{"action":"opened","issue":{"url":"https://api.github.com/repos/usnistgov/800-63-3/issues/220","repository_url":"https://api.github.com/repos/usnistgov/800-63-3","labels_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/220/labels{/name}","comments_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/220/comments","events_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/220/events","html_url":"https://github.com/usnistgov/800-63-3/issues/220","id":170302014,"number":220,"title":"In support of SMS one-time password deprecation for higher impact systems","user":{"login":"SyntaxPolice","id":564819,"avatar_url":"https://avatars.githubusercontent.com/u/564819?v=3","gravatar_id":"","url":"https://api.github.com/users/SyntaxPolice","html_url":"https://github.com/SyntaxPolice","followers_url":"https://api.github.com/users/SyntaxPolice/followers","following_url":"https://api.github.com/users/SyntaxPolice/following{/other_user}","gists_url":"https://api.github.com/users/SyntaxPolice/gists{/gist_id}","starred_url":"https://api.github.com/users/SyntaxPolice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SyntaxPolice/subscriptions","organizations_url":"https://api.github.com/users/SyntaxPolice/orgs","repos_url":"https://api.github.com/users/SyntaxPolice/repos","events_url":"https://api.github.com/users/SyntaxPolice/events{/privacy}","received_events_url":"https://api.github.com/users/SyntaxPolice/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-10T00:26:03Z","updated_at":"2016-08-10T00:26:03Z","closed_at":null,"body":"**Organization**: [Tozny, LLC](https://tozny.com)\r\n\r\n **Type**: 2 (industry)\r\n        \r\n **Document**: NISTSP 800-63B (github).\r\n\r\n **Reference**: 5.1.3.2. [Out of Band Verifiers](https://github.com/usnistgov/800-63-3/blob/nist-pages/sp800-63b/sec5_authenticators.md)\r\n\r\n **Comment**:\r\n\r\nWe are writing to support NIST’s draft recommendation to deprecate SMS for multi-factor authentication.\r\n\r\nSMS one-time passwords are being used by organizations with a very wide variety of risk profiles: From small, zero-impact apps to large critical government agencies. Security 101 says that you should analyze the risks and vulnerabilities in your login system, but it’s extremely difficult for any organization to know what vulnerabilities they are exposed to with SMS. Put simply, SMS isn’t one thing. Every user, every phone company, every SMS cloud middleware provider, and every phone has a different set of vulnerabilities.\r\n\r\nFor instance, an attacker with no technical skills can target a specific individual, call up the phone company, [and take over their phone number to break into their account](https://www.wired.com/2016/06/deray-twitter-hack-2-factor-isnt-enough/). All they need is some smooth talking and a little bit of luck. This situation is clearly incompatible with the need for moderate-to-high impact systems to have multi-factor authentication.\r\n\r\nIndeed, coupling SMS and passwords does not necessarily get you multi-factor authentication. The usual way of thinking about MFA is that it includes two different types of proof. Typically, it’s something you know (e.g. a password) coupled with something you have (a cryptographic key) or a biometric. Despite the appearance to a casual observer, an SMS one-time password does not demonstrate possession of a physical device or token by the intended user. Instead:\r\n- It may be relayed through various third parties: SMS middleware, telephone companies, mobile OS companies, VOIP companies, and app authors.\r\n- It may then be relayed to several cloud-connected devices (including the computer the user is logging in on), and read by various apps on the device.\r\n- The phone number that the user registered in the past might now be reused by a new person or taken over by an attacker.\r\n- The IP or wireless networks delivering the OTP may have flaws that allow for passive or active interception.\r\n\r\nThe following high-level diagram is an illustration of various ways that SMS OTPs might not be proof of the user's control of their mobile phone as a token:\r\n![image](https://cloud.githubusercontent.com/assets/564819/17537976/e653fe58-5e55-11e6-8647-ebfca2602d5c.png)\r\n\r\nGiven this situation, we agree that SMS should be deprecated for access to critical systems. The risks are difficult to anticipate, and often they are simply too high.\r\n\r\nOn the other hand, SMS is convenient and useful for 2FA or onboarding in lower-risk environments. Coupled with a strong password, SMS will raise the bar for an attacker, but organizations should evaluate the risks to themselves and their users; especially for targeted attacks. Furthermore, strong passwords coupled with SMS is a significant usability barrier on mobile devices.\r\n\r\nWe strongly advocate cryptographic authentication. A good crypto key will always be stronger than even the best passwords.\r\n\r\n **Suggested Change**:\r\nConsider providing further justification for the deprecation of SMS. This justification could cover the goals of 2FA, the various risk profiles of organizations using 2FA, and guidance for organizations trying to make the risk/usability trade-off."}}
{"actor":{"display_login":"SyntaxPolice"}}