do the editors not even read submissions anymore?
Re:Typo (Score:5, Funny)
You say that like they ever used to.
Re: (Score:2)
Re: (Score:2)
Do submissions not even submit submissions anymore...
Why do I have that odd feeling that our friend with the "app" fetish will be here in a minute?
Re: (Score:2, Informative)
the editors don't read what the editors don't read.
Re: (Score:2)
...because the phone may not always be in possession of the phone...
Do the editors not even read submissions anymore?
It's not a typo - it's proof by fight-club assertion :-)
I heard you like phones (Score:5, Funny)
Re: (Score:2)
There is no Zuul... only phone.
Re: (Score:2)
There is no Zuul... only phone.
All your phones are belong to Zuul? Uh oh...
Re: (Score:2)
Which is why Firefox OS failed; there was no XUL.
WAS (Score:2)
phone
WHO?
Mom was phone (Score:2)
In the story [knowyourmeme.com] about making out with your girlfriend, getting a call from her parent to check on her, and discovering that her dad is dead?
Simple. Mom was phone [amazon.com].
the phone may not always be in possession of the (Score:1)
Better vs. Perfect (Score:1)
Re: (Score:3)
Not many organizations are required to follow NIST security standards. Those that do are in a better situation than most to switch to physical tokens or to software-based tokens of one sort or another. Note that "5.1.3.2. Out of Band Verifiers" does not deprecate sending a notification to a smartphone app that can then authenticate the user and provide a secondary authenticator.
Re: (Score:3)
Context here - NIST is setting standards for government security. If you are running a government system or are the vendor selling to the government, this will apply to you. DoD and IRS shouldn't be using SMS 2-factor authentication for users of their systems. DoD is not really the problem here, since 2-factor to them is certificates on smart cards (CAC), but I wouldn't be surprised to see IRS using SMS based 2-factor for some kinds of password recovery.
SMS based 2-factor for taxpayers accessing the IRS...t
Re: (Score:2)
Ability? Christ, it's practically a default. I configured my MacBook to handle my SMSes through message.app because it's much more comfortable and ergonomic. A few months later, I get two-factor SMS authentication as part of work. Yeah, not exactly two-factor.
Using SMS for two-factor authentication is an anachronism, and I wouldn't mind the government stopping people from calling SMS "two-factor authentication", anymore than I mind when it stops people from selling industrial effluent as baby formula. It's
Re: (Score:2)
And certificates can be cloned, so they aren't really good.
A security token not connected physically to a computer and protected by a pin code is still the best alternative.
Re: (Score:2)
eh, fair enough. this is the defense the SMS auth providers would use. it's a fairly weak case imho, but yeah, it is not nothing.
Re: (Score:2)
I'm in the password-only era, you insensitive clod!
Seriously. I live in a rural town without cell service. And with a lot of poor and elderly people who either can't afford or can't effectively use smart tech.
Something these tech wonks never seem to think about.
Re: (Score:1)
If I understand this properly...big IF I guess...
I use Google's SMS TFA, which is uses when I logon using a new computer and love it. Google also allows me to print out a set of codes that I keep handy in case I don't have my phone.
Additionally, the second factor could be a call on a preregistered land line. Couldn't it?
Re: (Score:3)
Re: (Score:2)
Since tokens can be generated by software [google.com] on phones [apple.com], even obscure [microsoft.com] and obsolete [sourceforge.net] phones [blackberry.com], tokens are already more[1] ubiquitous than phones.
[1] hardware tokens can be taken into secure areas where mobile phones are banned.
Re: (Score:2)
I can agree that SMS authentication is not really good now that most phones can be compromised. However the alternative of having biometrics is not good either since fingerprints can be cloned, and so can eye irises. Or you can go full "Demolition Man" on it too.
Re: (Score:2)
The only disadvantage with a separate token is that you will have a lot of them. I have two today, one for my bank, one for work.
Re: (Score:2)
So we're throwing out the "better" in search for the "perfect?" Until tokens gain the ubiquity of phones (which seems unlikely), doing away with SMS-based two-factor authentication may just force many users back to the password-only era.
But then, what if you are not in possession of your token?
Re: (Score:1)
Exactly. And not being in possession of your token is probably going to take longer for you to realize and report, than not being in possession of your phone.
Re: (Score:2)
Tokens are obtainable. They're afraid someone will obtain your phone, and advocate using another non-phone thing someone could obtain instead. It's weird.
Re: (Score:2)
So we're throwing out the "better" in search for the "perfect?" Until tokens gain the ubiquity of phones (which seems unlikely), doing away with SMS-based two-factor authentication may just force many users back to the password-only era.
Two words: Google Authenticator.
There is no excuse for using SMS for 2FA when you have TOTP [wikipedia.org] with a well-documented interoperability standard in RFC 6238 [ietf.org].
Re: (Score:2)
Non-sequitor (Score:5, Insightful)
The recommendation doesn't make sense. Yes, your phone may not always be in your possession. That would rule out software authenticators too, since they reside on the same phone that may not always be in your possession. Even dedicated hardware tokens may not always be in your possession, they can be lost or stolen just like a phone. So if not being always in your possession is the criteria, then all of the NIST's recommended methods fail to meet it.
As for VoIP lines, yes they can be intercepted. They do however share one characteristic with cel-phone lines: they don't normally share a path with the network connection being authenticated except possibly at the user's ISP and computer (if the VoIP line terminates on their computer as opposed to their cel phone). That limits the ability of a single attacker to intercept and alter both paths, which is the central facet of what 2FA does.
Ultimately the only secure 2FA is a dedicated hardware token that requires biometric authentication to function. Anything less than that is insecure, the question being merely whether the insecurity reaches the point of being unacceptable.
Re: (Score:3)
I agree, if your concern is possession of the phone, then soft tokens are almost equal to SMS. The big difference is the ability to intercept the code out on the network (VoIP, Google Voice, etc...).
One thing that I have seen done with RSA tokens that could be done with software tokens as well as SMS tokens would be appending a PIN to the token. That way even if the token is stolen, the thief would need to know the PIN and where to append it. You don't need a biometric to unlock the token, just a password o
Re:Non-sequitor (Score:4, Interesting)
RSA has software tokens too. The app prompts for a pin and regardless of what you enter, will generate a token code. The catch is, the resulting token code will simply not work if the wrong pin is entered. No way to brute force that, you'd have to take the software token and submit that to the login form to see if the combination was correct (which after 3 tries will still lock you out). Pretty ingenious, the app doesn't need network access and will still work when you change your PIN.
Re: (Score:2)
Re: Non-sequitor (Score:3)
This, theft or the cloning of the SIM are three possible threat. Another is the display of the SMS on the lock screen which would divulge the token to anyone who has access to the device.
Re:Non-sequitor (Score:5, Insightful)
The recommendation doesn't make sense. Yes, your phone may not always be in your possession.
I'd recommend re-reading the actual recommendation: "The NIST DAG draft argues that SMS-based two-factor authentication is an insecure process because the phone may not always be in possession of the phone number". It's not the user having the phone on them, it's the phone having the number associated with it. They're essentially saying that it's too easy to hijack the phone's number (or simply get it when the user changes it) and receive the SMS instead of the legitimate user.
Re: (Score:1)
There was a cluster of hacks of various YouTube channels recently which coincided with a convention.
The mechanism was social engineering of various cell phone providers to transfer a phone number to a new SIM card, together with compromise of passwords via some other method, possibly rogue WiFi APs.
Re: (Score:2, Insightful)
Too easy for who? I suspect 2FA over SMS would thwart 99% of the account hacks that occur today.
Re: (Score:2)
Re: (Score:2)
The summary is poorly worded. It's not YOU in possession o
Re: (Score:1)
Ultimately the only secure 2FA is a dedicated hardware token that requires biometric authentication to function. Anything less than that is insecure, the question being merely whether the insecurity reaches the point of being unacceptable.
I would not use a hardware device with biometrics since you can be forced to provide those. I'd rather use a hardware token which requires a PIN to function which only allows you to enter an incorrect number a few times before it wipes the key.
Re: (Score:2)
Ultimately the only secure 2FA is a dedicated hardware token that requires biometric authentication to function
Only, biometrics can be faked. A couple of years ago, my favorite computer magazine (German) [heise.de] showed how they could lift and reproduce a fingerprint good enough to fool many fingerprint scanners. For that matter, biometrics are stored as digital data, which can be stolen. And once your biometric data has been stolen, you are well-and-truly screwed, because you can't exactly change your fingerprints,
If the message is intercepted and not delivered... (Score:2)
Re: (Score:2)
wouldn't the person who is expecting to receive it kind of, you know, notice?
Not if your VOIP is hacked and you aren't immediately aware of it.
Re: (Score:2)
Re: (Score:2)
If the message is intercepted while it is being delivered, but is still otherwise delivered normally while a copy is saved elsewhere, I can see that being a problem, because the recipient gets no cues that interception is occurring. But that's not what I was talking abo
Provide your phone number for extra security? (Score:4, Interesting)
Many websites ask this - Facebook is top of the list. I fail to see the reason. It is just another part of their project to collect data on you.
Also, security questions are a joke. Where was I born? The whole world knows by now. Why would I provide yet another vector for compromising my account?
If the site insists, I type garbage, and save a copy in Lastpass.
Sheesh.
Re: (Score:1)
Works fine until they ask you for the answer to your security question over the phone. So make sure your random garbage is still pronounceable and not too revealing about your sexual preferences.
Re:Provide your phone number for extra security? (Score:5, Interesting)
Having password reset happen with a text to your phone is more secure than the typical security questions that websites and (worse) CSRs ask. The text message is intended to help prevent what happened to Mat Honan [wired.com], where his google account, twitter, and Apple ID were hacked, and his MacBook and phone erased remotely. This happened because a hacker was able to convince help desk folks he was the legitimate owner of the accounts, using info scraped from different places.
Cell phone numbers aren't as good as hardware or software-based authenticators for applications that require more security. It's part of a continuum, where the more security is needed, the more of a hassle it can be to get in.
Re: (Score:1)
It's even worse when you DON'T have SMS. Websites and steam keep spamming you with "upgrading security" and refuse to let you OPT OUT of the harassment.
Re: (Score:2)
One reason I avoid SMS signups - travel.
I've never done global roaming, picking up a local SIM when I get there. So what happens if my Australian bank detects I've been shopping in Argentina or Portugal and asks to verify I haven't had my details stolen by sending an SMS?
My previous phone had dual-SIM which might have been an option. Although these Asian manufactured things tend to be 4G on one and 2G on the other, which is no help if, as here in AUS, they intend to discontinue 2G capability.
Re:Provide your phone number for extra security? (Score:4, Interesting)
I asked if it was possible to advise them to use a different number if I was away. They said NO.
Re: (Score:1)
I bet your password is #MAKEAMeR1CAGREATAGa1N69.
Re: (Score:1)
You mean BabyPutin? Yeah, I dig him.
Re: (Score:2)
I laughed, but still: Waaaay too easy to guess.
Re: (Score:2)
Yes, "security questions" are quite an oxymoron, they DEcrease security considerably. Because they are usually made up from things that anyone can find out about you or that some people who know you may know. Your mom's maiden name? Easy to find out. Your first teacher's name? Not that hard either. Your pet's name? Likely to be found on your Facebook page. Your first car? Probably something I'd know if I had known you for long enough.
So my mom's maiden name is something akin to fRwef12$nu'ka. And don't you
Re: (Score:2)
You realize that you don't need to give a meaningful (nevermind "true") answer to those security questions?
"Mother's maiden name?" "#10 dual-window envelopes".
Re: (Score:3)
Sure it does - It means you have two passwords, rather than a password and a piece of publicly-available information... Though the GP already gets that, I basically just rephrased his "type garbage, and save a copy" as something a bit more user-friendly.
That said, I otherwise agree with you completely - Though, I also don't really see the problem here. Biometrics would solve some of the usability issues with passwords, but at the c
Re: (Score:2)
Many websites ask this - Facebook is top of the list. I fail to see the reason. It is just another part of their project to collect data on you.
Also, security questions are a joke. Where was I born? The whole world knows by now. Why would I provide yet another vector for compromising my account?
If the site insists, I type garbage, and save a copy in Lastpass.
Sheesh.
I always make up the answers to these questions using a system based on the question and the site that helps me remember the answer but prevents someone from just Googling my life store too find out the answer.
Re: (Score:2)
People without credit cards or cell phones are actually real people too, believe it or not
Yes but they don't actually matter to to large corporations. Accommodating a few outliers is simply more trouble than it's worth.
Re: (Score:2)
FTFY
that's not a "ban" (Score:5, Insightful)
NIST can't "ban" the use of SMS for two factor authentication in general. Those are NIST guidelines (of course, some organizations may choose to make those guidelines mandatory). Furthermore, they don't seem to have a problem with SMS verification per se, but as the announcement itself says, they merely want people to verify that the phone number is an actual mobile phone, a reasonable recommendation.
Re: (Score:2)
NIST can't "ban" the use of SMS for two factor authentication in general. Those are NIST guidelines (of course, some organizations may choose to make those guidelines mandatory). Furthermore, they don't seem to have a problem with SMS verification per se, but as the announcement itself says, they merely want people to verify that the phone number is an actual mobile phone, a reasonable recommendation.
The NIST most certainly can ban their use for government projects. Also, you can clone someone's SIM card or use a social engineering attack to get a new SIM issued for a specific number. So it's not just a matter of verifying the phone is a mobile phone. There are more sophisticated attacks that SMS auth allows.
Re: (Score:2)
Which part of "of course, some organizations may choose to make those guidelines mandatory" did you not understand?
Those are not "sophisticated attacks" and other two factor authentication schemes are
Re: (Score:2)
Which part of "of course, some organizations may choose to make those guidelines mandatory" did you not understand?
My point in mentioning this is to say that NIST is a government agency and that certain parts of the government are bound to NIST determinations. Not as a matter of self determination but a matter of law. [nist.gov] And that you cannot just say that "NIST can't ban SMS 2FA" because they did exactly that for the US Government.
Those are not "sophisticated attacks" and other two factor authentication schemes are subject to cloning and social engineering. It is exceptionally stupid to give up the extra security and simplicity of SMS authentication because of such objections.
The problem is not 2FA but doing 2FA over SMS. And those are relatively sophisticated attacks as they require a bit more knowledge and planning than just taking over someone's email account and using the password reset option to capture password reset requests or something like that. You actually have to know who the person is and who their cell phone provider is in order to execute such an attack. If you're overseas, you may need a local accomplice to help you execute the attack. There are better ways
Re: (Score:2)
There are better cars that a Honda Civic. That doesn't make a Honda Civic a bad car.
Three factor auth (Score:1)
Stop, please stop pushing three factor auth with the "are, have and know". Biometrics = bad = unchangable. Auths have to be mutable in order for plausible deniability. Body parts will be ripped off either to extort a non-body physical item or for the body part itself - never worth it. How many movies have to be made to drive this point home?
Not a big deal (Score:2)
Software Defined Radio (Score:5, Insightful)
Part of the cell phone security model was that it was expensive and difficult to build the radio gear necessary to spoof a cell tower. Fast forward to the last few years, and you can get an excellent board for SDR for like $500. The guidelines list steps you can take to reduce the risk of SS7 routing shenanigans, but there isn't much you can do about a highschool kid (or an organized crime outfit) playing MITM with a cheap radio, which is why it will be deprecated soon.
If you are in IT, and your environment demands security compliance, this will reach you eventually. It might take a few years if your structure is slow.
I'm not using secondary device auth anywhere because I believe that dedicated hardware is more secure, but many of my peers are.using this. They will be switching off the SMS option and pressing on with online OOB methods, at least until their next cycle. We suspect that online OOB will go away entirely soon as tablet/phone malware matures and starts emptying phone-2FA-protected bank accounts.
Number portability (Score:3)
In Australia, and presumably other countries with number portability, SMS authentication is a joke.
While a SIM has strong crypto, and cannot easily be cloned, it is trivial to steal someones phone number by 'porting' it to another SIM.
The only 'secret' you need is their account number (dumpster dive, emails, social engineer or mailbox) or date of birth for prepaid.
The only thing less secure is those password resets, that ask for the make of your first car, etc - something guessable or found on your facebook profile.
Ban? Melodrama much? (Score:2)
NIST isn't your god, you can safely ignore whatever NIST says, unless you are one of the handful of companies that actually HAVE to follow NIST guidelines.
What NIST does in this case is provide best practice recommendations. Nothing more. That's no "ban", not even by a longshot. Hell, if the FCC says "oh, we think you maybe shouldn't..." it is closer to a ban than NIST saying "you SHALL NOT!"
The article doesn't even talk about who has to implement this, only that two-factor out of band authentication shall
It really is very insecure (Score:2)
The method we use to employ was a tri-factor authentication system, password, TOTP and SMS / Email based tokenization, but we've officially taken the SMS authenticator away because just as this post points out, you have to guarantee who has the phone and somehow confirm the phone which received the SMS is the phone which was meant to.
Thi
Re: (Score:2)
If somebody gets a hold of my phone they could fuck me over pretty good.
Chances are that Apple or Google "owns" your phone. And yes, they could fuck you over pretty good.