4 ms·

Many services, including banks, have their users second factor auth tied to phone. Hopefully the whole esim and namely esim transfer initiative would end phone

by zx8080 3y ago

Many services, including banks, have their users second factor auth tied to phone. Hopefully the whole esim and namely esim transfer initiative would end phone as second factor. And yes, I know that options for 2FA are limited in general. But phone is not the best one.

Tijdreiziger 3y ago
But usually the second factor is tied to a bank app that you have to register in some way, not to your SIM.
Aerbil313 3y ago
Phones are a very good solution for 2FA, considering the requirements to obtain a phone number. The only disadvantage afaict is that SMS communication is easily intercepted and not encrypted.
- lotsofpulp 3y ago
  I thought the requirements were being a near minimum wage employee at mobile network store (in the US) or a call center employee. Which is usually how SMS 2FA are stolen, and no one is liable for the consequences. Which means SMS 2FA is pretty low security. Convenient for most, but secure? Hardly.
  - Aerbil313 3y ago
    Where I live all phone numbers are tied to national ID. When you are getting a new phone number you need to provide your ID card which has a chip and it is read by a device in order to tie the number to your ID for the phone number to be activated. I assume some cryptographic signing scheme is in action.
Dalewyn 3y ago
>But phone is not the best one. Phones are the best one. Why? Because (almost) everyone has one within reach. Security enthusiasts and believers constantly fail to understand why straight passwords and to a lesser extent phone 2FA never go away: All their proposed alternatives and solutions are inconvenient. Most people couldn't give a rotten rat's undead arse about security, but they will kill for convenience. Passwords and phone 2FA win and keep winning because they are convenient with good enough security.
- vigilans 3y ago
  The most uninformed takes always come with a healthy dose of arrogance and vulgarity. Every part of the industry that matters has been bitten by using phone numbers as a 2FA mechanism. It's why they're actually disappearing and are being phased out in favor of apps, OTP tokens, and email codes, depending on the amount of influence technical people wield at a given org.
  - Dalewyn 3y ago
    >in favor of apps, OTP tokens, and email codes And all of them are some form of jank or inconvenience. Look, most people (myself included) don't give a fucking fuck about security. Our time lost to the kabuki theater of security is worth more than the so-called "security" we gain, and that's assuming whatever is being secured is even worth securing. A determined attacker will ignore all that and just undermine everything with social engineering against a useful customer support tech anyway. Unless your solution is as simple as entering a password and hitting a button, which is the digital equivalent to taking out a key and unlocking your front door, it is not going to see widespread acceptance. Make your fucking security solutions convenient, not secure. kthxbai. Even cars did away with keys because turning the ignition is an inconvenience compared to just pushing a button.
    - tialaramex 3y ago
      > Unless your solution is as simple as entering a password and hitting a button What password? I mentioned the NHS app I use in a different sub-thread, so let's try my (not very good, would not recommend but they offered decent credit balance interest) current account. I tap the app on my phone, I get a whirl of nonsense, and then: "Verify that it's you" and I touch the fingerprint sensor on my Pixel 6. And that's it. No passwords, no PINs, no SMS messages, no separate authenticator device This is much more secure than real human passwords (it'll be an elliptic curve signed message, so similar to HTTPS) and much more convenient, and short of convincing me to literally send you my phone and my finger you can't trick me into giving you access.
      - 3y ago
sofixa 3y ago
> Hopefully the whole esim and namely esim transfer initiative would end phone as second factor. > And yes, I know that options for 2FA are limited in general. But phone is not the best one. Phone doesn't just mean SMS. E.g. bank apps in the EU use MFA with the bank's app directly which you have to unlock with biometrics or PIN, after unlocking your phone.
- crotchfire 3y ago
  A PIN is just a short numeric password. It's not a second factor.
  - sofixa 3y ago
    Anything is a second factor if it's the second way you're identifying yourself.
    - crotchfire 3y ago
      So I can use a password as my first factor and another password as my second factor?
  - ericpauley 3y ago
    The phone is the second factor. The pin just locks access to the (banking app on the ) phone.

by zx8080 3y ago

Tijdreiziger 3y ago

But usually the second factor is tied to a bank app that you have to register in some way, not to your SIM.

Aerbil313 3y ago

Phones are a very good solution for 2FA, considering the requirements to obtain a phone number. The only disadvantage afaict is that SMS communication is easily intercepted and not encrypted.

lotsofpulp 3y ago
I thought the requirements were being a near minimum wage employee at mobile network store (in the US) or a call center employee. Which is usually how SMS 2FA are stolen, and no one is liable for the consequences. Which means SMS 2FA is pretty low security. Convenient for most, but secure? Hardly.
- Aerbil313 3y ago
  Where I live all phone numbers are tied to national ID. When you are getting a new phone number you need to provide your ID card which has a chip and it is read by a device in order to tie the number to your ID for the phone number to be activated. I assume some cryptographic signing scheme is in action.

Dalewyn 3y ago

>But phone is not the best one. Phones are the best one. Why? Because (almost) everyone has one within reach. Security enthusiasts and believers constantly fail to understand why straight passwords and to a lesser extent phone 2FA never go away: All their proposed alternatives and solutions are inconvenient. Most people couldn't give a rotten rat's undead arse about security, but they will kill for convenience. Passwords and phone 2FA win and keep winning because they are convenient with good enough security.

vigilans 3y ago
The most uninformed takes always come with a healthy dose of arrogance and vulgarity. Every part of the industry that matters has been bitten by using phone numbers as a 2FA mechanism. It's why they're actually disappearing and are being phased out in favor of apps, OTP tokens, and email codes, depending on the amount of influence technical people wield at a given org.
- Dalewyn 3y ago
  >in favor of apps, OTP tokens, and email codes And all of them are some form of jank or inconvenience. Look, most people (myself included) don't give a fucking fuck about security. Our time lost to the kabuki theater of security is worth more than the so-called "security" we gain, and that's assuming whatever is being secured is even worth securing. A determined attacker will ignore all that and just undermine everything with social engineering against a useful customer support tech anyway. Unless your solution is as simple as entering a password and hitting a button, which is the digital equivalent to taking out a key and unlocking your front door, it is not going to see widespread acceptance. Make your fucking security solutions convenient, not secure. kthxbai. Even cars did away with keys because turning the ignition is an inconvenience compared to just pushing a button.
  - tialaramex 3y ago
    > Unless your solution is as simple as entering a password and hitting a button What password? I mentioned the NHS app I use in a different sub-thread, so let's try my (not very good, would not recommend but they offered decent credit balance interest) current account. I tap the app on my phone, I get a whirl of nonsense, and then: "Verify that it's you" and I touch the fingerprint sensor on my Pixel 6. And that's it. No passwords, no PINs, no SMS messages, no separate authenticator device This is much more secure than real human passwords (it'll be an elliptic curve signed message, so similar to HTTPS) and much more convenient, and short of convincing me to literally send you my phone and my finger you can't trick me into giving you access.
    - 3y ago

sofixa 3y ago

> Hopefully the whole esim and namely esim transfer initiative would end phone as second factor. > And yes, I know that options for 2FA are limited in general. But phone is not the best one. Phone doesn't just mean SMS. E.g. bank apps in the EU use MFA with the bank's app directly which you have to unlock with biometrics or PIN, after unlocking your phone.

crotchfire 3y ago
A PIN is just a short numeric password. It's not a second factor.
- sofixa 3y ago
  Anything is a second factor if it's the second way you're identifying yourself.
  - crotchfire 3y ago
    So I can use a password as my first factor and another password as my second factor?
- ericpauley 3y ago
  The phone is the second factor. The pin just locks access to the (banking app on the ) phone.