Security Analysis of SMS-enabled Websites

Annotation Explanation
initial X 2FA signup mandatory X 2FA required to enable 2FA, CAN be disabled in favor of other options after
X 2FA used as mandatory backup X 2FA required as a backup to enable 2FA, CANNOT be disabled in favor of other options
X 2FA mandatory X 2FA required to enable 2FA, CANNOT be disabled in favor of other options
automatic X backup signup X 2FA discreetly enabled without user input or notification
Proprietary Authenticator app that is exclusive to the website; either uses tap-to-login or TOTP
U2F U2F security key
PKQ Personal knowledge (security) questions
Secure - uses stronger authentication schemes, such as authenticator apps; schemes cannot be recovered or reset by SMS.
Insecure - can only be compromised if the attacker knows the account password; these configurations offer SMS-based authentication but do not allow for SMS-based password recovery
Doubly insecure - a SIM swap alone is enough for account compromise; the configuration uses both SMS-based MFA and SMS-based password recovery
Insecure, but not pertinent to our analysis
Likely insecure based on account recovery page; unable to verify due to noted restrictions
Name Recommended Configuration Alternate Configuration 1 Alternate Configuration 2 Alternate Configuration 3 Account/Password Recovery Remarks Screenshots
1 (ISC)2 Authenticator Authenticator; SMS SMS; PKQ Authenticator; PKQ PR email backup signup available
2 Acquia Authenticator; SMS SMS Authenticator PR email backup signup recommended
3 Adafruit Authenticator; SMS SMS Authenticator PR email SMS backup signup recommended
4 Airtable SMS; Authenticator SMS PR email SMS 2FA mandatory
5 Allegro SMS Authenticator; SMS PR email SMS 2FA used as mandatory backup
6 Ally Bank PR SMS Restriction - bank account required for account creation
7 Amazon Web Services Authenticator U2F PR email SMS 2FA still used but no longer enrollable
8 Ancestry SMS PR email
9 Apple Proprietary; SMS PR linked device SMS backup signup mandatory; 2FA cannot be disabled once set
10 Atlassian Authenticator SMS PR email
11 Autodesk Authenticator; Email SMS; Email PR email automatic email backup signup using email on file
12 Backblaze SMS Authenticator Authenticator; SMS PR email; PR SMS only if SMS 2FA is not enabled
13 Betterment SMS SMS; Authenticator PR email SMS 2FA mandatory; backup signup available
14 BiggerPockets SMS SMS; Authenticator PR email SMS 2FA mandatory; backup signup available
15 Bitflyer Email Authenticator SMS PR email
16 Bithumb SMS Authenticator PR email initial SMS 2FA signup mandatory; 1-step login with OTP available if SMS 2FA is enabled
17 Bitlish SMS Authenticator PR email
18 Bitly SMS PR email
19 bitwarden Authenticator Authenticator; Email SMS U2F PR email SMS 2FA available with premium membership
20 Blockchain Authenticator U2F SMS PR seed
21 Booking.com SMS; Email PR email automatic email backup signup using email on file
22 Box SMS PR email
23 BTC BOX Authenticator Authenticator; SMS SMS PR email SMS 2FA improperly configured, does not manifest
24 Buddy SMS Authenticator PR email
25 Buffer SMS Authenticator PR email
26 Buycraft Email Authenticator; SMS PR email initial email 2FA signup mandatory; SMS 2FA used as mandatory backup for authenticator 2FA
27 CEX.IO Authenticator SMS PR email
28 Circle SMS Authenticator PR email initial SMS 2FA signup mandatory
29 Cisco Meraki SMS Authenticator; SMS PR email SMS 2FA used as mandatory backup
30 Cloze SMS Authenticator PR email
31 CM Telecom SMS Proprietary; SMS PR email automatic SMS backup signup using phone number on file
32 Coinbase U2F Authenticator SMS PR email already explicitly recommends against SMS 2FA, explanation provided but not directly linked
33 CoinDeal SMS; Authenticator PR email SMS 2FA used as mandatory backup
34 Coinjar Authenticator Authenticator; SMS SMS PR email Recommends against SMS but labeles authenticator as 'advanced'
35 Coinspot Authenticator SMS PR email Already explicitly recommends against SMS 2FA
36 Comcast PR SMS; PR email Restriction - utility service required for account creation
37 Con Edison PR SMS; PR email Restriction - utility service required for account creation
38 Cosmolex SMS PR email
39 Delighted SMS; Email PR email automatic email backup signup using email on file
40 DigitalOcean Authenticator; backup code Authenticator; SMS SMS; backup code SMS; Authenticator PR email backup signup available
41 Discord Authenticator; SMS Authenticator PR email authenticator 2FA mandatory; SMS backup signup recommended
42 Docusign Authenticator; SMS; Email SMS; Email Email PR email email 2FA used as mandatory backup; required 2 combined phone number/email backup minimum
43 Dropbox SMS Authenticator; SMS Authenticator Authenticator; U2F PR email SMS backup signup recommended
44 Dynadot Authenticator SMS Authenticator; SMS PR email backup signup available
45 easyDNS Authenticator SMS Email PR email
46 Electronic Arts (Origin) Authenticator; Email SMS Email PR email backup signup available; backups cannot be disabled once set
47 Etsy Authenticator SMS Phone PR email
48 Evernote Authenticator SMS PR email SMS 2FA available with Evernote Premium
49 Facebook Authenticator SMS U2F PR SMS only if 2FA is not enabled; PR email
50 FastMail Authenticator U2F PR SMS only if 2FA is not enabled; PR email only if 2FA is not enabled Outdated - no SMS 2FA
51 Figma Authenticator Authenticator; SMS SMS PR email backup signup available
52 Fiverr Proprietary; Email; SMS PR email
53 Flywheel Authenticator SMS PR email
54 FollowMyHealth Authenticator; Email; SMS PR email automatic SMS backup signup using phone number on file; automatic email backup signup using email on file; backups cannot be disabled once set
55 Formstack Authenticator; SMS SMS Authenticator PR email SMS backup signup recommended
56 FreeTaxUSA SMS; Email Authenticator; SMS; Email Authenticator; Email Authenticator; SMS PR SSN initial SMS 2FA signup mandatory; initial email 2FA signup mandatory
57 Gemini Authy SMS U2F PR email initial SMS 2FA signup mandatory, permanantly switches to Authy if installed
58 GitHub Authenticator Authenticator; SMS SMS U2F PR email SMS backup signup available
59 GoCardless SMS PR email
60 GoDaddy SMS; Authenticator; U2F SMS; U2F Authenticator SMS PR email backup signup recommended
61 Google SMS; Authenticator; U2F Authenticator Proprietary; U2F SMS; U2F; Proprietary PR email; PR SMS only if SMS 2FA is not enabled; PR manual review
62 Grape SMS Authenticator PR email
63 GroupMe SMS PR email
64 Guild Wars 2 Email SMS Authenticator PR email initial email 2FA signup mandatory
65 Gusto SMS Authenticator PR email
66 HashiCorp Terraform Enterprise Authenticator; SMS Authenticator SMS PR email SMS backup signup recommended
67 HashiCorp Vagrant Cloud Authenticator; SMS Authenticator SMS PR email SMS backup signup recommended
68 HelloSign Authenticator SMS PR email SMS 2FA available with upgrade
69 Hover.com Authenticator SMS PR email
70 HubSpot Authenticator; SMS Authenticator SMS PR email backup signup recommended
71 Hushmail Authenticator; SMS; Email SMS; Authenticator Email Authenticator No PR No PR; all schemes selected by default
72 ID.me SMS Authenticator; SMS Authenticator; Proprietary Proprietary; U2F PR email backup signup available
73 IFTTT Authenticator SMS PR email
74 Infomaniak Proprietary SMS; Email; U2F Proprietary; U2F PR email backup signup available
75 Instagram SMS Authenticator SMS; Authenticator PR email backup signup available
76 Intuit TurboTax SMS SMS; Authenticator PR email; PR SMS only if 2FA is not enabled; PR PII SMS 2FA used as mandatory backup; 1-step login with OTP available if 2FA is not enabled
77 Jottacloud Authenticator SMS PR email
78 Justworks Authenticator; SMS Authenticator; Email SMS; Email Email PR email
79 Keeper SMS Authenticator PR email other 2FA options available with enterprise plan
80 Kickstarter Authenticator; SMS SMS PR email SMS 2FA mandatory; backup signup recommended
81 LinkedIn Authenticator SMS PR SMS only if 2FA is not enabled; PR email
82 LogMeIn Authenticator; SMS Authenticator; Email SMS; Email PR email backup signup mandatory
83 Mail.Ru SMS SMS; Authenticator Authenticator PR email; PR SMS only if 2FA is not enabled initial SMS 2FA signup mandatory
84 MathWorks Authenticator SMS Email SMS; Authenticator PR email backup signup available
85 Mercado Libre Proprietary SMS Authy Proprietary; SMS PR email backup signup available; Authy 2FA disables all backup schemes
86 Minds SMS PR email
87 Mixpanel SMS; Authy PR email automatic Authy backup signup using phone number on file
88 MongoDB Cloud Manager Authenticator Authenticator; SMS SMS PR email SMS backup signup available
89 Namecheap Authenticator U2F SMS Proprietary PR email initial SMS 2FA signup mandatory for proprietary 2FA signup
90 Newegg SMS; Email SMS; Authenticator Email; Authenticator PR email backup signup mandatory
91 Nexmo SMS PR email
92 Nimbox Authenticator SMS Email PR email
93 Norton Proprietary; SMS SMS; U2F Proprietary; U2F PR email backup signup mandatory
94 Okta Proprietary SMS; Proprietary PKQ; Proprietary PR email proprietary 2FA mandatory; backup signup available
95 Patreon SMS Authenticator PR email
96 Paychex PR SMS; PR email Restriction - enterprise signup only
97 Paytm PR SMS Restriction - non-U.S. phone number required for account creation
98 PCloud SMS Authenticator PR email
99 Personal Capital PR SMS; PR email Restriction - cannot sign up for 2FA without adding financial accounts
100 Pinterest SMS; Authy PR email automatic Authy backup signup using phone number on file
101 Plastiq SMS PR email
102 Playstation Network SMS PR email
103 Questrade SMS; Email PR email SMS 2FA mandatory; email 2FA used as mandatory backup
104 RBCommons Authenticator SMS Authenticator; SMS PR email SMS backup signup available
105 Recurly Authy SMS PR email initial SMS 2FA signup mandatory, permanantly switches to Authy if installed
106 Redacted Authenticator SMS PR SMS; PR email Redacted
107 Redacted Authenticator; SMS SMS PR SMS; PR email SMS 2FA used as mandatory backup
108 Redacted Authenticator; SMS Authenticator; Email; SMS PR email; PR SMS SMS 2FA used as mandatory backup; using SMS disables 2FA altogether
109 Redacted Authenticator; SMS; Email PR SMS; PR email automatic SMS backup signup using phone number on file; automatic email backup signup using email on file
110 Redacted Email Email; SMS; Authenticator Email; SMS PR SMS; PR email email 2FA mandatory
111 Redacted Email; SMS Authenticator PR SMS; PR email SMS 2FA used as mandatory backup for email 2FA
112 Redacted Proprietary Proprietary; SMS Authenticator; U2F SMS PR SMS; PR email 1-step login available via PR SMS number
113 Redacted Proprietary; Email SMS; Email PR SMS automatic email backup signup using email on file; 1-step login with OTP available if 2FA is not enabled
114 Redacted Proprietary; Email; SMS PR SMS; PR email automatic SMS backup signup using phone number on file; automatic email backup signup using email on file; proprietary app can be disabled with SMS
115 Redacted Proprietary; Email; SMS Email; SMS PR SMS; PR email automatic SMS backup signup using phone number on file; automatic email backup signup using email on file; 1-step login (via notification, OTP via SMS, OTP via email) enabled if proprietary app 2FA is selected
116 Redacted SMS Authenticator PR SMS; PR email
117 Redacted SMS SMS; Authenticator Authenticator PR SMS; PR email backup signup available
118 Redacted SMS Authenticator SMS; Authenticator PR SMS; PR email backup signup available
119 Redacted SMS Authenticator; SMS PR SMS; PR email automatic SMS backup signup using phone number on file
120 Redacted SMS PR SMS; PR email
121 Redacted SMS; Authenticator Authenticator SMS PR SMS; PR email backup signup recommended
122 Redacted SMS; Email PR SMS; PR email automatic email backup signup using email on file; 1-step login with OTP available
123 Repairshopr Authenticator; SMS Authenticator PR email SMS backup signup recommended
124 Ring SMS PR email
125 Robinhood SMS Authenticator PR email
126 RoboForm Email SMS Authenticator PR email
127 Salesforce Authenticator; SMS Proprietary; SMS U2F; SMS PR email SMS 2FA used as mandatory backup
128 Samsung SMS PR email
129 SecureSafe SMS PR seed 2FA availabe with subscription upgrade
130 Sentry Authenticator; SMS Authenticator SMS U2F PR email SMS backup signup recommended
131 Shopify Authenticator Authenticator; SMS Authenticator; U2F SMS PR email backup signup available
132 Signal No PR No PR; E2EE, phone number only used as identifier, attacker can hijack future communications; Outdated - No 2FA
133 Slack SMS Authenticator PR email
134 Sonic PR phone call Restriction - utility service required for account creation
135 Square SMS SMS; Authenticator Authenticator PR email backup signup available
136 StatusCake SMS Authenticator PR email
137 Stripe SMS Authenticator SMS; Authenticator Authenticator; U2F PR email
138 T-Mobile PR phone call Restriction - utility service required for account creation
139 Telegram Password; Email; Proprietary Password; Proprietary PR email only if email 2FA is set automatic tap-to-login 2FA sent to other signed-in devices
140 Ting Authenticator SMS PR email
141 Tokopedia PR SMS; PR email Restriction - non-U.S. phone number required for 2FA signup
142 TransferWise SMS Proprietary; SMS PR email initial SMS 2FA signup mandatory; automatic SMS backup signup using phone number on file; 2FA cannot be disabled once set
143 TransIP Authenticator; SMS PR email authenticator 2FA mandatory; SMS 2FA used as mandatory backup
144 Tumblr SMS Authenticator SMS; Authenticator PR email backup signup available
145 Twilio SMS; Authy PR email automatic Authy backup signup using phone number on file
146 Twitch SMS; Authy PR email; PR SMS automatic Authy backup signup using phone number on file; PR SMS is in beta
147 Twitter SMS SMS; Authenticator Authenticator SMS; U2F PR SMS only if 2FA is not enabled; PR email backup signup available; Optional feature called PR Protect - requires email address to be correctly entered, does not help against PR SMS
148 Uber SMS Authenticator PR email 1-step login with OTP available if 2FA is not enabled
149 Ukraine Authenticator; SMS PR email authenticator 2FA mandatory; SMS 2FA used as mandatory backup
150 Unity SMS SMS; Authenticator Authenticator PR email backup signup available
151 VK SMS SMS; Authenticator PR SMS only if 2FA is not enabled; PR email backup signup available; SMS 2FA mandatory
152 Wealthsimple Authenticator SMS PR email
153 WhatsApp PIN; Email PIN No PR No PR; 1-step login enabled; phone number only used as identifier, attacker can hijack future communications
154 XING SMS Authenticator PR SMS; PR email SMS 2FA requires non-US number
155 Yandex.Money Proprietary PR SMS only if 2FA is not enabled; PR email only if 2FA is not enabled; PR SMS + old password 1-step login (via in-app QR scanner, via in-app OTP) enabled if 2FA is enabled
156 Zendesk Authenticator SMS PR email