91–100 of 312 posts
Isn't texting usually used in 2-factor-authentification? What was the other factor? I thought the whole idea behind 2-factor-auth is that two somewhat secure authentification methods combined make a stronger one.
Unfortunately it is also used far too often as 1-factor authentication for password resets, making 2-factor authentication essentially pointless.
Earlier quoted context omitted.
How does adding a second factor of authentication to an already good password make it less secure?
because they let you use the phone number to reset the password
Earlier quoted context omitted.
Make it a lock like domains. https://www.icann.org/resources/pages/locked-2013-05-03-en
This seems like the best solution. Introduce an opt-in security feature, whereby any attempt to port the number, or swap sims, is subject to a ~72h cooldown period. During that period, notify the account holder through numerous communication channels of the pending change. Email, SMS, automated phone call.
If we want to authenticate a user, what is the best way to do it? best: a great balance between convenience, security and cost. Lately, it bothers that we cannot be sure that we are interacting with real people or the people that we are interacting with are not the same people with different accounts.
If I "authenticate" a $1 postcard of the Mona Lisa, does that mean it's the real Mona Lisa? A real postcard? Really worth a dollar? Really a physical object that exists?
Earlier quoted context omitted.
In Poland it is also used, I heard stories (e.g. https://niebezpiecznik.pl/tag/sim-swap-fraud/ polish website) about sim card swapping and stealing funds from bank accounts. After reading those I switched authentication from a sms text to my bank app.
Unfortunately, the current corporate thinking in Poland is that 2-factor authentication means SMS. I see banks and other companies introduce this in spite of known vulnerabilities. SMS is NOT a secure second factor!
While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed. The government agencies that setup the mobile number portability system need to realise the seriousness of this flaw and allow a “Never transfer my Number” flag to be set in their databases. Until then even the lowest rung service desk agent at any telco has the ability to transfer numbers. A system l…
If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better than no 2FA [1].
[1]:https://security.googleblog.com/2019/08/understanding-why-ph...