3 ms·
SMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.
by jeanlucas 8y ago
SMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.
- bena 8y agoIsn't it effectively plaintext? I don't know too much about the SMS protocol. But I do know that most protocols do start out plaintext because programmers are lazy and optimistic.
- village-idiot 8y agoThat’s one part of the problem. The other part is that it’s actually quite easy to convince most cell phone carriers to change the SIM card associated with a given phone number. Once you’ve pulled that off hijacking the account is easy.
- marcosdumay 8y agoIt's not exactly plaintext. Last time I saw it was using broken crypto (may have changed since then, but I doubt it), and it encrypts the data hop by hop, so that if you insert yourself as a hop, you'll just have decrypt (with your keys), read and encrypt it.