At Buffer, security has always been a balance: keeping our customers safe and at the same time logging in to make them seamless as possible for our global user base.
A few months ago we made a decision that may sound surprisingly to have SMS-based two-factor authentication (2FA) removed and completely transferred to e-mail-based verification.
It was not a change that we took lightly. SMS has long been seen as the standard for 2FA. But over time the disadvantages began to weigh against the benefits.
Here is the story of how we got there, what the transition looked and what we have seen since then.
Why we left SMS
SMS-based 2FA has long been considered a security standard, but our team discovered various critical issues that made us reconsider:
Vulnerabilities of security were more common than expected
SIM exchange attacks have become increasingly advanced, so that attackers can hijack phone numbers and bypass text-based security.
Moreover, SMS reports do not travel through multiple carriers through multiple carriers, creating potential interception points.
The costs were untenable scales
Every authentication -SMS costs money, and with our growing user base, these apparently small costs were added to hundreds of dollars every month. International SMS rates made this even more challenging because our global user base.
International regulations and requirements of the sender -id
SMS regulations vary dramatically per country, making compliance a constant challenge. Each country has different requirements for sender IDs (the name that appears as the sender of an SMS), whereby some require registration in advance that can last weeks or months to complete.
Singapore requires, for example, business verification documents, India demands a template before the approval process and the VAE has strict content restrictions.
Managing these requirements in more than 100 countries created a huge administrative burden that grew with every new regulations.
Moreover, the non -compliance with a local regulation can cause messages to be blocked, and ultimately customers cannot log in to Buffer.
Depending on third parties have made failure points
We trusted SMS-Gateway providers who occasionally encountered malfunctions, delivery delays or rate-restricting problems.
When these services fall, our users do not have access to their accounts – a critical problem for a tool that feeds strategies for social media worldwide.
Why e -Mail was more logical
When we looked for alternatives, we realized that we already had a stronger option: e -mail.
So instead of just removing SMS and call it a day, we have re -invented our authentication flow by recording E -Mail as a different location.
We have implemented time limited verification codes for one-time use that were sent via e-mail with improved security heads and coding. Our e-mail infrastructure, which we have already maintained for reports and updates, proved more reliable than SMS gateways from third parties.
We have also added tariff restriction and anomalo detection to prevent abuse.
The unexpected benefits of switching to E -Mail
The transition provided improvements outside our first expectations:
- Security has actually been improved. E -mail accounts usually have more robust security options than telephone numbers, including their own 2FA, restoration options and activity monitoring. Users retain better control over their e -mail accounts than their telephone numbers, which can be transferred without their knowledge.
- Support tickets fell. We saw a decrease in authentication -related support requests. Users no longer struggled with international SMS delivery problems, changed telephone numbers or carrier-specific problems.
- The development speed increased. Our engineering team no longer needs to maintain integrations with the SMS provider, error instrumentation issues for various carriers or handling land-specific SMS regulations.
How we rolled out the switch
Making this transition required careful planning.
We communicated the change to users well in advance and explained the security benefits and tackling worries. We have provided detailed migration guides and temporarily supported both methods during the transition period.
For users who prefer SMS, we helped them to understand that modern e -mail security, especially with providers such as Gmail or Outlook who offer robust protection, offers equal or better security than SMS.
We have also improved our e -mail delivery infrastructure to guarantee reliability, to implement unnecessary e -mail service providers and to closely monitor the delivery rates.
The right choice for buffer
This decision is not suitable for every company. Services that do not have e -mail addresses of users or that serve demography with limited E -mail access may need different solutions. For buffer – where every user has already linked an e -mail account to his profile – this change is perfectly in line with our needs.
Three months after the transition, the results speak for themselves: a reduction in authentication -related support sticks and significant monthly savings that we have reinvested in product improvements.
Look forward
The removal of SMS authentication initially felt like swimming against the current, but it forced us to critically think about security theater versus actual security. Sometimes the “standard” solution is not the best solution for your specific context.
We continue to explore extra authentication options, including support for hardware security keys. But our e-mail-first approach has proven that it can indeed be safer indeed.
We share these kinds of stories because we know that other teams have to deal with similar considerations. Have you recently reconsider a “standard” security practice? We would like to hear from you on our social media! Find us @Buffer everywhere and Follow Carlos here on LinkedIn.
#replaced #SMS #authentication #mail #authenticator #apps