9 ms·
SMS 2FA is not secure. Lots of HN posts about it: https://hn.algolia.com/?q=sms+2fa https://hn.algolia.com/?q=sms+2fa
by sand500 4y ago
SMS 2FA is not secure. Lots of HN posts about it:
https://hn.algolia.com/?q=sms+2fa https://hn.algolia.com/?q=sms+2fa
- 2muchcoffeeman 4y agoUnfortunately it’s still better than no other factor especially for most people.
- jqpabc123 4y agoAnyone have any examples of widespread violation of OTP for 2FA --- something other one individual who gave his buddy his phone or something?
- UncleMeat 4y agoSMS 2FA is basically the same as TOTP against phishing. It is worse in that you can be hit with sim-swapping. Phishing is many orders of magnitude more common than sim-swapping. There is a real difference between these two options, but it is wildly overemphasized online. The gap between SMS/TOTP and a Yubikey or equivalent is way larger.
- mehrdada 4y agoI was not suggesting SMS 2FA when I referred to "Smartphone-based solution". I meant relying on Secure Enclave or alike on the smartphone as the second factor in a challenge-response fashion that makes the "OTP" bound to a specific domain and thus unphishable.
- sand500 4y agoSorry I didn't see the SMS part was a quote of the parent.