3 ms·

Yahoo! Japan, One of the most famous website in Japan, forces users to use insane auth method: SMS 1FA. It even accepts phone number as login ID. This is really

• Arkanosis 6y ago
  EDF, the largest electricity provider in Europe does the same in France. Actually, it even manages to do a bit worse: 1FA using SMS or email, but choice is left to the potential attacker. I've spent countless hours trying to explain them the issue in 2019 and gave up as nobody cared.
  • neolefty 6y ago
    What's the incentive for attackers?
• unscaled 6y ago
  It's a rather recent thing, and it's touted as a security feature. To be fair, Japan seems to be safer than most of the world when it SIM swapping (there are pretty strict identification requirements defined by law) and for porting phone numbers between SIM cards. I also never heard of any case of attacks against SS7 or other part of the telecommunication stack in Japan (I'd be happy to know if someone does) That being said, a certain class of SIM cards (SMS-only cards, without voice functionality) is exempt from most of these strict checks as far as I know, and there are other technical vulnerabilities that are probably just waiting to happen in Japan before they're taking seriously. I'm a little bit surprised that Yahoo! Japan went for SMS as the only authentication method, since their one of the main sponsors of the FIDO Japan WG.