Background

Let us quickly cover how 2FA works.

As well as what it has going for it.

And, also some of its not so good.

 

Set Up

To set up 2FA, you register a phone number and choose verification method.

Currently Supported Verification Methods includes:-

1. Text Messages
2. Apps

Usage

Login

To log into your account, you will do the following

1. Username and Password
   • Please enter your username and password
2. Successful username and password
   • In the event that your username and password match, the service will get your phone number and verification method
   • Option
     • Text Message
       • The service sends a one password password to you a text message
     • App
       • The service initiates a conversation with you via your registered App
       • Depending on which app you chose
         • Passcode
           • You will get a passcode that is valid for 30 seconds or so
           • You will have to enter the passcode on your service site
         • Acknowledgment button
           • You will acquiescence through pressing a button
           • And, will not be asked for a passcode

Authentication Option?

Let us go over why you may choose text option.

Or on the other hand, why App option may be more secure.

For It

1. Works Offline
   • Cellular Data can be off
2. Ease of use
3. Minimum Requirement
   • Any phone that supports SIM Card
4. Additional Hardware or Software
   • No additional hardware or software is required
5. Phone OS Version Support
   • Phone OS does not have to be on a modern version

Against It

1. Lifetime
   • One time passwords are usable for a few minutes
2. SIM
   • SIM Card Switchable
     • A SIM Card can be easily removed from your phone and placed in a new phone
     • The new phone will be able to receive incoming text messages directed at the registered phone number
   • SIM Swapping attack
     • Someone other you can contact your carrier and have them switch your phone number to a SIM Card
   • SIM Duplication attack
     • Software is available that will duplicate a SIM Card
3. Signaling System 7 ( SS7 )
   • Eavesdrop
     • An attacker can exploit current vulnerability with SS7 and listen on your text messages
4. Rerouting
   • SMS Messages can be rerouted to other devices
5. Malware attacks
   • In the event that malware attacks have been installed on your phone, those malwares may have access to your text messages
6. Lost Access
   • Unfortunately, loss of your phone will impact your access to your account
7. Phone Number Changes
   • Whenever your change your phone number, you will have to change your phone across the board, as well
   • It is advisable that you keep both phone numbers for a while as you access each site and change your phone

 

Referenced Work

1. Rublon
   • What Is SMS 2FA? Text Message Authentication Explained
     Link
2. CNET
   • Do you use SMS for two-factor authentication? Here’s why you shouldn’t
     Link