4 ms·
SMS security tokens have significant weaknesses; yes. The reason for multi-factor authentication is to compensate for the weaknesses of any single factor. This
by ademarre 12y ago
SMS security tokens have significant weaknesses; yes. The reason for multi-factor authentication is to compensate for the weaknesses of any single factor. This works reasonably well as long as the factors aren't so weak as to be trivially surmounted.
If there existed a single authentication factor that was at once practical and perfectly secure, then there would be no need for multi-factor auth.
- akerl_ 12y agoThe point of the article is that SMS as a security factor is weak enough as to be trivially surmounted.
- ademarre 12y agoWeak, yes. But trivial? The article does not convince me of that. > In this context, the telephone network itself may no longer be the weakest link in the chain. The diligent attacker only needs to look for the cloud operator with an unplugged security hole and use their system as a stepping stone to read any SMS they want, when they want. This is the most practical attack described in the article. Attack vectors like this will occasionally open up, but I would not call it trivial.
- Klinky 12y agoI agree. That quote basically describes any technical attack on a service. You could write any article stating XYZ tech is insecure if you're sounding the alarm based on "future unknown vulnerabilities".