4 ms·
Except SMS is better than nothing, right? Yes it's flawed. But it's a harder attack than simple password auth. An attacker has to to target an individual and kn
by ams6110 10y ago
Except SMS is better than nothing, right? Yes it's flawed. But it's a harder attack than simple password auth. An attacker has to to target an individual and know their phone number, and be able to spoof their phone.
- tptacek 10y agoIt depends. SMS is better than nothing as a second factor, but SMS has a weird way of worming its way into single-factor status. I think people should avoid SMS 2FA, and should be skeptical of the security of companies that offer only SMS and neither of TOTP or U2F.
- StavrosK 10y agoThis frustrates me endlessly about Namecheap. They only allow SMS, and, for something as valuable as my domain name (figuratively the keys to my kingdom), that's unacceptable.
- tonyztan 10y agoHave you tried using a (free) Google Voice number for 2FA purposes? Google Voice has no/minimal customer support, so it should be almost as secure as your Google Account.
- StavrosK 10y agoHaha, I love the reasoning there. I haven't, but you're right, I should.
- scrollaway 10y agoWell if you manage to do that, let me know. To my knowledge creating a text/voice compatible Google Voice number is not possible in europe.
- StavrosK 10y agoI had created one when I was in the US, so I do have one. I can't add a European phone number to it, but I can receive SMS with it.
- aianus 10y agoI transfered my domain to route 53 and let them know this was the reason why.
- nl 10y agoIf SMS can be used for account recovery (ie, 'I forgot my password' functionality) then it is probably worse.
- throwaway91111 10y agoOk, a 2fa protecting anything of value (such as money) should not be trivially breakable by state actors.
- always_good 10y ago2FA altogether isn't necessarily better than nothing. At its worst, it opens up a social engineering / customer support "lol lost my phone" attack vector that didn't exist before. SMS 2FA can be defeated by hijacking someone's number. Happened to me. One day I opened my Macbook and saw the "A new iPhone has been activated for your iCloud account". They had access to my number for hours after I called up my carrier.