2 ms·
Telecoms are not hardened against phishing attacks and are some of the dinosaur centric industries. Please, and I ask very nicely, if you work for a tech compan
by exabrial 6y ago
Telecoms are not hardened against phishing attacks and are some of the dinosaur centric industries. Please, and I ask very nicely, if you work for a tech company, do everything you can to fight implementing SMS as an authentication factor. It not private, nor authenticated, has no delivery guarantees, easily spoofed, easily intercepted, and easily forged.
One only has to look at Jack Dorsey getting jacked to prove this is an inevitability for every single one of your users.
- MaxBarraclough 6y agoDidn't the Dorsey hack occur because Twitter were using SMS for single factor? https://news.ycombinator.com/item?id=20939915 https://news.ycombinator.com/item?id=20939915
- bcrl 6y agoSS7's security model is basically the same as BGP. Peers assume they can trust one another. The cost for entry here in Canada is about $50,000. Pay that to the incumbent telco and you can basically have an SS7 connection of your very own, and announce cell phone numbers to the rest of the world. Electronic Funds Transfer is similarly based on trust. I can withdraw funds from any bank account just by knowing the account number. The only incentive is that you don't want to lose your account, but once you've been through the process of setting things up, it's quite easy to see how the system could be gamed. Maybe someday we'll be able to trust the underlying protocols our lives are built on top of.