3 ms·

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SM

by Rygian 2y ago

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.

aftbit 2y ago
I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice. Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.
- pwg 2y ago
  > It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. It's not, but much like 'fax' hanging on in the medical environment because it has been labeled "secure" by the regulations, there is a line in some regulation rule somewhere that labels "SMS" as "secure" but does not label "email" as "secure", and because they do the minimum to meet the regulation, they go with "SMS" and go on about their day.
  - mjevans 2y ago
    Important distinction. 'Fax' is 'exempt' not secure. So of course many places will take the relief valve even though the service is both a poor fit / quality and horridly insecure. When it works right the records aren't even in a sealed envelope but just on the output of some printer somewhere for anyone to see!
- Rygian 2y ago
  Sending a one time code by email means that anyone with access to them inbox can both reset the password (first factor) and intercept one time codes ("second" factor). Using SMS creates an opportunity to dissociate those two situations.
- mewpmewp2 2y ago
  You can access e-mail from outside of your phone, but SMS usually not unless synced with cloud. If your e-mail gets hacked then all of yoir 2FA everywhere with e-mail would be useless.

by Rygian 2y ago

Or they were using 2FA by email until an auditor told them "that's not 2FA" at which point they realized that their middleware to send notifications supports SMS as well as email.

aftbit 2y ago

I don't quite understand that. It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. Additionally, many seem to want a "real phone number", not a VoIP number like Google Voice. Meanwhile treasurydirect.gov still just uses a verification code via email. If it's good enough for the Treasury, it's probably good enough for a bank.

pwg 2y ago
> It's not like sending an SMS to my phone is any more secure or harder to access than sending an email to my phone. It's not, but much like 'fax' hanging on in the medical environment because it has been labeled "secure" by the regulations, there is a line in some regulation rule somewhere that labels "SMS" as "secure" but does not label "email" as "secure", and because they do the minimum to meet the regulation, they go with "SMS" and go on about their day.
- mjevans 2y ago
  Important distinction. 'Fax' is 'exempt' not secure. So of course many places will take the relief valve even though the service is both a poor fit / quality and horridly insecure. When it works right the records aren't even in a sealed envelope but just on the output of some printer somewhere for anyone to see!
Rygian 2y ago
Sending a one time code by email means that anyone with access to them inbox can both reset the password (first factor) and intercept one time codes ("second" factor). Using SMS creates an opportunity to dissociate those two situations.
mewpmewp2 2y ago
You can access e-mail from outside of your phone, but SMS usually not unless synced with cloud. If your e-mail gets hacked then all of yoir 2FA everywhere with e-mail would be useless.