4 ms·
> Because SMS is not even remotely a secure communication channel Neither is 2FA, it's a key stored completely unencrypted in both your phone and the the host'
by BrainInAJar 12y ago
> Because SMS is not even remotely a secure communication channel
Neither is 2FA, it's a key stored completely unencrypted in both your phone and the the host's db.
- dragonwriter 12y agoThat's not particularly weak as proof to the person who controls the DB that you have access to the phone, which is what the device factor of a 2FA scheme is intended to prove, since you have to have access to either the DB or the phone to get the key. Conversely, SMS's weakness is in the communication channel, which can be compromised without compromising the things for which the factor is intended as proof.
- BrainInAJar 12y agoPhones get hacked too. If you ever access a site with your phone, it's not two factor auth. Malware can read your 2FA key and read your password as you type it in.
- mirashii 12y agoAnd thus why we have Yubikeys and other hardware tokens.