2 ms·
E-mail seems to be the solution. It's out of bound; authentication/authorization are required; there's standards to flag an invalid origin; filters spam. It's n
by 0xbadcafebee 4y ago
E-mail seems to be the solution. It's out of bound; authentication/authorization are required; there's standards to flag an invalid origin; filters spam. It's not encrypted, but neither is SMS. Most of today's dumb phones can check e-mail, so it's almost ubiquitous. The only way it doesn't work is for rural users who have no data but do have GSM/SMS.
- lxgr 4y agoI agree, but unfortunately some regulatory bodies like the EBA have specifically labeled it "not a factor for 2FA purposes"... Ironically, my email inbox is much better protected than my SIM/phone number.
- 0xbadcafebee 4y agoWe should lobby them to change the rules, as a second e-mail account would literally be a second factor. Then it's up to the user to hook it up to their phone.
- devoutsalsa 4y agoEmail based authentication is lame. If a hacker gets access to your email, then they automatically have access to your 2FA. Lame.
- pkulak 4y agoSo if a hacker gets access to your second factor, they have access to your second factor?
- lxgr 4y agoAnd if they get access to my phone number they get access to my texts and phone calls. That's why neither should ever be the only authentication factor (nor a single-factor recovery method for that matter). That said, my phone number is significantly easier to take over than my email address and mailbox.
- ridgered4 4y agoMost (but not all) free email providers now seem to require SMS verification to sign up for them these days.
- lxgr 4y agoTrue, but at least you need an SMS-capable number only once (to sign up), and not every time you are trying to authenticate to some "secure" website.