4 ms·

It isn't the telcos, it's the people asserting that SMS is the only way to authenticate someone (my bank does this), it's not only absurd but also horrifically

It isn't the telcos, it's the people asserting that SMS is the only way to authenticate someone (my bank does this), it's not only absurd but also horrifically inconvenient as it assumes the number happens to be tied to the SIM in your device, in my case the number is in another country, and ends up on a VM, not my mobile device (I don't give my real number to anyone and I rarely use voice), SMS was never secure since it's readable by at the very least 3 entities, but yet it's treated as such by all sorts of people who should know better but it ticks some checkbox for compliance.

jacquesm 5y ago
SMS isn't secure and I don't think anybody ever advertised it as such, the security for MFA use derives from the use of various channels even if the information itself travels in plaintext, the theory being that your average hacker won't have access to all of those channels. This is a broken assumption at the root of many multi-factor authentication methods. SMS should not be used like this but telling users to stop it isn't productive, it is the various institutions that demand it be used that are the problem.
- throwaway67743 5y ago
  That's what I was saying, it's the enforced use of insecure channels by institutions (and also horribly inconvenient)
eternityforest 5y ago
SMS auth has one really big advantage. There is a human run authority one can appeal to if a device is ever lost, stolen, or forgotten, which you might not be able to afford to manage yourself. It also makes spam accounts harder to make. I think it should always be an option until something with similar properties arrives(Like a YubiKey with the option to have them keep a key on file and reorder, with their agents somehow making sure it's you).
- novocantico 5y ago
  It's also extremely easy to abuse, which IMO kind of negates the benefit you pointed out.

jacquesm 5y ago

SMS isn't secure and I don't think anybody ever advertised it as such, the security for MFA use derives from the use of various channels even if the information itself travels in plaintext, the theory being that your average hacker won't have access to all of those channels. This is a broken assumption at the root of many multi-factor authentication methods. SMS should not be used like this but telling users to stop it isn't productive, it is the various institutions that demand it be used that are the problem.

throwaway67743 5y ago
That's what I was saying, it's the enforced use of insecure channels by institutions (and also horribly inconvenient)

eternityforest 5y ago

SMS auth has one really big advantage. There is a human run authority one can appeal to if a device is ever lost, stolen, or forgotten, which you might not be able to afford to manage yourself. It also makes spam accounts harder to make. I think it should always be an option until something with similar properties arrives(Like a YubiKey with the option to have them keep a key on file and reorder, with their agents somehow making sure it's you).

novocantico 5y ago
It's also extremely easy to abuse, which IMO kind of negates the benefit you pointed out.