3 ms·
Great idea, BUT — Isn’t it true that it is fairly trivial for attackers to spoof the number they are calling “from”? If so, this could be a serious security we
by alanh 16y ago
Great idea, BUT —
Isn’t it true that it is fairly trivial for attackers to spoof the number they are calling “from”? If so, this could be a serious security weakness, couldn’t it?
- yanda 16y agoSpoofing the phone number is not very hard. That said, you'd still need the PIN to gain access to the email. A 4 digit pin is not the most secure thing around, but the combo of the phone number and the PIN seems reasonably safe. Thoughts?
- alanh 16y agoWasn’t aware of the PIN step. That does help. [You]† should definitely report failed attempts to log in, at least in an opt-in capacity. † Edited from “they”
- yanda 16y agoGood point. I will add it to the list of feature requests.
- alanh 16y agoThanks. I realized why I missed the bit about the PIN: 1. It is omitted from the steps in the main content area, and 2. Due to a design neurosis I have, I did not process the bit at the top that talks about the PIN being required because my brain fixated on the different icon styles (Logo: what I think of as SVG style; Gmail: well, Gmail; Phone: Silk-esque; PIN/shield: Vista/Win 7). I trust the vast majority of your visitors will be able to retain the information you presented instead of doing whatever my own mind does… Anyway, thanks for pointing that out. I think I’ll try it out!
- jberryman 16y agoA 4 digit pin isn't good enough if you care at all about thwarting serious attackers. Do a quick calculation of how long it would take an attacker with a script and 10 phone lines to get access. Maybe you could translate a longer password into the corresponding touchtones?