3 ms·
Did the carriers agree to take on this role of securing SMS messages for authentication? If I were a carrier, I would be actively fighting this nonsense.
by ensignavenger 2y ago
Did the carriers agree to take on this role of securing SMS messages for authentication? If I were a carrier, I would be actively fighting this nonsense.
- AStonesThrow 2y agoHow secure do they need to be? It's a single ephemeral factor. Every cell tower a numbers station. Sometimes I relay my OTP code to my friends in FB chat if I think the number has cool properties. I don't tell them anything else about the sign-in, so my self-breach has a rather limited risk factor. Didn't that LifeLock guy advertise his SSN everywhere? I'd say reliability counts for more in these cases, and SMS was designed for unreliability, like UDP. So I'd be more concerned about the relationships and gateways from MFA services to send out their codes, and ensure that they can be received in a timely fashion. This message will self-destruct in ten minutes.
- miki123211 2y agoThe carriers basically have to do this anyway, one way or another, because people want to get their phone number back when something bad happens to their phone. This would be true even without SMS authentication. A part of it is mandated by regulation, most countries require carriers to let their customers port their phone numbers out. When handling those port out requests, they don't necessarily have enough data to decide whether the request is legitimate or not, yet refusing such requests too often would draw the ire of regulators, which is something no carrier wants.