3 ms·

Sure, but it seems a bit short-sighted to assume that SMS brings no benefit. If a customer somehow loses access, SMS is far cheaper and more available for all i

Sure, but it seems a bit short-sighted to assume that SMS brings no benefit. If a customer somehow loses access, SMS is far cheaper and more available for all involved than any other alternative. Most people don't want to carry any dongles (especially not institution-specific ones) and many don't really want to install apps or have phones that will wipe app data for infrequently-used apps.

bigDinosaur 3y ago
SMS as a backup is very different to SMS as your only option. For one it can be made much more inconvenient to use SMS so as to reduce the surface area for scams. Plenty of places still have it as the primary and only 2FA mechanism. Of course SMS itself is awful which is the key problem here. What you mean is that having your phone tied to an identity is useful (what if you lose your phone? SMS is no longer at all useful) and we could do much better than SMS for that.
- berkes 3y ago
  > SMS as a backup Indeed. I once worked on a system where we had SMS as one of the "last resorts". When someone used SMS as recovery, we'd disable withdrawals and fundings (it was some sort of wallet) as well as severely limit their daily limits. Until the account was fully restored again using normal, secure methods (Mail, KYC, etc). We were hit by a similar "attack" where our "let us call you to start recovery" was abused by putting a toll-number there, and our system would then call this toll-number and we'd get rediculous bills. But putting in limitations helped a lot, so we did this for SMS too.
- ta1243 3y ago
  If I lose my phone I get a replacement simcard from my provider in a day or two, and SMS continues to work If I lose my phone I've lost all my various OTP authenticator apps - I don't think they are backed up to icloud
  - bigDinosaur 3y ago
    You should be able to back up your OTP generator codes, I have mine in KeepassXC and on my phone. Note as well that you really don't want to rely on SMS if travelling internationally, which is a use case I hit reasonably frequently.

bigDinosaur 3y ago

SMS as a backup is very different to SMS as your only option. For one it can be made much more inconvenient to use SMS so as to reduce the surface area for scams. Plenty of places still have it as the primary and only 2FA mechanism. Of course SMS itself is awful which is the key problem here. What you mean is that having your phone tied to an identity is useful (what if you lose your phone? SMS is no longer at all useful) and we could do much better than SMS for that.

berkes 3y ago
> SMS as a backup Indeed. I once worked on a system where we had SMS as one of the "last resorts". When someone used SMS as recovery, we'd disable withdrawals and fundings (it was some sort of wallet) as well as severely limit their daily limits. Until the account was fully restored again using normal, secure methods (Mail, KYC, etc). We were hit by a similar "attack" where our "let us call you to start recovery" was abused by putting a toll-number there, and our system would then call this toll-number and we'd get rediculous bills. But putting in limitations helped a lot, so we did this for SMS too.
ta1243 3y ago
If I lose my phone I get a replacement simcard from my provider in a day or two, and SMS continues to work If I lose my phone I've lost all my various OTP authenticator apps - I don't think they are backed up to icloud
- bigDinosaur 3y ago
  You should be able to back up your OTP generator codes, I have mine in KeepassXC and on my phone. Note as well that you really don't want to rely on SMS if travelling internationally, which is a use case I hit reasonably frequently.