SMS OTP

Tue, 17 May 2022 15:46:07 -0600

Have you ever switched phone providers? Maybe you walked into a store, found that shiny new phone you’ve always wanted (or just learned that you always wanted). The store employees are super happy with your choice. They get your information, you give them your phone number, and the next thing you know you have a new phone and a new provider. Easy, right?

Now imagine someone else — who is not you — decides they want a new phone too. Only they want access to some of your accounts. They pretend they are you. They tell the store your phone number. The store activates your phone number on their device. They can now receive text messages intended for you. That trick is called SIM swapping. There are other ways attackers get SMS messages too: forwarding numbers, account-port abuse, or social engineering someone at the carrier.

SIM swap

Your number, their device — SMS codes included

Port / forward

Other ways attackers redirect texts

All this to say: SMS and phone numbers are weak channels for security-sensitive messages. For something so easy to redirect, it is surprising how often we still use them as a “second factor” protecting real accounts. Microsoft has even suggested that SMS-based MFA is a bad idea.

Avoid SMS MFA

Even major vendors have warned against SMS as a second factor

Microsoft (via Thurrott)

That is why I am not implementing SMS 2FA in SpartanAuth. I would rather push people toward stronger factors and clearer UX than paper over account recovery with a channel attackers already know how to steal. SpartanAuth focuses on better options instead.

No SMS 2FA

By design in SpartanAuth — stronger factors instead

If you have feature requests or opinions on which factors matter most in practice, I want to hear them. Reach me at feedback@spartanauth.com.

Cost of Passwords

Tue, 17 May 2022 13:29:04 -0600

I keep coming back to a blunt fact: passwords are expensive. Not just annoying — expensive in support time, abandoned checkouts, and breach cleanup.

It has been observed that many companies’ support teams are overloaded with password reset calls. According to research from Forrester, the average cost for a single password reset is about $70. Another report by Gartner estimates that 20% to 50% of all help desk calls are for password resets.

$70

Average cost of one help-desk password reset

Forrester

20–50%

Of help desk calls are password resets

Gartner

On top of all this, according to a report from IBM, 20% of all breaches came from compromised credentials.

Global average total cost of a data breach is $4.24m, but in the United States that average cost more than doubles to $9.05m. I highly recommend reading that report. It has tons more information about the cost of data breaches.

20%

Of breaches involved compromised credentials

IBM

$4.24M

Global average cost of a data breach

IBM

$9.05M

Average breach cost in the United States

IBM

Needless to say, passwords are expensive.

So, what do we do about it?

There are several technologies that attempt to mitigate the costs and risks of passwords. These include:

FIDO - FIDO is a standard that allows users to authenticate without a password. It uses private/public key cryptography to authenticate users.
WebAuthn - WebAuthn is a standard that allows users to authenticate without a password on webpages. Also, it is built on top of FIDO.
MFA - Multi-factor Authentication incorporates several technologies (including some on this list) and techniques such as time-based tokens or biometrics.
OTP - OTP is a standard that sends users a one time use code through a known channel such as email or on a mobile app. See this blog post on why SMS is not a secure channel for OTP.
TOTP - TOTP is a standard where an authenticator app stores a shared seed/secret that will generate codes based on the time. The service provider can compare the code sent by the user to verify they had access to the authenticator app.
Biometrics - Biometrics allows users to authenticate with something like a fingerprint or face unlock — usually as a local gate to stronger credentials, not as a shared secret by itself.
Hardware - Hardware security allows users to authenticate with a device such as a security key or a smartphone. Some FIDO implementations use hardware to protect the crypto keys.

All of these approaches seem promising, but there are still a few things to consider. First, the cost of adopting them is not as low as the slide decks imply. Implementing each one well usually means having at least some domain expertise on the team — or paying a large identity provider a lot of money and still doing non-trivial integration work. Second, if the user experience is not planned carefully, people will not understand how to manage their own authentication. When friction goes up, people avoid the secure path. For example, 58% in the U.S. have abandoned purchases due to the difficulty of managing passwords.

58%

Of U.S. consumers have abandoned a purchase because of password friction

FIDO Alliance

That tension — better security that people will actually use — is a big part of why I am building SpartanAuth. I want the stronger options on this list to be easier to integrate into real web and mobile apps without turning auth into a multi-quarter science project. I use SpartanAuth in several of my own applications.

If you are wrestling with the same password costs, I hope these posts help — and I hope you will take a look at what I am shipping.

security on SpartanAuth Blog

SMS OTP

Cost of Passwords