Stop Using SMS as Second Factor in the Authentication Process

Since web services that care about security have moved toward two-factor authentication (2FA), some of us – such as Wall Street Journal writer Christopher Mims – have become confident enough not to use secure passwords because the second layer of security means it’s tougher to hack an account. But it’s the second part in the 2FA security process that can become the weak link that could open the door to your online accounts and allow hackers to lock you out of your digital life.

The difference between the two methods is that two-step verification uses verification codes sent via SMS text messages or via Find My iPhone, while 2FA requires a six-digit verification code displayed on trusted devices. As known security researcher and forensics expert Jonathan Zdziarski explains, the problem with text messages sent to your trusted mobile phone number is that “SMS has turned that “something you have” into “something they sent you”.

There are various methods hackers can use, and one of them is to call your mobile network carrier and swap their SIM card with yours. In fact, the number of SIM swaps was so high in New York that it has prompted the New York State Department of State’s Division of Consumer Protection to alert AT&T customers about the scheme that allows scammers to switch the target’s SIM card to a new device. From that moment on, they were able to intercept all SMS messages – including the verification codes – the user has set up as part of the two-step verification process.

First, you can upgrade the security level of two-factor authentication services to push notifications sent to trusted devices instead of SMS messages. If you need to stick with SMS, you can set up a security PIN or passcode to your phone’s wireless account. That PIN should be different from the PIN used to unlock the smartphone.

Storing your PIN and/or strong passwords can be done with a secure notebook, but using a password manager would do just as well. That way, you need to remember only your master password and let the service do the rest: store backup codes, PIN codes, passcodes, and much more. And if you are using a good password manager, you can even set it up to work with services working with one-time passcodes generated by services such as the Google Authenticator app or Authy.