SMS 2FA is not just insecure, it's also hostile to mountain people

Post by wkat4242 » Thu, May 15, 2025, 1:27 AM UTC

watermelon0 wrote: post #206

fasteo wrote: post #190

Earlier quoted context omitted.

>>> I really wish that were illegal. A phone number is a phone number. European speaking. For completeness: Financial directive PSD2[1] allows to use an SMS as a 2FA only because there is an KYC already done for that number (anon SIM are no longer allowed in the EU) Also note that the 2FA is not the OTP code you receive. This code is just a proxy for probing "something you have", with the "something" being the phone…

Anon SIM cards are still allowed in some EU countries: https://prepaid-data-sim-card.fandom.com/wiki/Registration_P...

Post by kazinator » Thu, May 15, 2025, 1:33 AM UTC

Post by insane_dreamer » Thu, May 15, 2025, 1:40 AM UTC

zinekeller wrote: post #127

lxgr wrote: post #23

> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…

> Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised. I can probably illuminate some things here. This is almost certainly the SMS API they're using. Your phone, and your network by extension, does not care if the phone is technically online - so those messages get received because they're…

Post by protocolture » Thu, May 15, 2025, 1:51 AM UTC

stackskipton wrote: post #210

Something somewhere is always hostile to particular group. That's just facts of life. You do your best to minimize but can never eliminate it. As someone who has dealt with 2FA support, all the methods suck. SMS 2FA is least secure but has broadest support with quickest recovery method. TOTP Applications (Google Auth, Authy, iOS Passwords) is more secure but people switch phones, lose phones and so forth and recovery…

Post by olalonde » Thu, May 15, 2025, 2:42 AM UTC

TonyTrapp wrote: post #255

olalonde wrote: post #246

Earlier quoted context omitted.

1) It's possible they do not have an Internet connection. In fact, it doesn't seem necessary. 2) Bluetooth can ensure that you are in proximity of the locker, otherwise you could accidentally unlock a locker while standing at the wrong rack.

They always had internet access. Of course it is possible that they decided to rip out the internet connection in the new models together with the touch screen, but I heavily doubt that they want to trust the internet connection of a random stranger to do whatever important communication they have to do with their servers. The app only requires internet access because... well, it always needs internet access.