4 ms·

I would love to use a proper authenticator app or security key for everything important, but the reality we live in is that many financial institutions still on

by lkbm 4y ago

I would love to use a proper authenticator app or security key for everything important, but the reality we live in is that many financial institutions still only support phone-based 2FA. If CloudFlare ould force them all to add support for proper 2FA, that would be fantastic, but I don't think that's an option. If they can make SIMs more secure in the meantime, that's a win, and a very important one. Improve the things you have control over rather than just bemoaning the things you don't.

filoleg 4y ago
> the reality we live in is that many financial institutions still only support phone-based 2FA I believe that's exactly the point the grandparent comment was addressing when they said "we stop using SIM for authentication". The "we" wasn't necessarily referring users, but to services and providers currently using SIM 2FA in their products.
- lkbm 4y ago
  Sure, but Cloudflare can't make that happen, so instead Cloudflare is doing what they can.
  - filoleg 4y ago
    I totally agree with you. I am not blaming Cloudflare here, they are trying to create workarounds and patch holes around the lack of proper 2FA from those services and providers. But the real goal is imo those services and providers implementing proper 2FA.
Abishek_Muthian 4y ago
> but the reality we live in is that many financial institutions still only support phone-based 2FA. True and even highly sensitive Govt. services authentication for citizens in some large countries depends upon SMS based 2FA, Although the CF article is focused on corporate infrastructure security and I doubt if any of the 'Fortune 1000' companies mentioned actually still use SMS 2FA; CF is trying to block the phishing URL from being resolved and SIM-swap. Meanwhile as a concerned individual, Since SMS 2FA is not dying soon I would wish at least some mechanism is brought forth to prevent the underpaid, overworked personnel at the carrier from being able to access that 2FA SMS and aiding in SIM-swapping.

by lkbm 4y ago

filoleg 4y ago

> the reality we live in is that many financial institutions still only support phone-based 2FA I believe that's exactly the point the grandparent comment was addressing when they said "we stop using SIM for authentication". The "we" wasn't necessarily referring users, but to services and providers currently using SIM 2FA in their products.

lkbm 4y ago
Sure, but Cloudflare can't make that happen, so instead Cloudflare is doing what they can.
- filoleg 4y ago
  I totally agree with you. I am not blaming Cloudflare here, they are trying to create workarounds and patch holes around the lack of proper 2FA from those services and providers. But the real goal is imo those services and providers implementing proper 2FA.

Abishek_Muthian 4y ago

> but the reality we live in is that many financial institutions still only support phone-based 2FA. True and even highly sensitive Govt. services authentication for citizens in some large countries depends upon SMS based 2FA, Although the CF article is focused on corporate infrastructure security and I doubt if any of the 'Fortune 1000' companies mentioned actually still use SMS 2FA; CF is trying to block the phishing URL from being resolved and SIM-swap. Meanwhile as a concerned individual, Since SMS 2FA is not dying soon I would wish at least some mechanism is brought forth to prevent the underpaid, overworked personnel at the carrier from being able to access that 2FA SMS and aiding in SIM-swapping.