<story><title>It’s time to stop using SMS for security</title><url>https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80</url></story><parent_chain><item><author>quicklime</author><text>I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn&amp;#x27;t a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I&amp;#x27;m not reachable by SMS.&lt;p&gt;This has bitten me a few times, sometimes in desperate situations. Like when I&amp;#x27;ve needed to log in to Airbnb to message a host, transfer some cash from my bank account, access my frequent flyer account, etc. Far too many sites don&amp;#x27;t provide 2FA over email, or through an app like Google Authenticator - they can &lt;i&gt;only&lt;/i&gt; do it over SMS.&lt;p&gt;Yeah, I know I could set up roaming. But it&amp;#x27;s an easy thing to forget, since I change phone numbers every couple of years (for both personal and work phones). And it&amp;#x27;s not always cheap.&lt;p&gt;It&amp;#x27;s also just a huge pain to have to go through and change every account I have, any time I change numbers. A lot of accounts that I only use occasionally are configured with one of my many old phone numbers, which don&amp;#x27;t work anymore. This usually involves a call to tech support to fix it.</text></item><item><author>slovette</author><text>So, I work in telecom and dabble a bit in software.&lt;p&gt;I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale?&lt;p&gt;At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”.&lt;p&gt;I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable.</text></item></parent_chain><comment><author>chrismorgan</author><text>I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn on and check the old phone I left with them, because roaming for a year is expensive and otherwise pointless (I barely use a phone), but transferring my number to a prepaid Amaysim SIM let me keep it alive and mine for the year for $10.&lt;p&gt;Actually, the myGov thing was a real piece of work. They offer secret questions as a second factor that you can opt to use instead of SMS codes (and yes, secret questions are stupid), but when I did that, &lt;i&gt;it silently unlinked my Australian Tax Office account&lt;/i&gt;. I tried to link it up again (a bit of a pain in its own right), and it told me that ATO has decided that it won’t let you link it up if you use secret questions as the second factor technique. Seriously. So I had to switch back. Oh yeah, they do also have a third option, an app of their own that can generate codes (&lt;i&gt;not&lt;/i&gt; TOTP), but that app had something like 2 stars on Google Play Store, with many reviews saying it didn’t work at all, so I didn’t even bother trying that.&lt;p&gt;When I’m in Australia with my phone handy, SMS verification seems not too bad, but when out of the country and not roaming, it may vary between very inconvenient and completely debilitating.</text></comment>
<story><title>It’s time to stop using SMS for security</title><url>https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80</url></story><parent_chain><item><author>quicklime</author><text>I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn&amp;#x27;t a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I&amp;#x27;m not reachable by SMS.&lt;p&gt;This has bitten me a few times, sometimes in desperate situations. Like when I&amp;#x27;ve needed to log in to Airbnb to message a host, transfer some cash from my bank account, access my frequent flyer account, etc. Far too many sites don&amp;#x27;t provide 2FA over email, or through an app like Google Authenticator - they can &lt;i&gt;only&lt;/i&gt; do it over SMS.&lt;p&gt;Yeah, I know I could set up roaming. But it&amp;#x27;s an easy thing to forget, since I change phone numbers every couple of years (for both personal and work phones). And it&amp;#x27;s not always cheap.&lt;p&gt;It&amp;#x27;s also just a huge pain to have to go through and change every account I have, any time I change numbers. A lot of accounts that I only use occasionally are configured with one of my many old phone numbers, which don&amp;#x27;t work anymore. This usually involves a call to tech support to fix it.</text></item><item><author>slovette</author><text>So, I work in telecom and dabble a bit in software.&lt;p&gt;I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale?&lt;p&gt;At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”.&lt;p&gt;I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable.</text></item></parent_chain><comment><author>RileyJames</author><text>Absolutely this. I currently have a document from my bank, that they emailed me. Which I’m suppose to print, write all my personal info on, plus a copy of my passport and FAX to them!!&lt;p&gt;All because I want to change my phone number, and I’m overseas.&lt;p&gt;Which I only need to change (or even have associated with my account at all) because they refuse to offer any other 2FA option.</text></comment>