4 ms·
It's actually unbelievable how often SMS OTP is used, when it's public knowledge that it just replaces one attack vector with a worse attack vector... Cracking
by eBombzor 2y ago
It's actually unbelievable how often SMS OTP is used, when it's public knowledge that it just replaces one attack vector with a worse attack vector... Cracking a password or breaking into an encrypted database is 10x harder than getting a sim swap.
- loloquwowndueo 2y agoCracking a good password - which a large percentage of people don’t have or will readily input in any phishing web form without a second thought. Time-constrained 2FA codes can be broken with sim swaps or targeted phishing which are less widespread than a wide-net spam-based phishing campaign. Now don’t get me wrong I hate SMS 2FA with a passion but still :)
- zamalek 2y agoMy bank recently added the feature of removing SMS as an 2FA option - requiring TOTP. Now if they'd only add webauthn, but TOTP is pretty secure against phishing with a browser-integrated password manager (no autofill results in suspicion).
- s1dev 2y agoWhat bank is this and are they available nationwide?
- zamalek 2y agoFirst Tech CU. Their physical locations are PNW only, but that hasn't stopped me from continuing to use them electronically on the east coast. They are also part of the CU alliance, so access to alliance branches and ATMs is possible (I've never had the need to test this).
- Hnrobert42 2y agoYes. Why are banks with TOTP so rare?!
- unethical_ban 2y agoI have no idea, and I despise it. USAA and eTrade both have TOTP, exclusively with the shitty, non-backup-able Symantec VIP app. Break your phone? You're boned! Symantec VIP on those sites don't provide 2FA verification (the thing where the phone asks to confirm the number on the client-side) and it doesn't provide push notifications. It's literally a worse version of regular TOTP. And they're in the minority even having 2FA!
- umbra07 2y agohere you go! https://gist.github.com/jarbro/ca7c9d3eebba1396d53b4a7228575948 https://gist.github.com/jarbro/ca7c9d3eebba1396d53b4a7228575...
- Aaronn 2y agoThis works for Charles Schwab too!
- umbra07 2y agoand fidelity!
- tekknik 2y agoWhat could possibly go wrong using an open source project for authentication against your bank accounts? Where have we seen this before? You best audit the shit out of that code if you actually use it. Every. time. they. update.
- eco 2y agoMy bank finally added 2FA today actually. It is, of course, SMS or Email only because banks the worst online security for reasons I'll never understand.
- gruez 2y agoIt's not really "replacing" though. Prior to SMS OTP it would just be the password. Having password + SMS OTP is strictly better, regardless of how shitty SMS OTP might be.
- guffins 2y agoMany sites do allow logging in with just an SMS OTP, no password required (even if you’ve set a password for the account). If it absolutely must be used (it shouldn’t), then SMS OTP should be a second factor, not the only factor.
- lr1970 2y ago> Having password + SMS OTP is strictly better, regardless of how shitty SMS OTP might be. Unfortunately one can claim to "forgot my password" and use SMS OTP to reset it. Now it becomes a single factor authentication with a compromised phone. Password + SMS OTP is strictly worse than a password. At least you cannot SIM swap your password.
- lxgr 2y agoBut once you manage it, you've got a lot of compromised accounts at the same time. Everything based on username + password alone today should be replaced by passkeys. The problems they don't solve are 2FA and account recovery.
- kredd 2y agoIt’s easy, it’s free for the customer, and with feature’s like iPhone’s “code autofill”, it’s the easiest UX. Swim swapping happens to such a small number of people that it’s not worth the effort for anyone involved. I hate it myself, but such is the reality.