SMS-based two-factor authentication (2FA) can be vulnerable to man-in-the-middle (MitM) phishing scenarios due to SIM swap attacks and SS7 protocol-level vulnerabilities. An attacker can capture the one-time password (OTP) sent to the user's phone via a fake login page and forward it to the actual system in real-time. This has become a common practice with today's phishing tools. This situation prompts organizations and individual users to consider Hardware Security Keys (HSMs) or passwordless authentication methods based on FIDO2/WebAuthn.
However, the decision to switch from SMS OTP to hardware security keys is not just a technical security upgrade. It involves direct operating costs, hardware supply logistics, recovery procedures in case of lost keys, and user habits. In this article, we will compare SMS OTP and physical hardware security keys in terms of cost, practicality, and actual security level, and discuss how to establish a sustainable balance in field conditions.
ℹ️ Field Note
Thanks to FIDO2 standards, security keys are no longer limited to external USB/NFC devices. The Secure Element and TPM chips on mobile devices and computers can also function as hardware security keys.
Architectural Vulnerabilities of SMS-Based Two-Factor Authentication
SMS-based authentication was the most practical channel for reaching the masses in the early days of two-factor authentication (2FA). It allowed users to authenticate without needing to install additional software or carry hardware, using only their GSM line. However, the security architecture of the telecommunications infrastructure was not designed for authentication processes.
The architectural vulnerabilities in the SS7 (Signalling System No. 7) protocol family allow malicious actors to redirect SMS messages sent to the target GSM number to their own devices at the global network level. Additionally, SIM swap attacks, which involve deceiving GSM operators' customer services through social engineering, allow attackers to intercept all SMS OTP codes without physically accessing the user's phone.
+-------------------+ A2P SMS Gateway +-------------------+
| Identity Server | ------------------------> | GSM Operator |
+-------------------+ +-------------------+
|
SS7 / SIM Swap | Vulnerability
v
+-------------------+ +-------------------+
| Real User | | Attacker |
+-------------------+ +-------------------+
A more common threat is reverse proxy-based phishing tools. The attacker presents users with an interface that is an exact replica of the actual service. When the user enters their username, password, and OTP code received via SMS on this fake page, the attacker's server simultaneously forwards this information to the real system and steals the session cookie. Since the SMS OTP message becomes a static string the moment it is sent, the user has no way to verify which domain they are entering the code into.
How FIDO2 and WebAuthn Standards Work in Hardware Security Keys
The FIDO2 standard and W3C WebAuthn API fundamentally change the static authentication logic provided by SMS OTP. The system is built on asymmetric key pairs (Public/Private Key) instead of symmetric encryption or time-based codes. When a user registers with a service, an asymmetric key pair specific to that service (Origin/Domain) is generated within the secure chip of the hardware security key (Authenticator). The public key is sent to the server, while the private key is stored within the chip and never leaves the device.
During the authentication phase, the server sends a random challenge to the user. The hardware security key signs this challenge and the current domain (Origin) accessed by the browser with its private key. The process requires the user to physically touch the device (User Presence) or provide a PIN/Biometric verification.
This architecture is highly resistant to phishing attacks because of the domain (origin) context. If the user is on a fake phishing site (e.g., g00gle.com), the browser informs the hardware security key of the g00gle.com domain via the WebAuthn API. The hardware security key will not use or generate a signature for this fake domain with the private key registered for google.com. Thus, even if the user is deceived into entering their credentials on the fake site, the attack will fail.
Cost Comparison: A2P SMS Per-Message Billing vs. Hardware Security Key Investment
Beyond the security aspect, there is a significant financial dimension. Using SMS OTP is not as free or cheap as it seems. Organizations pay per message for A2P (Application-to-Person) SMS services for in-app messaging and authentication. A2P SMS prices are on a continuous upward trend in the international market and with local operators.
A more common threat is SMS Toll Fraud (Premium Rate Number Scam) or SMS Pumping attacks, where bot networks cause an application's registration or password reset forms to send thousands of SMS messages to high-cost country codes. This results in companies facing unexpectedly large SMS bill items overnight.
| Comparison Criteria | A2P SMS 2FA | Hardware Security Key |
|---|---|---|
| Cost Model | Variable cost per message | One-time fixed investment per device (CAPEX) |
| SMS Pumping Risk | High (Risk of bots exploiting forms) | None (No server-side SMS sending) |
| Unit Cost | $0.0075 - $0.05 per SMS sent (varies by country and operator) | $22 - $95 per device (one-time, varies by model) |
| Lifespan / Durability | Requires continuous subscription | Physical durability and long usage life |
| Phishing Protection | None (Vulnerable to MitM proxies) | Full protection (FIDO2 Origin binding) |
| Operational Logistics | No logistics required (GSM infrastructure) | Device distribution and inventory tracking required |
In contrast, the cost model for hardware security keys shifts from Variable Expenses (OPEX) to Fixed Capital Investment (CAPEX). The cost of a YubiKey or equivalent FIDO2 hardware security key varies by model. While the initial supply cost may seem high, especially for organizations with many employees, the elimination of active SMS sending fees and fraud risks means the investment can provide financial advantages in the medium term.
Practicality and User Experience: Operational Challenges
While security level is crucial, the practicality of a method in field conditions is determined by user experience (UX). The biggest advantage of SMS OTP is its zero learning curve. Everyone knows how to enter a 6-digit code received on their phone into a box. However, this comes with significant usability issues:
- Areas with poor GSM coverage, such as server rooms, basements, or foreign travel, where the SMS code may not arrive.
- SMS transmission delays causing the user to click the "Resend Code" button multiple times and overlapping verification codes.
- The user losing access to the system entirely if their phone battery dies.
Using hardware security keys is much simpler: just plug the key into a USB port or tap it on the back of a phone via NFC. No code reading, copying, or typing is required. The authentication time is in milliseconds.
+-------------------------------------------------------------------+
| USER EXPERIENCE AND USABILITY COMPARISON |
+-------------------------------------------------------------------+
| SMS OTP: [Wait for Code] -> [Read Code] -> [Type Code] (15-30 seconds)|
| Hardware Security Key: [Touch Device] (< 2 seconds)|
+-------------------------------------------------------------------+
However, the biggest operational hurdle for hardware security keys is physical loss. What happens if an employee leaves their hardware security key at home, loses it, or breaks it? Access to email or critical production infrastructure is completely blocked. This adds an extra burden on IT support teams.
⚠️ Lost Key Management
Systems that rely on a single hardware security key will lock the user out of the system if the key is lost. Each user should have at least two keys registered (Primary and Backup), or an emergency protocol should be established.
Transition Strategy and Creating a Hybrid Security Model
It's unrealistic to switch from SMS 2FA to hardware security keys overnight. Especially in organizations with thousands of employees or large user bases, a phased hybrid model should be implemented.
1. Step-up Authentication
Policies should be determined based on the criticality level of the resources being accessed. For example:
- Standard Access (Email, Internal Documents): Software-based TOTP (Google/Microsoft Authenticator) or Passkey.
- Critical Access (Production Servers, AWS/GCP Root/Admin Accounts, Databases): Mandatory FIDO2 Hardware Security Key.
2. Passkey (Software FIDO2) Integration
The Passkey technology integrated into operating systems (iOS, Android, macOS, Windows) allows users to enjoy the FIDO2 security provided by hardware security keys without purchasing an additional physical device. The device's own TPM chip and biometric layers (TouchID/FaceID) act as a hardware security key. This approach reduces costs while providing significantly higher security than SMS OTP.
# Example: WebAuthn Server-Side Challenge Verification Configuration (Python/FastAPI concept)
from webauthn import verify_authentication_response
from webauthn.helpers.structs import AuthenticationCredential
def validate_user_login(credential_payload: dict, expected_challenge: bytes, user_public_key: bytes):
try:
auth_verification = verify_authentication_response(
credential=AuthenticationCredential.parse_raw(credential_payload),
expected_challenge=expected_challenge,
expected_rp_id="company.com",
expected_origin="https://company.com",
credential_public_key=user_public_key,
# credential_current_sign_count parameter can be used to prevent replay attacks.
# This example is simplified but should be included in production environments.
require_user_verification=True # PIN or Biometric requirement
)
return True, auth_verification.new_sign_count
except Exception as e:
# Authentication is denied in case of domain mismatch or invalid signature
return False, str(e)
3. Bring Your Own Device (BYOD) and Backup Procedures
Allowing users to register their personal mobile devices' Face/Touch ID as Passkey/WebAuthn reduces the organization's hardware supply costs. The system should always have a primary and a backup authenticator registered. The backup authenticator can be a second hardware security key stored in a safe or securely stored one-time recovery codes.
Conclusion
SMS 2FA has largely lost its security function in today's cyber threat landscape and with advanced phishing tools. Additionally, increasing A2P SMS costs and the risk of SMS pumping make this method financially unsustainable. Hardware security keys (FIDO2/WebAuthn) offer a highly resistant security standard against phishing attacks by architecturally preventing man-in-the-middle attacks.
However, transitioning to hardware security keys requires managing logistical processes, initial investment costs, and lost key scenarios. The most practical and cost-effective approach is to mandate physical hardware security keys for critical infrastructure personnel and implement a Passkey/WebAuthn software framework for the general user base. SMS OTP should be retained only as a last resort (fallback) method or phased out of the system altogether.
Top comments (0)