NIST declares the age of SMS-based 2-factor authentication over



2-factor authentication is a great thing to have, and more and more services are making it a standard feature. But one of the go-to methods for sending 2FA notifications, SMS, is being left in the dust by the National Institute of Standards and Technology.

NIST creates national-level guidelines and rules for measurements, and among the many it must keep up to date are some relating to secure electronic communications.

An upcoming pair of “special publications,” as its official communiques are called, update its recommendations for a host of authentication and security issues, and the documents are up for “public preview.” I put the phrase in quotes because technically, a “public draft” triggers formal responses from partners and, in fact, from NIST itself.

To avoid red tape, the Institute is trying out a new method for reviewing and commenting on the guidelines that isn’t quite so official: GitHub. “It only seemed appropriate for us to engage where so much of our community already congregates and collaborates,” reads an intro to the new process.

The public preview, to be sure, is still very incomplete, and includes questions built right into the text — “I think we are making this too hard,” reads one piece of marginalia.

At any rate, the changes are numerous, but perhaps most relevant for Joe and Jane Six-Pack is the active discouragement of using SMS as an “out of band authenticator” — essentially, a method for delivering a one-time use code for 2FA. (Emphasis theirs.)

If the out of band verification is to be made using a SMS message on a public mobile telephone network, the verifier SHALL verify that the pre-registered telephone number being used is actually associated with a mobile network and not with a VoIP (or other software-based) service. It then sends the SMS message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change. OOB using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

For now, services can continue with SMS as long as it isn’t via a service that virtualizes phone numbers — the risk of exposure and tampering there might be considered too great. NIST isn’t telling for now, but more info will come out as the comment period wears on. But before long all use of SMS will be frowned on, as the bolded passage clearly indicates.

The alternative is to use a dedicated 2FA app like Google Authenticator or RSA SecurID, or a dedicated secure device like a dongle. There are plenty of options — SMS was just the easy one.

Curious about the other changes?

  • LOA is decoupled into its component parts
  • Complete revamp of identity proofing
  • New password guidance
  • Removal of insecure authenticators (aka tokens)
  • Federation requirements and recommendations
  • Broader applicability of biometrics
  • Privacy requirements (under construction)
  • Usability considerations (under construction)

Feel free to dive into the documents themselves (links are at the top of the intro), and if you’d like to comment, use GitHub’s issue tracker. Details here.



Source link

Reply

Pin It on Pinterest

Shares
Share This
NBC tries to promote karate for 2020 Olympics, shows taekwondo
Ala. lawyer busted trafficking methamphetamine, 369 grams seized
Former Cuomo aide killed in crash on Long Island Expressway
Critics rip Cuomo plan that combines tax and wage subsidies
Oil prices fall as analysts say August price rally has been overblown
Asian shares slip, dollar stands tall on Fed hike bets
Japan Inc unenthused over Abe's stimulus, BOJ easing: Reuters poll
Facebook can climb more than 20 percent on ad growth: Barron's
Singapore Luxury Real Estate: Back to a Buyer's Market
Sail The Seven Seas With Ease In The Oyster 625 Bandido
The Montblanc Meisterstück Is On Point
The Wining Wines of the 2015 En Primeur Campaign
Can’t believe you ate the whole thing? Blame ‘false hunger’
Lead in NYC tap water is a danger despite quality system
Seattle toddler speaks first words after nearly drowning
Humans first infected Neanderthals with herpes, tuberculosis
Barbra Streisand Tells Apple to Fix Siri's Pronunciation of Last Name
Watch Metallica Debut Punishing 'Hardwired' Live at Minneapolis Concert
Matt Roberts, Original 3 Doors Down Guitarist, Dead at 38
Frank Ocean Reflects on Creating 'Blonde' in Tumblr Posts
Obama wants more choices for consumers using cable boxes
Sanders preaches economic equality at the Vatican
Senator calls out CUNY boss Milliken on campus anti-Semitism
Angry campaign making strange bedfellows out of bedfellows
Basketball Football Other Sports
SEE IT: Softball player pulls off behind-the-back bunt
Nets owner Mikhail Prokhorov’s office raided in Moscow
Isola: Phil Jackson no longer the cool, calm man on bench
Mobile Social
How carbon nanotubes could give us faster processors and longer battery life
Facebook’s new teens-only app Lifestage turns bios into video profiles
Looklive helps men shop by mimicking celebs’ styles