3 ms·
I think the worst is when companies force you to leave SMS on as a fallback. On stripe, I use a security key. Someone has to either steal my keyring, or steal
by WhyNotHugo 6y ago
I think the worst is when companies force you to leave SMS on as a fallback.
On stripe, I use a security key. Someone has to either steal my keyring, or steal my backup key.
But I'm force to leave SMS on as a fallback, so really, the weakest link is there, and a potential cracker only needs to break this extremely fragile insecure system, and completely bypass the security key.
- postalrat 6y agoI assume it's their attempt at reducing support calls.
- R0b0t1 6y agoSo is stripe liable for your account being compromised due to SIM hijacking? The telephone companies claim they're not liable, and you certainly aren't liable, so who is? This smells similar to banks not needing to check check signature anymore.
- snarf21 6y agoI agree. SMS is an attack vector, not an authentication.
- Arkanosis 6y agoEven worse is when companies force you to use SMS as the first and sufficient authentication factor. EDF (the biggest European electricity provider) does that in France.