Microsoft is urging users to move away from phone-based multi-factor authentication (MFA) solutions, such as one-time codes sent via SMS and voice calls, and replace them with newer MFA technologies, such as app-based authenticators and security keys.
The warning comes from Alex Weinert, Microsoft's director of Identity Security. For the past year, Weinert, on behalf of Microsoft, has been urging users to enable MFA on their online accounts.
Citing internal Microsoft statistics, Weinert said in a blog post last year that users who enabled multi-factor authentication (MFA) ended up blocking about 99.9% of automated attacks against their Microsoft accounts.
But in the post released today, Weinert says that if users have to choose, they should stay away from multi-factor authentication (MFA) verification done over the phone.
Microsoft expert says telephone networks have many security issues.
Weinert says that both SMS and voice calls are transmitted in cleartext and can be easily intercepted by determined attackers , using techniques and tools such as SDRs, FEMTO cells or SS7 jamming services .
SMS-based one-time codes can also be intercepted through open-source and readily available phishing, such as Modlishka, CredSniper, or Evilginx.
Additionally, a well-known method is SIM swapping which allows attackers to obtain MFA codes on behalf of their victims.
Additionally, telephone networks are also exposed to changing regulations, downtime, and performance issues , which all impact the overall availability of the MFA mechanism.
Messages and voice calls are not secure
All of this makes MFA via SMS or calls the least secure of the MFA methods available today,” according to Weinert.
Weinert says users should enable a stronger MFA mechanism for their accounts if available, recommending Microsoft's Authenticator MFA app.
But if users want the best possible option, they should opt for hardware, which Weinert ranked as the best MFA solution in a blog post he published last year.
Postscript: This means that users should disable SMS or voice verification on accounts . SMS verification is better than no verification at all.
