4 ms·

So don't do SMS OTP and use an authenticator app instead, which is more secure. And inflammatory comments aside, yes, any good IT org should believe that it's

by hirsin 8y ago

So don't do SMS OTP and use an authenticator app instead, which is more secure. And inflammatory comments aside, yes, any good IT org should believe that it's more likely for a user to be phished and give away their super secure xkcd based password than it is for a nation-state attacker to target their phone OS with a 0day.

xte 8y ago
Try to think about different scenarios: first not a nation vs nation attack but a simple dictatorship attack against some opponent, something like "hey see! This bad guy have done many criminal thing". Also think about what kind of situation we have today with anything based on few proprietary hardware and software commonly used anywhere. After think about ancient Plan9 model which put your personal workstation at the center of the world and "services" only as "addition" to it. In this scenario need of auth, risk of phishing etc substantially vanish.