4 ms·
>>That's why I don't like 2FA with SMS. How can you trust a password that's send in clear through multiple carrier. Hmm, maybe websites should allow people to
by smtddr 12y ago
>>That's why I don't like 2FA with SMS. How can you trust a password that's send in clear through multiple carrier.
Hmm, maybe websites should allow people to select an "encryption" format for the SMS. Something not too complicated, like a ROT13'ish type of thing:
"We'll txt you the code, but every 3 char should be ignored... or every 4th number should be multipled by 3"
- josho 12y agoI suspect that anything that a user could be reasonably expected to perform wouldn't provide enough additional security to make the additional effort worthwhile.
- DasIch 12y agoThe general assumption in cryptography that the algorithm used for encryption is known. Even if you relax that restriction and assume you know which algorithms a user can choose but not which one she chose, you could still just try all of them, if they are "not too complicated".
- esrauch 12y agoIf 3 login attempts invalidate the OTP then you only need a manageable number of different "known modifications" to tell the user through the secure channel to keep this safe. If they can arbitrary brute force you OTP anyway then the OTP isn't really going to be all that useful at 10k possibilities. That said, hardly any user would be willing to take on such complexity without very strong reason.