4 ms·

I gave up trying to solve this at the mobile operator level, they don't care, they don't get fined/sued enough and legislators are too incompetent/slow to fix t

I gave up trying to solve this at the mobile operator level, they don't care, they don't get fined/sued enough and legislators are too incompetent/slow to fix this. I just never use any service that forces 2FA by SMS. If it not avoidable for some reason, I make this account completely isolated from the rest of my online identity (new email just for it, regularly change password). If your bank/financial institution forces 2FA by SMS, it is time to change, most of the serious ones have their own app that handles 2FA. I'm yet to find one that allows to use your own OTP generators, so I'm usually forced to use their app for now.

toomuchtodo 4y ago
This is the happy path imho. Mobile providers cannot be trusted to be reliable identity providers.
- deleted 4y ago
  [deleted]
mox1 4y ago
The attack in the article had zero mention of SMS 2FA. They swapped the sim to get access to credit card fraud alerts, delivered via SMS.
- JohnFen 4y ago
  My CC company sends fraud alerts via email as well as SMS. They all should.
- throw101010 4y ago
  If they used SMS to identify the customer, isn't it a form of authentification? Having the credit card/credit card info is the first factor and the second factor seems to only have been being able to receive the SMS to confirm it wasn't fraud. I've experienced better banking apps which did use SMS at the initialization, but coupled it with other identifying factors (eg the phone IMEI or a code sent through postal services). If these app needed to be reinstalled the whole verification process would have to be redone.
ab_testing 4y ago
I don’t think there are any banks in the Us that use Authenticators to enforce 2FA. Although I have seen Robinhood does app based 2FA.
- aluminum96 4y ago
  App-based 2FA is offered for both checking and investment accounts at Fidelity, Schwab, and E-Trade. (The common factor is that these are all brokerages first, and banking providers second.) There may be others, but those are the ones I know of.

toomuchtodo 4y ago

This is the happy path imho. Mobile providers cannot be trusted to be reliable identity providers.

deleted 4y ago
[deleted]

mox1 4y ago

The attack in the article had zero mention of SMS 2FA. They swapped the sim to get access to credit card fraud alerts, delivered via SMS.

JohnFen 4y ago
My CC company sends fraud alerts via email as well as SMS. They all should.
throw101010 4y ago
If they used SMS to identify the customer, isn't it a form of authentification? Having the credit card/credit card info is the first factor and the second factor seems to only have been being able to receive the SMS to confirm it wasn't fraud. I've experienced better banking apps which did use SMS at the initialization, but coupled it with other identifying factors (eg the phone IMEI or a code sent through postal services). If these app needed to be reinstalled the whole verification process would have to be redone.

ab_testing 4y ago

I don’t think there are any banks in the Us that use Authenticators to enforce 2FA. Although I have seen Robinhood does app based 2FA.

aluminum96 4y ago
App-based 2FA is offered for both checking and investment accounts at Fidelity, Schwab, and E-Trade. (The common factor is that these are all brokerages first, and banking providers second.) There may be others, but those are the ones I know of.