3 ms·
I almost^ missed a train recently because I tried to book my ticket and for the first time ever (and actually not since either) Amex wanted to send me a verific
by OJFord 3y ago
I almost^ missed a train recently because I tried to book my ticket and for the first time ever (and actually not since either) Amex wanted to send me a verification code. They support only SMS & email, but you can't change it for the current one and it was set to SMS, and I don't have email on my phone anyway & was at the station. Anyway - SMS didn't arrive. Had the same thing recently with them from a bank, it's the network blocking them, suspected spam or whatever.
There's plenty of other reasons not to use SMS 2FA, but it might suddenly not work one day right when you need it, and totally out of your control, is perhaps the most universally compelling?
- qingcharles 3y agoHad this crap happen to me the other day with a banking app. Luckily I eventually managed to find a way to get them to call my phone with the code instead. There are so many problems with SMS.
- lxgr 3y agoFortunately, SMS-OTP isn't considered SCA/PSD2 compliant anymore (by itself, since it's only a single factor – and the card number doesn't count) by the regulator in the EU (not sure about the UK), so hopefully we'll be seeing less of that going forward.
- yoavm 3y agoI'm totally not advocating for 2FA over SMS. It's also just not secure enough. What if the website presented a QR you can scan with Aegis and then Aegis would make a request with your one time code? You could still type it manually - there would be an input and a QR code next to it.
- sliken 3y agoKinda surprised banks aren't more current with security, after all even NIST recognizes the problem with 2FA over SMS: https://www.nist.gov/blogs/cybersecurity-insights/questionsand-buzz-surrounding-draft-nist-special-publication-800-63-3 https://www.nist.gov/blogs/cybersecurity-insights/questionsa...