4 ms·
OTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number. Thi
by j0ba 6y ago
OTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number.
This is not speculative. I've literally had to help relatives with this exact security breach.
Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your only authentication factor is much less secure than a password + 2FA.
An authenticator app, such as Authy, faces none of those security issues.
- ramraj07 6y agoI'm presenting the thesis that this system works in places like India and Brazil. I don't have data on my hand that such number transfer social engineering hacks are possible/prevalant here, do you have any?
- jwandborg 6y ago"here" is relative. Here's one data, this one from Canada: https://youtu.be/LlcAHkjbARs https://youtu.be/LlcAHkjbARs at 3:48
- ramraj07 6y agoSeems like it's a problem in countries where companies bend over backwards to appease customers, also including when they shouldn't. In other places the agent will just go you're SOL if you called asking to change ownership.
- httpsterio 6y agoVery untrue, it's a pretty common way of stealing social media accounts like Twitter and YouTube accounts. Happens all over the place, definitely in places like USA.