3 ms·
Reading or entering codes from SMS is really risky. If the message doesn't say who it's from in the body, there's no safe way to proceed. Let's say you're tryi
by Thorrez 5y ago
Reading or entering codes from SMS is really risky. If the message doesn't say who it's from in the body, there's no safe way to proceed.
Let's say you're trying to create an account on website A. It sends says you need to confirm your phone number and sends you an SMS and you need to give it the code. The SMS says "Your verification code is 395724". Do you type it in? There's no way to know whether that was legitimately sent by website A, or was sent by one of the 100 other websites you have accounts on and was sent due to website A trying to hack that account.
Even if it does say "395724 is your Facebook Password reset code", 90.5% of people won't pay attention to it saying "Facebook" and will just type the code into whatever website they're trying to sign up for.[1]
[1] https://www.ieee-security.org/TC/SP2017/papers/207.pdf https://www.ieee-security.org/TC/SP2017/papers/207.pdf
- quickthrower2 5y agoUber has a 4 digit code SMS and you just need tel. no and this code to get in. Someone has been trying to hack by sending dozens of them. There is no option to change my password when I log in. I just removed the payment method. 1000 numbers and a botnet and just guess 1234 and youll probably get into an account. I wonder why Uber doesnt make it more secure.
- jabbany 5y agoScrolling through my 2FA SMS's, it does seem like every service is putting their name in the SMS and it usually comes before the code ("Your [service name] security code is ..."). A bunch also write "[service name] won't call you for this code" or "This code is for online entry only." I do believe most people don't read this stuff, especially since most more recent phone OS's tend to offer to extract the code into the clipboard for you.