As of June 10 2017, users of the Social Security Administration (SSA) website will be required to use two-factor (2FA) authentication to gain access. Potentially, this could affect a vast number of American adults, who will be required to enter both their password and a separate code sent to them either by SMS or email text.
What is surprising is that in July 2016, NIST deprecated SMS-based 2FA in special publication 800-63B: Draft Digital Identity Guidelines. It should be noted this is still a draft, and not yet a formal standard that government agencies are required to meet; but nevertheless, it specifically says, “OOB [2FA] using SMS is deprecated, and may no longer be allowed in future releases of this guidance.” It seems strange, then, that the SSA should introduce precisely what NIST deprecates.
NIST has chosen to denounce SMS because it is flawed, and not just because there are stronger alternatives. Publication 800-63B stresses, “Due to the risk that SMS messages may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators” (section 5.1.3.2). This is not a hypothetical risk. German newspaper Suddeutsche Zeitung reported on May 3, 2017 that criminals had relied on Signaling System No. 7 (SS7) attacks to bypass two-factor authentication systems and conduct unauthorized wire transfers.
SS7 is an underlying mobile telephony protocol deeply embedded in the worldwide mobile telephony system. It was developed in 1975, without much regard to security, to allow easy signal transfer between towers. “It is full of flaws,” explains Martin Zinaich, information security officer at the City of Tampa. “Most of those flaws are ‘by design’ to keep calls connected from tower to tower. It doesn’t make sense to utilize 2FA when that second factor is so easily breached.” And it is unlikely that SS7 will ever be fixed.
The initial plan from the SSA had been to offer only SMS-based 2FA. “Last summer,” explains Jim Borland, acting deputy commissioner for communications in a blog post early this month, “we added a second way for us to check your identity when you registered or signed in to my Social Security. However, at that time, we only allowed the use of a cell phone as your second identification method. We listened to your concerns, and beginning on June 10, you can choose either your cell phone or your email address as the second way for us to identify you. Since an email address is already required to use my Social Security, everyone can continue to benefit from the features my Social Security provides.”
The problem was that many of the SSA’s 30 million users did not have SMS-capable phones. “The initial rollback of last year’s plan to use SMS messages as the sole means to receive a one-time passcode was done due to, primarily, a convenience issue, since most users of the SSA website were found to not have phones capable of receiving SMS messages,” explains Nathan Wenzler, chief security strategist at consulting firm AsTech. “Some estimates suggested that up to two-thirds of users would be affected in this way.”
But he continued, “Adding the option to receive an email does not add any additional security, either, as email accounts can also be compromised in many ways, allowing an attacker to intercept the one-time passcode sent to a user’s inbox as well. Is the SSA meeting [current] policy requirements? Yes. Are they creating a more secure site for their users? Not really.”
Chris Roberts, chief security architect at threat detection firm Acalvio is just as damning. “I won’t sugarcoat this: of all of those that could be affected, seniors are the most wary of text messages, especially when so many damn scams come across as text messages these days. Therefore, this might not be the best solution. The fact that it’s been proven several times that a text 2FA does little to help combat fraud means that there’s still a lot that the SSA needs to do.”
The SSA, however, is in a difficult position. It provides a necessary service to a large number of citizens, many of whom were born before the technology and internet revolution. Some have never adapted, but still rely on the SSA. In order to maintain its service to all its customers, it is forced to adopt the lowest common denominator for its 2FA. Normally, this would be SMS 2FA — but for the SSA’s particular range of customers, even that is too high. It supplemented SMS with email text. The result is simply a weak and vulnerable form of authentication, albeit stronger than passwords alone. “Using email as a way to verify Americans,” comments Marc Boroditsky, VP and GM of Authy, “is, at best, misguided, and, at worst, a high-risk attack vector for massive fraud.”
Could it have done better? Yes, says Boroditsky. “Even if someone’s phone number isn’t text-enabled, you can still do phone number verification or 2FA over a simple voice call to that person. And with regard to ‘technical complexity’ of 2FA, this should be really straightforward. I’ve seen developers build a verification app in 5 minutes that works with nearly every phone on the planet.”
But flawed 2FA is not the only SSA departure from NIST’s draft guidelines. NIST takes the view that password length is more important than password complexity. “Since the size of a hashed password is independent of its length, there is no reason not to permit the use of lengthy passwords (or pass phrases) if the user wishes.” This allows the user to use a phrase based on, for example, a favorite line of poetry: easy for the user to remember, hard for the criminal to crack. “Allow at least 64 characters in length to support the use of passphrases,” recommends NIST. “Encourage users to make memorized secrets as lengthy as they want, using any characters they like (including spaces), thus aiding memorization.” But the SSA website currently accepts passwords of between only 7 and 20 characters.
If NIST’s draft guidelines become reality unchanged, the SSA will have much to do. It will know this. It might be expecting an exemption; or the current changes might simply be a holding-exercise while it develops a better system more in line with NIST’s expectations. What other factors could the SSA adopt? Tom Conklin, Sr. director of security & compliance at Vera, comments, “That’s a challenge because nothing is perfect, not everyone has a cell phone, email can be compromised, and private keys can be stolen. One approach would be for the social security to adopt an open standard like FIDO universal second factor. This way anyone with a FIDO compatible device or app could use it with the Social Security website.”
