3 ms·
Third comment on this post, but anyway. Why are 2FA providers still using SMS and not USSD (http://en.wikipedia.org/wiki/Unstructured_Supplementary_Service_Data
by kolev 12y ago
Third comment on this post, but anyway. Why are 2FA providers still using SMS and not USSD (http://en.wikipedia.org/wiki/Unstructured_Supplementary_Service_Data http://en.wikipedia.org/wiki/Unstructured_Supplementary_Serv...)?
- lxgr 12y agoWhat would be the advantage of using USSD?
- matthiasl 12y agoI'm not Kolev, so I don't know his reasoning. But I can guess. USSD is interactive. That lets you keep the one-time password's validity time short since you know when the subscriber sees the one-time password. The other is that it's straightforward to require an interactive step, e.g. "press 7 to get a code". The interactive step makes an attack based on SMS forwarding harder. The short timeout makes an attack based on having limited access to a victim's phone harder. Not sure if the security improvements are worth the useability problems---people aren't familiar with USSD and, because it's not used as often, mobile terminal software for it is likely to be buggier.
- kolev 12y agoYes, that, plus, supposedly, apps like Facebook Messenger and Google Hangouts won't see those messages.
- the_mitsuhiko 12y agoFor a start, because USSD is provider specific and unless you are the provider you need to initiate it with a special USSD code from the phone which you need to register in every network you want to operate in.
- kolev 12y agoNexmo offers it (although it's in Beta like pretty much every meaningful service): https://www.nexmo.com/tour/USSD.html https://www.nexmo.com/tour/USSD.html