141–150 of 379 posts
The only good solution at this point is to legislate cell carriers to make SMS more secure. Everyone perceives it as secure, everything uses it for auth, and it aught to be secure for its own sake.
(FWIW, SMS is also insecure in that it's fairly easy to passively snoop on SMS comms, but that's a separate problem.)
Earlier quoted context omitted.
A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient
I know a few people who have been hacked with this method via t-mobile in order to control chat rooms on telegram and steal crypto. According to this paper, t-mobile has the smallest surface area, which is sad.
Why sad? someone has to have the smallest Would it be less sad if it was Verizon?
Earlier quoted context omitted.
I wish Apple added iMessage as a service to make 2FA more secure.
Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.
Earlier quoted context omitted.
I wish Apple added iMessage as a service to make 2FA more secure.
Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.
Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
My brain isn't working right now... Can you tell me why something like google authenticator could not be executed as a website? Does it have to be an app? Just wondering if there could be an easier non installed version that was always available. Apologies if it's a really silly question!
But how do you protect access to the website - with a username and password? Or do people now need to remember another code like "JBSWY3DPEHPK3PXP" to set up the authenticator everytime they visit?
Mobile apps were one way to solve this although the hardware U2F tokens like Yubikey provide another authentication factor in a usable way (and more secure than TOTP because you can't be phished to enter them on the wrong site).
Earlier quoted context omitted.
A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient
Earlier quoted context omitted.
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
My brain isn't working right now... Can you tell me why something like google authenticator could not be executed as a website? Does it have to be an app? Just wondering if there could be an easier non installed version that was always available. Apologies if it's a really silly question!
The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did not back up their TOTP. With SMS authentication, even if the user loses a phone, they can go down to the local cell phone store and get a new phone on their number and be back in business without the website having to get involved.
> What happens if the user loses a yubikey. Always buy two. ;-) Joking aside, I've moved almost every 2FA to hard token, soft-token, or google voice. But the root of trust is still LastPass & Google. I don't see an easy way out of dependency other than power of attorney. Even worse: I worry what happens to my protected assets as I age and possibly face memory loss.