4 ms·
Digits sounds like a good idea in theory, but relying on SMS for password security is like relying SMS for anything. Even if SMS were secure on its own (meaning
by iLoch 12y ago
Digits sounds like a good idea in theory, but relying on SMS for password security is like relying SMS for anything. Even if SMS were secure on its own (meaning traffic was encrypted - which it isn't anyway) you still have the problem of people gaining access through a person's cellular provider account. AT&T for example, will allow you to send and receive SMS from your account on their website - an account which is accessible after "verifying" that you own the account by entering your mother's maiden name or dog's birthday (more or less). Point being, this is no more secure than sending my password in plain text to my email.
- Oompa 12y agoMy favorite feature of SMS authentication is when I get locked out of accounts because I'm traveling and using a different SIM.
- Goopplesoft 12y agohttps://www.gauthify.com/ https://www.gauthify.com/ - phone, email, sms, and ga?
- InAnEmergency 12y agoYou are assuming that the SMS is like a password and the phone number is like a user name, and that's all an attacker would need to log into the app. However, it doesn't have to be designed that way. There could be another value tying the phone number and SMS to the specific app login attempt, in which case intercepting just the SMS is not sufficient.
- InAnEmergency 12y agoHave to amend my statement...if the attacker can intercept the SMS in real time, then it is an effective attack: 1. Attacker knows victim's phone number and attempts login 2. Attacker intercepts SMS as it is sent to victim 3. Attacker completes their login process with the SMS code