5 ms·

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever devic

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

datr 10y ago
There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.
- scrollaway 10y ago
  Additionally, it requires an active phone number, which may not be available to you in general or temporarily.
doublec 10y ago
It's possible for an attacker to intercept the SMS based 2FA http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-and-telegram-encryption-useless-503894.shtml http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-an...
dingaling 10y ago
> Curious, why is SMS-based auth a downside in your opinion? If I go 40 miles south I'm in ( the Republic of ) Ireland and can't receive SMS.
colinbartlett 10y ago
Airplanes are a big one for me as a frequent traveler. Every plane has wifi but you can't receive SMS. If my previous cookie expired or the site thinks the plane's IP is new and strange, then I might have no way to sign in from the air.
- geekamongus 10y ago
  How much tweeting do you do on an average flight?
  - hnal943 10y ago
    Reading tweets is perfect for a flight, it's a never-ending stream of entertaining information that doesn't require a lot of concentration.
realusername 10y ago
No phone network for me why I go back to my parents place so it's complicated.
weeksie 10y ago
Try spending a bit of time traveling. I've been on the road for almost a year. My phone number changes every month or two (or more depending on if I'm buying new tourist SIMs everywhere I go).
sudojudo 10y ago
Nobody else has mentioned this, so maybe I'm an odd-ball, but I don't like giving out my phone number to ad-based services, especially social media sites. What do they do with that information? It feels like data collection veiled in security. Giving out more personal information is the exact opposite of everything I've learned about privacy and security.

datr 10y ago

There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.

scrollaway 10y ago
Additionally, it requires an active phone number, which may not be available to you in general or temporarily.

doublec 10y ago

It's possible for an attacker to intercept the SMS based 2FA http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-and-telegram-encryption-useless-503894.shtml http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-an...

dingaling 10y ago

> Curious, why is SMS-based auth a downside in your opinion? If I go 40 miles south I'm in ( the Republic of ) Ireland and can't receive SMS.

colinbartlett 10y ago

Airplanes are a big one for me as a frequent traveler. Every plane has wifi but you can't receive SMS. If my previous cookie expired or the site thinks the plane's IP is new and strange, then I might have no way to sign in from the air.

geekamongus 10y ago
How much tweeting do you do on an average flight?
- hnal943 10y ago
  Reading tweets is perfect for a flight, it's a never-ending stream of entertaining information that doesn't require a lot of concentration.

realusername 10y ago

No phone network for me why I go back to my parents place so it's complicated.

weeksie 10y ago

Try spending a bit of time traveling. I've been on the road for almost a year. My phone number changes every month or two (or more depending on if I'm buying new tourist SIMs everywhere I go).

sudojudo 10y ago

Nobody else has mentioned this, so maybe I'm an odd-ball, but I don't like giving out my phone number to ad-based services, especially social media sites. What do they do with that information? It feels like data collection veiled in security. Giving out more personal information is the exact opposite of everything I've learned about privacy and security.