No and stop using SMS it's not secure.
Well, unless you're for some reason a worthy target, nobody is going through the social engineering effort to defeat SMS just to steal your data. If you're going after random people just to extort some data or stuff like that, it's way easier to just trick them into opening an executable or fall for a fake webpage.
Authenticator to the left of me, SMS to the right, here I am Man In The Middle Attack.
Happened to me because I had an account on a crypto exchange. The attacker went in to my phone carrierās store, likely with a fake ID, convinced the store they were me, then got a new SIM card and reset my password on everything they could with it. They logged in to my crypto exchange mere minutes after they got the SIM, saw the $0.03 in my account, and logged out.
Sometimes it's less about the person that you're targeting and more about what that access gives you.
Low level accountant? Office worker with an excel file full of passwords or has correspondence with your actual target at a different company that you can pose as to gain access into?
They're just a step in the process.
I'm not sure where this idea of high profile target comes from. The sim swap attack is pretty common. People just need to be in some credentials leak DB with some hint of crypto trading or having some somewhat interesting social media account. (either interesting handle or larger number of followers)
There are now organized groups that essentially provide sim swap as a service. Sometimes employees of the telco company are in on it. The barrier to entry is not that high, so the expected reward does not need to be that much higher.
Permanently Deleted
The least secure part of the sign-in process is the person. It doesn't matter what the 2FA method is.
You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because "they're from Google". Someone can trick you into making the financial transfer yourself because "you're getting a deal".
On some websites, it is the only option.
Although it's true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn't matter. It still is doing it's job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
Many password managers use a biometric factor to sign in (your fingerprint, for example, using some kind of auth app if needed). This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
Arguably, if you use 2FA to access your passwords in 1password, there's little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it's been compromised, and having your OTPs separated wouldn't provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.
There is one theoretical situation I can think of where having your OTPs and passwords separate could be an advantage, and that's if someone gained all your 1password login details, including the 2FA secret key. But for someone able to gather that much sensitive intel, I'm not sure how much more of a challenge an authenticator app would be.
If you truly feel you need a second factor though, you'll probably want to look at something like a Yubikey or Titan. I've considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.
This is why we require second factor on the password manager too, otherwise youāre exactly right.
Stop using 2fa where its not needed. My university library logs me out every 45 minutes and requires microsoft authentication to log in.
Seriously, whats a hacker going to do if tgey get my password,download a PDF? Send a citation to my Favorites list?
Bulk download a shit ton of research papers through the university's educational license and distribute them for free on the internet, cutting out the completely unnecessary profit driven middle man leading you to eventually do away with yourself due to the pressure from the government and corporations to make an example out of you with a strong sentence.
But wait it has to be double secure, it has two s's in its name!!
USPSā website does this, sort of.
If their text service is down itāll let you know and just skip the 2FA process even though normally they offer an option to get the code via email.
The fact that they do this is bad enough, the fact that this happens so often that Iāve seen this at least a dozen times is even worse.
Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
Please just dont do anything you arent supposed to, my boss will kill me
Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
The password you have entered is already used by user
RandoMcRandom123, please use another password.
I appreciate the quick hack, but with a little more foresight you could have just put up a blurry jpeg with that number and changed the prompt so it looks like a CAPTCHA. Nobody would have given it a second thought.
