4 ms·

The focus in the article seems to be on best practices for banks, businesses, etc, as opposed to consumers, but there are specific tips for owners of Apple and

The focus in the article seems to be on best practices for banks, businesses, etc, as opposed to consumers, but there are specific tips for owners of Apple and Android phones. "Do not use SMS as a second factor for authentication." Why? The reason given is that SMS doesn't have end-to-end encryption. Gmail has had end-to-end encryption since December 2022, so I'm thinking that if I'm given a choice between having a verification code texted to me or emailed to me, I should choose the email option.

TYPE_FASTER 2y ago
It also states that SMS is not "phishing-resistant." I've received SMS messages that were phishing attempts at stealing my authentication credentials. It's also possible to re-route SMS messages via SIM swapping, SIM hijacking, or other methods (https://www.schneier.com/blog/archives/2021/03/easy-sms-hijacking.html https://www.schneier.com/blog/archives/2021/03/easy-sms-hija...). SMS is just not designed to be used as an authentication mechanism. We have more secure mechanisms now.
amyames 2y ago
a private party can deploy a stingray in an urban area and steal your text messages as readily as the sheriff’s department can. nobody cares about mine, but this could be deployed near a residence where someone’s password or website is breached unbeknownst to them yet. that could be a situation where they got a sysadmin or CEO or public figure and think they can get even more passwords leaks or breaches out of the target. my email would be a snooze fest as I don’t have a personal account and don’t mix personal with business. but I do have credentials to lots of other peoples stuff. which, sometimes due to their own decisions, could be reset from my email I guess. I don’t use SMS for any of it because I have a non USA phone number which nobody supports anyway.

4 ms·

The focus in the article seems to be on best practices for banks, businesses, etc, as opposed to consumers, but there are specific tips for owners of Apple and

by pmdulaney 2y ago

TYPE_FASTER 2y ago
It also states that SMS is not "phishing-resistant." I've received SMS messages that were phishing attempts at stealing my authentication credentials. It's also possible to re-route SMS messages via SIM swapping, SIM hijacking, or other methods (https://www.schneier.com/blog/archives/2021/03/easy-sms-hijacking.html https://www.schneier.com/blog/archives/2021/03/easy-sms-hija...). SMS is just not designed to be used as an authentication mechanism. We have more secure mechanisms now.
amyames 2y ago
a private party can deploy a stingray in an urban area and steal your text messages as readily as the sheriff’s department can. nobody cares about mine, but this could be deployed near a residence where someone’s password or website is breached unbeknownst to them yet. that could be a situation where they got a sysadmin or CEO or public figure and think they can get even more passwords leaks or breaches out of the target. my email would be a snooze fest as I don’t have a personal account and don’t mix personal with business. but I do have credentials to lots of other peoples stuff. which, sometimes due to their own decisions, could be reset from my email I guess. I don’t use SMS for any of it because I have a non USA phone number which nobody supports anyway.