2 ms·
I see the advice not to use SMS for 2FA comes up a lot on HN, and understand the reasons why that is true. But I find that recommendation comes up short. What
by michrassena 8y ago
I see the advice not to use SMS for 2FA comes up a lot on HN, and understand the reasons why that is true. But I find that recommendation comes up short. What are the alternatives, and how can they be widely deployed for little cost?
- village-idiot 8y agoToken based 2FA, either via something like google authenticator or a USB dongle like a Yubikey or RSA token. The point is to prove that you have possession of both knowledge and a physical token (hence two factor). And while sms to phone makes it seem like you are proving possession of the phone, you’re actually proving that you have the phone that texts will route to. That last bit is movable and subject to shockingly little security, hence the issue.
- aviv 8y agoEven 2FA that involves you receiving a call is more secure than 2FA that involves you getting a text, but of course that too should not be used, ever. It's just that SMS is that much worse. I wish I could share on HN the technique anyone anywhere can use to take over any mobile number's SMS traffic within a minute so we can discuss it at great detail, but obviously I know better and would never do it. Unfortunately this knowledge is not limited to myself and many people out there know this especially after being in telecom for a while.