3 ms·

I hope Apple, Google, et all will step using SMS as required 2FA, or regulation comes down the pipeline to eliminate this practice.

amichal 5y ago
NIST attempted to indicate SMS was not usable for 2FA sometime in 2016. Since other methods were not common yet (and maybe because banks had just barely gotten SMS 2FA deployed?) they were pressured to "soften" their recommendation. Their followup blog post https://www.nist.gov/blogs/cybersecurity-insights/questionsand-buzz-surrounding-draft-nist-special-publication-800-63-3 https://www.nist.gov/blogs/cybersecurity-insights/questionsa... Edit: https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB 5.1.3.3 Authentication using the Public Switched Telephone Network Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10. If out-of-band verification is to be made using the PSTN, the verifier SHALL verify that the pre-registered telephone number being used is associated with a specific physical device. Changing the pre-registered telephone number is considered to be the binding of a new authenticator and SHALL only occur as described in Section 6.1.2. Verifiers SHOULD consider risk indicators such as device swap, SIM change, number porting, or other abnormal behavior before using the PSTN to deliver an out-of-band authentication secret.
- atatatat 5y ago
  Good to know even they're toothless, now..
  - deleted 5y ago
    [deleted]
  - meepmorp 5y ago
    NIST isn't a regulatory agency, so they aren't meant to have "teeth."
- rocqua 5y ago
  That blog post was really interesting. I'm going to save it for future reference.
bagacrap 5y ago
not only does Google not require 2fa, it offers multiple other methods of 2fa besides sms
lotsofpulp 5y ago
Google does not require SMS 2FA. Not sure if Apple does, they prefer to use other devices logged into iCloud as 2FA.

amichal 5y ago

NIST attempted to indicate SMS was not usable for 2FA sometime in 2016. Since other methods were not common yet (and maybe because banks had just barely gotten SMS 2FA deployed?) they were pressured to "soften" their recommendation. Their followup blog post https://www.nist.gov/blogs/cybersecurity-insights/questionsand-buzz-surrounding-draft-nist-special-publication-800-63-3 https://www.nist.gov/blogs/cybersecurity-insights/questionsa... Edit: https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB 5.1.3.3 Authentication using the Public Switched Telephone Network Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10. If out-of-band verification is to be made using the PSTN, the verifier SHALL verify that the pre-registered telephone number being used is associated with a specific physical device. Changing the pre-registered telephone number is considered to be the binding of a new authenticator and SHALL only occur as described in Section 6.1.2. Verifiers SHOULD consider risk indicators such as device swap, SIM change, number porting, or other abnormal behavior before using the PSTN to deliver an out-of-band authentication secret.

atatatat 5y ago
Good to know even they're toothless, now..
- deleted 5y ago
  [deleted]
- meepmorp 5y ago
  NIST isn't a regulatory agency, so they aren't meant to have "teeth."
rocqua 5y ago
That blog post was really interesting. I'm going to save it for future reference.

bagacrap 5y ago

not only does Google not require 2fa, it offers multiple other methods of 2fa besides sms

lotsofpulp 5y ago

Google does not require SMS 2FA. Not sure if Apple does, they prefer to use other devices logged into iCloud as 2FA.