5 ms·

Isn't 2FA considered dangerous now? We've seen how susceptible it can be to social engineering. On a related note, I noticed that my Windows Phone displays tex

Isn't 2FA considered dangerous now? We've seen how susceptible it can be to social engineering. On a related note, I noticed that my Windows Phone displays text message notifications even when it's locked... So adding a PIN doesn't prevent an attacker from doing 2FA if they have access to my phone.

schoen 10y ago
There were also cases of attackers tampering with the phone system to intercept 2FA tokens. Much better is authenticator-app-based or hard-token-based 2FA.
mtgx 10y ago
SMS 2FA isn't safe at least, and even NIST is deprecating it. The rest depends on dumb implementations, like Paypal allowing 2FA bypass with a change of the login link, or Google allowing 2FA bypass of all of its other methods by forcing you to use a phone number as "backup", which is to 2FA what secret questions were to passwords (their Achilles's heel).
- et-al 10y ago
  Secret questions are horrible when they're predefined, and what's worse is when the options are also predefined (e.g. United Airline's website). However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world who know and I'm comfortable with that (of course this changes with the over-publicising of our lives on social media). But I'm digressing and agree TOTOP 2FA is great for the masses. Just be sure to have the backup codes stored in a safe space.
  - pbhjpbhj 10y ago
    >However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world // Who quite possibly can be established from either your Facebook or your friends' Facebook (eg you have your friends list set private but a friend who posts on your wall doesn't). Taking the "I had a crush on 'snail-fridge-running-spectrum'" line reduces the number who know the answer to on average less than 1(!).
lorenzhs 10y ago
2FA with a hardware token (U2F, Universal Second Factor) is the safest method. It has built in phishing protection, and sites can't track the token (no unique ID). It's really nice and I use it a lot but carrying around a token on your key ring makes it a hard sell for the general public.
sp332 10y ago
That notification behavior is a default, but you can change it if you want your messages to be more secure.
noja 10y ago
> Isn't 2FA considered dangerous now? SMS 2FA is weak, but either better than no second factor or worse depending on your situation. Use a TOTP app like FreeOTP or Google Authenticator for good 2FA. > I noticed that my Windows Phone displays text message notifications even when it's locked On Android you can disable that, even per app. Maybe Windows can do that too.
alasdair_ 10y ago
2FA via an insecure channel (like SMS) is dangerous. 2FA with, say, a hardware token or even a phone app is generally pretty good.

schoen 10y ago

There were also cases of attackers tampering with the phone system to intercept 2FA tokens. Much better is authenticator-app-based or hard-token-based 2FA.

mtgx 10y ago

SMS 2FA isn't safe at least, and even NIST is deprecating it. The rest depends on dumb implementations, like Paypal allowing 2FA bypass with a change of the login link, or Google allowing 2FA bypass of all of its other methods by forcing you to use a phone number as "backup", which is to 2FA what secret questions were to passwords (their Achilles's heel).

et-al 10y ago
Secret questions are horrible when they're predefined, and what's worse is when the options are also predefined (e.g. United Airline's website). However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world who know and I'm comfortable with that (of course this changes with the over-publicising of our lives on social media). But I'm digressing and agree TOTOP 2FA is great for the masses. Just be sure to have the backup codes stored in a safe space.
- pbhjpbhj 10y ago
  >However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world // Who quite possibly can be established from either your Facebook or your friends' Facebook (eg you have your friends list set private but a friend who posts on your wall doesn't). Taking the "I had a crush on 'snail-fridge-running-spectrum'" line reduces the number who know the answer to on average less than 1(!).

lorenzhs 10y ago

2FA with a hardware token (U2F, Universal Second Factor) is the safest method. It has built in phishing protection, and sites can't track the token (no unique ID). It's really nice and I use it a lot but carrying around a token on your key ring makes it a hard sell for the general public.

sp332 10y ago

That notification behavior is a default, but you can change it if you want your messages to be more secure.

noja 10y ago

> Isn't 2FA considered dangerous now? SMS 2FA is weak, but either better than no second factor or worse depending on your situation. Use a TOTP app like FreeOTP or Google Authenticator for good 2FA. > I noticed that my Windows Phone displays text message notifications even when it's locked On Android you can disable that, even per app. Maybe Windows can do that too.

alasdair_ 10y ago

2FA via an insecure channel (like SMS) is dangerous. 2FA with, say, a hardware token or even a phone app is generally pretty good.