From SMS OTP to Passkeys: Your Real Weakness Is the Recovery Path
AryHHAry · x · 2026-09-19
A systematic thread on account authentication security, answering which is better among SMS OTP, authenticator apps, and passkeys:
- SMS OTP is weak because of the channel, not the 6-digit code. Phone numbers are transferable identities: SIM swaps, SS7 interception, and customer-service social engineering all work. Princeton/USENIX (SOUPS 2020) showed carrier authentication is often defeatable; NIST SP 800-63B-4 lists SMS as a restricted authenticator.
- TOTP is better (computed locally, no cellular network) but can still be relay-phished within the 30-second window — CISA does not consider it phishing-resistant.
- Passkeys (WebAuthn/FIDO2) are a different class: the private key never leaves the device and signatures are bound to origin, so fake domains can't get valid signatures. But synced passkeys shift the single point of failure from your phone number to your Apple/Google cloud account — if that account's recovery still uses SMS, you've only changed the interface. A 2025 arXiv evaluation notes synced-credential security concentrates at the provider; Unit 42 demonstrated Windows malware abusing Google Password Manager's onboarding/recovery flow.
- Hardware keys remain best for critical accounts (email, bank, registrar): device-bound, non-exportable, no SMS recovery; NIST places them at AAL3.
Key takeaway: the chain is only as strong as its recovery path — if "lost device" still falls back to SMS, you haven't left SMS 2FA. Full references included.
More from Safety
- Spain reports first breach allegedly executed by an AI agent, per weekly security roundup — TechNadu · 2026-09-19
- Rant Against Both Copyright Holders and AI Firms: 'No 200-Year Hostage Over Civilization' — TinfoilTricorn · 2026-09-19
- Security researchers blast OpenAI's "nightmarish" vulnerability disclosure process — evilsocket · 2026-09-19
- Writing anti-AI-regulation op-eds with AI: cringe now, creepy soon — moultano · 2026-09-19
- Sovereign AIs may be impossible to regulate, argue researchers — leaving 'nuisance' path open — binarybits · 2026-09-19
- Ex-DOJ antitrust chief Kanter tells Decoder why AI labs don't need an antitrust exemption for safety — The Verge AI · 2026-09-19