New U.S. Guidelines Could Halt Use of SMS for Two-Factor Authentication

The US National Institute for Standards and Technology has released a new draft of its Digital Authentication Guideline, which sets the rules that all authentication software eventually follows. In the document, NIST deprecates the implementation of SMS as a method with which users validate a second level of security on various accounts, "no longer" allowing its use in future guidelines as it is considered not secure enough (via TechCrunch).

iOS two-factor authentication

Two-factor authentication via SMS (left) and an alternative trusted iOS device (right)

Setting up two-factor authentication through text messages is one of the most popular ways users add another layer of security onto an account, on top of a basic password, including those for Apple's own software, like Apple ID and iCloud. Other than SMS, Apple allows users to implement two-factor authentication through a simple push notification sent to another "trusted device," or a phone call.

If the out of band verification is to be made using a SMS message on a public mobile telephone network, the verifier SHALL verify that the pre-registered telephone number being used is actually associated with a mobile network and not with a VoIP (or other software-based) service. It then sends the SMS message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change. OOB using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

The new guidelines also make a point for companies to ensure that two-factor authentication notifications aren't going through a VoIP service, which could be easily compromised. NIST also includes "limited use" of biometrics as a way for users to gain access to their second layer of authentication, meaning Apple could pivot to Touch ID as an alternative if SMS support for the security feature officially comes to an end.

Top Rated Comments

2457282 Avatar
65 months ago
I thought our government was trying to weaken security so they can access our phones. Who at NIST made this mistake of proposing a verification process that was more secure? Probably fired by the end of the week. :eek::D:p:cool:
Score: 20 Votes (Like | Disagree)
John Mcgregor Avatar
65 months ago
Apple can send an iMessage.
Score: 10 Votes (Like | Disagree)
gwhizkids Avatar
65 months ago
But its a much better way than doing nothing at all. Personally, we need to get to a whole new paradigm of authentication, period. Deprecate the password!
Score: 7 Votes (Like | Disagree)
Iconoclysm Avatar
65 months ago
I thought our government was trying to weaken security so they can access our phones. Who at NIST made this mistake of proposing a verification process that was more secure? Probably fired by the end of the week. :eek::D:p:cool:
If the government convinces you to use TouchID, they can force you to unlock your phone without a PIN.
Score: 6 Votes (Like | Disagree)
bdhokie Avatar
65 months ago
While it may not be perfect, the suggestion everyone should use an app eliminates any two factor authentication for small companies /developers who may not have those resources starting out. Instead of deprecating SMS, which is better than nothing, why not recommend it as a last resort?
Score: 5 Votes (Like | Disagree)
big-ted Avatar
65 months ago
Good.

SMS is a piss poor way of doing 2FA and lazy companies need to move towards apps such as google authenticator, authy, e.g.
You are assuming that everyone on the planet has a smart phone
Score: 5 Votes (Like | Disagree)

Top Stories

Pro Display XDR Yella

Apple Working on External Display With Built-In A13 Chip

Friday July 23, 2021 9:37 am PDT by
Apple is developing an external display that includes an A13 chip with Neural Engine, according to a new rumor from 9to5Mac. The A13 chip with Neural Engine would presumably serve as an eGPU, though details are light at this time. Having a CPU/GPU built into the external display could help Macs deliver high-resolution graphics without using all the resources of the computer's internal chip....
iOS 14 on iPhone feature emergency

Apple Releases iOS and iPadOS 14.7.1 With Fix for Touch ID Apple Watch Bug

Monday July 26, 2021 9:48 am PDT by
Apple today released iOS and iPadOS 14.7.1, minor bug fix updates that come just a week after the release of iOS 14.7, software that introduced new Apple Card features and support for the MagSafe Battery Pack. The iOS and iPadOS 14.7.1 updates can be downloaded for free and the software is available on all eligible devices over-the-air in the Settings app. To access the new software, go to...
discount m1 macbook yellow

Deals: Shop Record Low Prices Across Apple's Full MacBook Pro and MacBook Air Lineup (Up to $499 Off)

Friday July 23, 2021 8:23 am PDT by
Apple's MacBook Pro and MacBook Air lineup is seeing all-time low discounts across the board today, including the 2019 16-inch MacBook Pro, 2020 13-inch MacBook Air, and 2020 13-inch MacBook Pro. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. 13-Inch M1...
iphone 12 pro gold

Report: iPhone 14 Pro Models to Feature Tough Titanium Alloy Chassis

Monday July 26, 2021 1:12 am PDT by
Next year's "iPhone 14" series is expected to feature high-end models with a new titanium alloy chassis design, claims a new investors report by JP Morgan Chase. According to the report, the use of titanium alloy will be one of the biggest changes to the case design in the 2022 iPhone series, and Foxconn will be the exclusive manufacturer of the titanium frames for the high-end models....
FaceID iMac REREREREMIX

Gurman: Face ID on the Mac Coming Within a 'Couple of Years'

Sunday July 25, 2021 7:09 am PDT by
Apple plans to bring Face ID to the Mac within the next "couple of years," respected Bloomberg journalist Mark Gurman said today in the latest edition of his Power On newsletter. In the newsletter, Gurman says that he believes Apple's ultimate goal is to shift all of its products to Face ID, including the lower-end iPhones such as the iPhone SE and the iPad Air, which feature Touch ID....
airpods 3 gizmochina Feature

AirPods 3 Rumored to Launch Alongside iPhone 13 at Expected September Event

Friday July 23, 2021 12:54 am PDT by
The third-generation AirPods will likely launch at the same event revealing Apple's upcoming iPhone 13 lineup, according to a report from DigiTimes, which makes the claim citing sources familiar with the matter. The report as a whole echoes previous reporting that production of the third-generation AirPods will kickstart in August, meaning a launch shortly after can be easily expected. DigiTi...
imac with accessories

Larger Redesigned High-End iMac Rumored to Launch Next Year

Monday July 26, 2021 3:45 am PDT by
Apple's larger redesigned iMac will arrive sometime in 2022 rather than later this year, according to the leaker known as "Dylandkt." On Twitter, Dylandkt claimed that Apple's "high end iMac" is not expected to release in the fourth quarter of 2021 alongside Apple's "M1X Macs" – a reference to Apple's redesigned MacBook Pro models – because "Apple simply does not want their devices to...
apple bitcoin hack

Is Apple Really Buying Bitcoin?

Monday July 26, 2021 3:07 am PDT by
A large number of websites and posts on social media are stoking rumors that Apple has purchased $2.5 billion worth of bitcoin in the company's first move into cryptocurrency, but is there any validity to the claims? Many people are citing the fact that Apple was looking for a Business Development Manager with experience in alternative payments, including cryptocurrency, earlier this year as ...
apple mac business page

Apple Shares 11 Reasons Why Business Users Should Choose Macs

Monday July 26, 2021 11:35 am PDT by
Apple today updated its Apple at Work website with a new section dedicated to the Mac, which offers up 11 reasons why "Mac means business." On the webpage, Apple highlights the M1 chip as the number one reason why business users should choose a Mac, offering up an M1 overview [PDF] that explains the benefits of the M1 chip. The information isn't new, but it does provide a look at all of...
magsafe battery pack iphone 12 mini

Top Stories: Hands-On With MagSafe Battery Pack, iPhone 13 Always-On Display?

Saturday July 24, 2021 6:00 am PDT by
Apple's new MagSafe Battery Pack is now available, and we went hands-on this week for some early impressions of the new accessory to get more battery life out of Apple's iPhone 12 lineup. Subscribe to the MacRumors YouTube channel for more videos. This week also saw a number of rumors about the upcoming redesigned MacBook Pro models, the iPhone 13 lineup, the next-generation iPad mini, a new...