4 ms·
SMS as a second factor is not and is unlikely to be secure for a second factor anytime in the near future given the design of SS7 and the glacial pace that the
by mirashii 7y ago
SMS as a second factor is not and is unlikely to be secure for a second factor anytime in the near future given the design of SS7 and the glacial pace that the global telecom industry moves at for upgrading core infrastructure. The lock prevents port-out attacks, but is still not sufficient for considering SMS as okay to use for a second factor. Use TOTP instead.
- js2 7y agoI use something more secure than SMS as my sole second factor where I can. Unfortunately some sites still require a phone number. I’ve edited my comment to be clear about that. So if you have to use a phone number, is GV the least bad option?
- NotSammyHagar 7y agoI think it's better than the phone company, but as discussed, someone could force steal your number. Secondly, if someone hacks your gmail, they can access google voice themselves but just logging in as you. My freaking gmail is my main barrier against the world. I sure as heck use a yubi key (I have multiple) plus password. If my gmail is hacked, I'd be in trouble like a lot of tech people. I think that's the ultimate - break into gmail and you'd have endless things to steal.