3 ms·
SMS 2-factor is wrong and bad and NIST has been yelling about this since 2016 or before. Simjacking is real and fairly commonly used in targeted attacks. 2-fa
by hprotagonist 6y ago
SMS 2-factor is wrong and bad and NIST has been yelling about this since 2016 or before. Simjacking is real and fairly commonly used in targeted attacks.
2-factor as an idea is great, and this author seems very confused.
- jandrese 6y agoSMS should only ever be used as a proof of investment. IE making sure a bit setting up hundreds of thousands of accounts (because they broke your CAPCHA) needs to buy tens of thousands of real phone numbers with service. It’s a one time thing at account creation and should be immediately deleted afterwards. Real 2FA should be set up afterwards to actually protect the account. A yubikey or even a simple TOTP app is a lot of protection against account takeover. The only big weakness left at that point is the help desk.
- UncleMeat 6y ago> TOTP app This is only very marginally more effective than SMS. Phishing is way more common and can be automated much more easily than SIM-swapping. With TOTP you close a small window but leave the big door open. Yubikeys prevent phishing, which is enormously valuable.
- frei 6y agoAll the arguments in the post against SMS 2FA are also arguments against TOTP
- jandrese 6y agoThere is no help desk that can give away your TOTP secret. That’s the big weakness with SMS, someone buys a phone and asks the clerk to give them your phone number.
- UncleMeat 6y agoIt is a publicized weakness. In practice, phishing is scalable and social engineering isn’t. And humans are shit at detecting phishing attacks.