SMS-based Two Factor Authentication is Insecure, What to Do to Secure Online Accounts?

 SMS-based Two Factor Authentication is Insecure, What to Do to Secure Online Accounts?

In today's digital age, 'Two-Factor Authentication' (2FA) has become a must for securing online accounts. But the most popular and convenient medium used for this is SMS, which has proven to be the most insecure.

SMS-based Two Factor Authentication (2FA) has serious security flaws, which are putting user accounts at risk. The biggest technical weakness of SMS is its outdated communication system. SMS uses a protocol called 'Signaling System No. 7' (SS7), which was developed in the 1970s and 80s.

This system was created at a time when only a limited number of people had access to it and all users were considered trustworthy. It lacks 'cryptographic authentication', which means that the system cannot distinguish whether a message comes from a legitimate source or not. This makes it easy for hackers to intercept, listen to, or modify messages.

Since SMS messages are sent in ‘plain text’, they do not have the ‘end-to-end encryption’ that modern apps have. Hackers can access not only the content of the message but also metadata such as the user’s phone number, location and device information.

Apart from technology, human error and ‘SIM swapping’ have also become another major threat. Hackers can use various pretexts to trick the telecom provider into transferring the user’s phone number to a SIM card they own. According to a report by TransUnion, about 27 percent of telecom executives have identified SIM swapping as the biggest emerging threat.

Apart from security, SMS has also been seen as a problem with reliability. Many users have experienced problems with SMS codes arriving late or not at all when logging into services like Daraz or Google. This has made it difficult for users to access their accounts.

As a safer alternative, you can use authenticator apps. Apps like Google Authenticator, Microsoft Authenticator, or Authy generate a new code every 30 seconds. Since these codes are generated locally on the device, there is no risk of being stolen from the network.

Passkeys have emerged as another secure option. This is a digital credential that remains secure on the user’s device and cannot be opened without biometric security (fingerprint or facial recognition).

In addition, security keys are now popular in developed markets around the world. Physical USB keys like the YubiKey cannot be used to log in without physically connecting them to the device.

In this way, SMS only gives users a false sense of security. Instead of relying on old and insecure technology, it is wise to adopt modern security measures. However, users are complaining that some banks and financial institutions still do not provide 2FA options other than SMS.