Change Details

(This is the current target of ((sms)), and linked to in the MFA documentation.) SMS is relatively easy to use as an authentication factor, but is significantly less secure than other types of factors. Although it's better than nothing, the upstream discourages using it. You should use it only if you have a very compelling reason not to use other factor types, like TOTP. It is empirically practical to compromise or intercept SMS:

(This is the current target of ((sms)), and linked to in the MFA documentation.) (WARNING) {icon exclamation-triangle color=yellow} **SMS is a very weak MFA provider and can be compromised or intercepted by an attacker.** SMS is relatively easy to use as an authentication factor, but is significantly less secure than other types of factors. Although it's probably a little better than nothing, the upstream strongly discourages its use. You should use it only if you have a very compelling reason not to use other factor types. In most cases, TOTP is a far superior factor to SMS. It is empirically practical to compromise or intercept SMS. Here are some resources on SMS compromises and other types of carrier compromises (voice, voicemail): - In 2012, Cloudflare suffered a compromise related to carrier social engineering of Google MFA. [[ https://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app/ | Read More ]] - In 2015, The Verge published an account of a carrier social engineering compromise. [[ https://www.theverge.com/a/anatomy-of-a-hack | Read More ]] - Since 2016, NIST has adopted language discouraging the use of SMS for MFA. [[ https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html | Read More ]] - In 2016, Wired published an article with a good overview of weaknesses in SMS MFA. [[ https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ | Read More ]] - In 2017, The Verged published another copy of "stop using SMS for MFA". [[ https://www.theverge.com/2017/9/18/16328172/sms-two-factor-authentication-hack-password-bitcoin | Read More ]] - In 2018, Reddit suffered a compromise related to SMS interception. [[ https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/ | Read More ]] Broadly, SMS is highly vulnerable to social engineering (where the attacker calls the victim's carrier and convinces them to give the attacker control of the number). It is also highly vulnerable to physical interception.

(This is the current target of ((sms)), and linked to in the MFA documentation.) SMS is relatively easy to use as an authentication factor, but is significantly less secure than other types of factors. Although it's better than nothing, the upstream discourages using it. You should use it only if you have a very compelling reason not to use other factor types, like TOTP.(WARNING) {icon exclamation-triangle color=yellow} **SMS is a very weak MFA provider and can be compromised or intercepted by an attacker.** It is empirically practical to compromise or intercept SMS:SMS is relatively easy to use as an authentication factor, but is significantly less secure than other types of factors. Although it's probably a little better than nothing, the upstream strongly discourages its use. You should use it only if you have a very compelling reason not to use other factor types. In most cases, TOTP is a far superior factor to SMS. It is empirically practical to compromise or intercept SMS. Here are some resources on SMS compromises and other types of carrier compromises (voice, voicemail): - In 2012, Cloudflare suffered a compromise related to carrier social engineering of Google MFA. [[ https://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app/ | Read More ]] - In 2015, The Verge published an account of a carrier social engineering compromise. [[ https://www.theverge.com/a/anatomy-of-a-hack | Read More ]] - Since 2016, NIST has adopted language discouraging the use of SMS for MFA. [[ https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html | Read More ]] - In 2016, Wired published an article with a good overview of weaknesses in SMS MFA. [[ https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ | Read More ]] - In 2017, The Verged published another copy of "stop using SMS for MFA". [[ https://www.theverge.com/2017/9/18/16328172/sms-two-factor-authentication-hack-password-bitcoin | Read More ]] - In 2018, Reddit suffered a compromise related to SMS interception. [[ https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/ | Read More ]] Broadly, SMS is highly vulnerable to social engineering (where the attacker calls the victim's carrier and convinces them to give the attacker control of the number). It is also highly vulnerable to physical interception.