121–130 of 379 posts
DontPort.Com - I built this to fix this. I've been a victim of this 4 times and was too much frustrated. Unfortunately Sim swap is only one way to get your 2FA but the risks are much higher which I am working to solve one by one
Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.
A further cost is that they usually require the user to install and set up an app, contrary to SMS.
DontPort.Com - I built this to fix this. I've been a victim of this 4 times and was too much frustrated. Unfortunately Sim swap is only one way to get your 2FA but the risks are much higher which I am working to solve one by one
How do you protect against an insider attack?
Earlier quoted context omitted.
I wish Apple added iMessage as a service to make 2FA more secure.
Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.
If you change your SIM card you'll have to reset your 2FA setup on the banks site. It's done on the carrier side.
I still hate it tho, as you are locked to a phone number and it sucks when you move countries a lot.
Earlier quoted context omitted.
Have you seen the prompt system, as used by Google, Micosoft, Okta, et al.? In my strictly personal opinion, responding to a notification that asks if a login attempt is you is clear enough that people need minimal training to make use of it. This might just be me, though. In my career, I've definitely seen people actively choose SMS over other factors on offer. It was easier for them, and in many cases shouldn't hav…
They (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access. In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets de…
Earlier quoted context omitted.
I wish Apple added iMessage as a service to make 2FA more secure.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
Just wondering if there could be an easier non installed version that was always available.
Apologies if it's a really silly question!
Earlier quoted context omitted.
What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.
A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
Earlier quoted context omitted.
Have you seen the prompt system, as used by Google, Micosoft, Okta, et al.? In my strictly personal opinion, responding to a notification that asks if a login attempt is you is clear enough that people need minimal training to make use of it. This might just be me, though. In my career, I've definitely seen people actively choose SMS over other factors on offer. It was easier for them, and in many cases shouldn't hav…
They (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access. In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets de…
Earlier quoted context omitted.
I wish Apple added iMessage as a service to make 2FA more secure.
I could see Apple offering 2FA as a core feature, at least on iOS. In fact, Apple should redesign Keychain into a user friendly, 1Password-lite product with 2FA built-in (1Password offers this too) or as a separate app that works with Keychain.