5 ms·

This. SMS 2FA has been considered insecure by NIST since 2016 [1] and it's a major pain when travelling and swapping sim cards. [1] https://www.theregister.com

This. SMS 2FA has been considered insecure by NIST since 2016 [1] and it's a major pain when travelling and swapping sim cards. [1] https://www.theregister.com/2016/07/24/nist_says_sms_no_good_for_authentication https://www.theregister.com/2016/07/24/nist_says_sms_no_good...

tornato7 3y ago
The best solution is to create a Google Voice account and use that number for 2FA
- rtsil 3y ago
  Until Google decides to retire Google Voice...
- NoZebra120vClip 3y ago
  Many MFA implementations will detect and disallow the use of VoIP numbers... for security reasons.
  - twodave 3y ago
    Yep, and this is because sim-jacking is actually less profitable than just finding records of people’s _past_ phone numbers and signing up for a voip service that supports sms for that number. And many of the voip providers just don’t do any kind of fraud prevention. Source: I work at a place that is a natural target for this kind of thing.
Biganon 3y ago
I was thinking this with my health insurance website (which uses SMS 2FA), and I realized the problem is you can't expect your average Joe to know how to manage a TOTP 2FA correctly. SMS might not be the most secure, but it's probably better than 1FA, and absolutely everyone can use it. Enter your number, receive text, boom.
- kdklol 3y ago
  There are other options though Couldn't a health insurence company make an app? Or do SSO trough google and such? Webauthn is really easy! Controversial opinion: If you are given all these options and you cannot/refuse to use them, you shouldn't manage your insurrance trough the web. Either you are wholly computer-illiterate, deeply misinformed or you are not educated enough to use it safely. Of course, the main issue is that companies only give SMS 2FA as an option, or only one other, like the App method, which forces users without phones to fall back to SMS. Worst part is that especially financial institutions are guilty of this.
projektfu 3y ago
This is a beautiful catch-22 because when you can't use your SIM is also when they decide your location is too different and you must be reauthorized. The same for anti-fraud text messages, which are nice when you're home but useless when you're out of country. Why can't I set up an Authenticator again?

tornato7 3y ago

The best solution is to create a Google Voice account and use that number for 2FA

rtsil 3y ago
Until Google decides to retire Google Voice...
NoZebra120vClip 3y ago
Many MFA implementations will detect and disallow the use of VoIP numbers... for security reasons.
- twodave 3y ago
  Yep, and this is because sim-jacking is actually less profitable than just finding records of people’s _past_ phone numbers and signing up for a voip service that supports sms for that number. And many of the voip providers just don’t do any kind of fraud prevention. Source: I work at a place that is a natural target for this kind of thing.

Biganon 3y ago

I was thinking this with my health insurance website (which uses SMS 2FA), and I realized the problem is you can't expect your average Joe to know how to manage a TOTP 2FA correctly. SMS might not be the most secure, but it's probably better than 1FA, and absolutely everyone can use it. Enter your number, receive text, boom.

kdklol 3y ago
There are other options though Couldn't a health insurence company make an app? Or do SSO trough google and such? Webauthn is really easy! Controversial opinion: If you are given all these options and you cannot/refuse to use them, you shouldn't manage your insurrance trough the web. Either you are wholly computer-illiterate, deeply misinformed or you are not educated enough to use it safely. Of course, the main issue is that companies only give SMS 2FA as an option, or only one other, like the App method, which forces users without phones to fall back to SMS. Worst part is that especially financial institutions are guilty of this.

projektfu 3y ago

This is a beautiful catch-22 because when you can't use your SIM is also when they decide your location is too different and you must be reauthorized. The same for anti-fraud text messages, which are nice when you're home but useless when you're out of country. Why can't I set up an Authenticator again?