3 ms·
I hope he loses, so financial services will stop supporting 2FA over SMS. Is that more or less likely than SMS providers fixing their security?
by tantalor 8y ago
I hope he loses, so financial services will stop supporting 2FA over SMS.
Is that more or less likely than SMS providers fixing their security?
- rubatuga 8y agoHow about he wins, and then we slowly wean off a more secure SMS system for everybody?
- aeternus 8y agoThere are plenty of secure messaging services out there. Making one that works for everyone is not a trivial problem. Suppose you own a coffee shop and offer free wifi, should you be held responsible if someone logs into a bank without SSL and gets their credentials sniffed? Should you be responsible for designing a wifi protocol that uniquely encrypts the traffic of each user, without shared keys, to prevent sniffing?
- ghouse 8y ago2FA isn't _this_ problem. It's password resets via SMS that are the problem here.
- LyndsySimon 8y agoSMS is 2FA. I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
- tinco 8y agosms password resets are not 2fa. 2fa means you have two factors of authentication. If the only thing you need to authenticate is control over a phone number, then that's just one factor. Two factor authentication is when you need both a password and an SMS token, like how GitHub does it. I'm not saying SMS 2fa is strong enough, often passwords are weak and/or weakly guarded, and ostensibly phone numbers can be fidgeted with. But having a phone number be the only thing guarding your entire identity is a whole next level of weak.