2 ms·

Just to summarize, I entered because the concern was about cleartext passwords being sent via SMS. This is almost never the case, typically it's a token. As a

by nkozyra 12y ago

Just to summarize, I entered because the concern was about cleartext passwords being sent via SMS. This is almost never the case, typically it's a token. As a mitigation tactic for full MTM, 2FA is basically without teeth. Same applies for the new item Google is trumpeting. I'm not saying someone couldn't do a MTM with both SMS and full network, I'm saying it's overkill and redundant. There's no advantage. If you're already funneling the data, you have what you want.

acqq 12y ago
> As a mitigation tactic for full MTM, 2FA is basically without teeth. What I believe is that a mechanism can definitely be made where without having the second authentication item of the 2FA the MTM on the internet channel would be automatically deactivated (or the user would recognize the existence of the MTM since it would reject the connection). Namely, the MTMI (internet) point from my scenario wouldn't be able to keep the connection to the server active since it doesn't have the key which is needed to even have the (encrypted) communication: the key given from the entity with the server to the user, but not using the internet, and therefore impossible to be used by the MTM interceptor. I believe such a mechanism can be made as soon as we assume the existence of such a key. That some simpler forms are currently still more popular doesn't mean we should dismiss the properly implemented mechanism as "without teeth." Maybe you'd say that such a mechanism isn't 2FA at all. How would you call it?