3 ms·

For the vast majority of users who are not the targets of government attacks, SMS OTP is still a huge win for account security. Alex Stamos put it well: https:

• darpa_escapee 10y ago
  State actors aren't the only ones threatening the security of SMS OTP.
• agwa 10y ago
  SMS-based 2FA doesn't stop phishing, which is a significant security benefit of U2F.
• seanp2k2 10y ago
  The security of these is actually somewhat DUE TO the low adoption rates. If all of my consumer services have SMS 2FA, attackers will currently just move on to the next account in their list. It's similar to the spam game: it doesn't have to be perfect, just enough to make it not economically viable to spend the time required to crack it. Once everyone has SMS 2FA, I'll move on to push or U2F and be ahead for another decade or so. It's just important that people are given an option, so lazy / don't know any better consumers can do the easy thing and get their accounts stolen, while people who actually care / know enough to know they should care can stay somewhat safer. The unbalance is unfortunate, but until we figure out a way to ACTUALLY secure things which companies will get onboard with (related: the US uses chip cards now...but still only requires a signature facepalm) staying one or two steps ahead of the general population makes you pretty safe against everything except targeted attacks.