Twitter is moving away from 2-factor authentication using SMS, according to Elon Musk. He says Twitter loses $60 million per year due to being scammed with it.
Here is more information about 2-factor authentication and using SMS and why it is insecure.
In today's digital age, online security has become a critical issue. Cybercrime is on the rise, and hackers are continually finding new ways to steal sensitive information. As a result, two-factor authentication (2FA) has become a popular way to increase the security of online accounts. However, the use of SMS and phone-based 2FA methods has been criticized for being insecure, and it is recommended to move towards app-based 2FA methods instead. In this article, we will explore the reasons why SMS and phone-based 2FA are insecure and why we should switch to app-based 2FA.
What is Two-Factor Authentication (2FA)?
Two-factor authentication is an extra layer of security that requires users to provide two forms of authentication to access their accounts. The two factors are usually a password or PIN, and a unique code generated by a device or app.
The idea is that even if a hacker steals a user's password, they will not be able to access the account without the additional factor of authentication.
The Problems with SMS and Phone-Based 2FA
SMS-based 2FA and phone-based 2FA, which use voice calls, have been popular methods of 2FA for a long time. However, there are several problems with these methods that make them insecure.
Vulnerability to SIM-Swapping
One of the biggest problems with SMS and phone-based 2FA is their vulnerability to SIM-swapping. SIM-swapping is a technique used by hackers to transfer a victim's phone number to a device under their control.
Once the hacker has control of the victim's phone number, they can receive the 2FA code and gain access to the victim's account. This type of attack is becoming increasingly common and is a significant security risk.
Inherent Insecurity of SMS
SMS is an inherently insecure method of communication. SMS messages are sent in plain text and can be intercepted by hackers using a variety of techniques. This means that the 2FA code sent via SMS is vulnerable to interception, which can allow hackers to gain access to the user's account.
Phone-Based 2FA is Vulnerable to Call Forwarding
Phone-based 2FA is vulnerable to call forwarding. If a hacker gains access to a victim's phone, they can set up call forwarding so that any calls to the victim's number are forwarded to a number under the hacker's control. This means that the hacker can receive the 2FA code and gain access to the victim's account.
Why App-Based 2FA is a Better Alternative
App-based 2FA is a better alternative to SMS and phone-based 2FA. Here's why:
App-Based 2FA is More Secure
App-based 2FA is more secure than SMS and phone-based 2FA. App-based 2FA codes are generated within the app and do not rely on a third-party service like SMS or voice calls. This means that the codes are not vulnerable to interception or call forwarding attacks.
App-Based 2FA is Less Vulnerable to SIM-Swapping
App-based 2FA is less vulnerable to SIM-swapping attacks. The codes are generated within the app, which means that even if the hacker gains control of the victim's phone number, they will not be able to receive the code unless they have access to the victim's device.
App-Based 2FA is More Convenient
App-based 2FA is more convenient than SMS and phone-based 2FA. Users do not have to rely on a third-party service, and the codes are generated within the app, making the process faster and more streamlined.
SMS and phone-based 2FA are insecure and vulnerable to a range of attacks. So much so that Twitter gets scammed out of $60 million per year. I also understand that SMS 2-factor authentication is convenient and easy because you don't have to open an app and look for a code, you can just look at a message instead.
What do you think - is SMS an OK way to do 2-factor authentication? Or should an app be used instead, or a hard key?
Online writer since 2008. I enjoy writing and have written nearly a thousand tech related articles about electric vehicles, software, tech companies, hardware, gaming, tech related products, and company developments in tech.
