3 ms·
Demonstrating that passwords are also a poor factor doesn't make using SMS as an additional factor a "bad idea". A physical cell phone is also something that is
by c22 7y ago
Demonstrating that passwords are also a poor factor doesn't make using SMS as an additional factor a "bad idea". A physical cell phone is also something that is loosely associated with you, transferable and vulnerable to social engineering attacks.
It turns out there are no really good ways to authenticate individuals at scale. The answer is not to deride and blacklist arbitrary bad options from the pool, but to add even more factors so that their differing contexts present a more formidable holistic challenge.
Obviously, as GP points out, supporting multiple factors but allowing any one of them to be used in isolation is just building a chain with a weakest link. Better to build a chain-link fence.
- scarface74 7y agoA physical cell phone is also something that is loosely associated with you, transferable and vulnerable to social engineering attacks. SIM swapping is not always the result of social engineering attacks. There are bad actors that work for carriers who will knowingly fraudulently swap sims. At least with something like Google Authenticator that can be done at scale, someone has to have your physical device and has to get past your hopefully secure pin code/finger print sensor/face id or use rubber hose decryption.