3 ms·
The security advantage is that an attacker using a completely different device doesn’t have your phone.
by jgilias 4y ago
The security advantage is that an attacker using a completely different device doesn’t have your phone.
- ale42 4y agoExcept that SMS messages can be intercepted, e.g. by having a proper access to the SS7 backbone, by abusing services provided for other reasons, or by SIM swapping attacks. All of this has already been done, so it's not just theory. See e.g. https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at..., https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev..., https://arstechnica.com/information-technology/2016/08/congressman-to-fcc-fix-phone-network-flaw-that-allows-eavesdropping/ https://arstechnica.com/information-technology/2016/08/congr...
- jgilias 4y agoYes, of course, the Ask:HN is basically about that! The parent comment asserted that having an SMS in addition to a password is functionally no different from having a password only. Which is not the case.