4 ms·
Isn’t BankID subject to the same old issues with cellular networks that make SMS 2FA insecure? Mobile provider support human factor, connection MITM’ing, etc. (
by goblin89 7y ago
Isn’t BankID subject to the same old issues with cellular networks that make SMS 2FA insecure? Mobile provider support human factor, connection MITM’ing, etc. (https://news.ycombinator.com/item?id=16810266 https://news.ycombinator.com/item?id=16810266)
Edit: from sibling threads I can see that issuing a duplicate SIM card in Norway may require a very dedicated attacker, but mass-spoofing cell towers could still be an issue. I don’t know why do companies dislike non-SIM-associated OTP tokens so much…
- tjoff 7y agoNot at all. And the comment you link to is "just" social engineering. Tricking people into signing in someone else and then signing their transactions. Akin to "hey I'm from paypal please give me your password so I can verify it is you". Or "I'm from Microsoft support, you have a virus please run this executable so that we can help you". But it is a problem. And they explicitly target old and other people that (statistically) treat any computer stuff as black magic and are more likely to trust a stranger because they say they are calling from a bank/whatever.
- deleted 7y ago[deleted]