4 ms·
He gives an example of what can happen with voice-based authentication but not SMS. What can an attacker do, collect the text as it passes between the cell towe
by extra88 13y ago
He gives an example of what can happen with voice-based authentication but not SMS. What can an attacker do, collect the text as it passes between the cell tower and your phone then use it before you get the chance to?
Or is it the scenario where they've stolen your password and your phone? If it's a smartphone, they'd have to be able to unlock it and once they've done that, SMS doesn't seem any worse than Google Authenticator.
- benmanns 13y agoIf you could social engineer an employee to change a voicemail number, you may be able to convince them to port a number to a new account.
- _djo_ 13y agoThere have been bank account hacks where the perpetrator has had an accomplice inside a cellular service provider who intercepted the SMS and prevented it from being sent to the account-holder's phone while retrieving the code.
- cheald 13y agoNumber porting attacks have been used to compromise SMS-based auth in the past. http://www.itnews.com.au/News/282221,phone-porting-used-to-unlock-net-banking-codes.aspx http://www.itnews.com.au/News/282221,phone-porting-used-to-u...