31–40 of 323 posts
If the choice between no 2FA and SMS, which is better?
[1] https://news.sophos.com/en-us/2018/10/01/facebook-turn-off-s...
Hardly an SMS issue, an issue with a vendor not properly securing a sensitive datastore.
It is an SMS issue in the sense that OTPs and hardware tokens don't require their rotating secrets to be written to some potentially publically-readable datastore. This specific attack vector simply does not exist for those technologies.
Earlier quoted context omitted.
You need it. While your bank already gives you (typically) a card you can also use as is for auth for them. Your country probably have some e-documents already, no need for extras to authenticate the public sector services and so on. The point is offering something already usable and gives people a habit on that. After we might add yubi for generic services like GMail and so on.
I have zero clue as to what you're talking about. And what card am I getting from my bank?
Similarly various countries offers eIDs (some I know Estonia, Belgium, Italy, Germany, France) witch are NFC ISO 14443A/B who are used to authenticate the Citizen on various public services.
Many universities and some high school as well offer an NFC badge witch is a smart card, and could be used to authenticate institution website and so on.
All those examples are already in use since years, but used for limited activities and mostly not advertised. It's just a matter of spread them. In Italy for instance since some years national eID card (CIE) is used to access fiscal services to send for instance you filled tax forms, to pay some tax and so on, while national health service card is used to buy tobacco from every automatic vending machines since much more (to prove you are >18 years old), France start since last year the same with France Connect+ witch as Italy, German etc is the pan European eIDAS system to offer digital docs and services to all. All countries have invented absurd systems to AVOID using eIDAS with smart cards in most cases, while we all have them. Only to push the "app" cloud+mobile model.
Earlier quoted context omitted.
But it's also the most cost expensive (from provider side) among 1FA and 2FA-OTP
I think conversion rate and support cost associated with 2FA-OTP are worse enough for SMS to still be worth it, especially as a phone number also gives you a good marketing ability and a reasonably unique identifier for a user. If not, everybody would be using OTP already.
The biggest problem with SMS-2FA in my opinion is a lot of places are setup so it isn't even a second factor. I can often reset my password just through email so it just seems like throwing a threadbare blanket marked security over the top of a user tracking scam.
If the choice between no 2FA and SMS, which is better?
As the linked post says itself, "2FA-SMS is Better Than Nothing"
Use 2FA. Use 2FA. Use 2FA. Worry about the design decisions in your spare time.
I mean, even if we disregard the auth codes thing, which according to CCC were being generated on a static timer, if someone did get access to this bucket - they would have gotten away with a juicy list of phone numbers and names from some of the top companies, at the very least.
I'm not sure how hard it would be for an S3 scanner to guess "idmdatastore", so it is difficult to say if anyone else got in. Even if not, a live database storing live data without encryption or anything is crazy. I feel like IdentifyMobile will feel the wrath of this no matter what.
[0]: https://stackdiary.com/twilio-issues-an-alert-about-a-securi...
And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!
Earlier quoted context omitted.
How many have a smartphone with a cover able to hold cards? How many have wallet in their pockets? Where the trade off in usability? Having a sole pin and a card to access various services instead of passwords and copypasting OTP or something similar with crappy and dysfunctional apps.
> How many have a smartphone with a cover able to hold cards? I use a wallet that holds cards, but not common or popular, and are you seriously suggesting that we insert this thing into our phones, which would probably mean you'd have to dislodge from the case, wallet or not, and align the card into the slot. Not to mention how much space it'd consume in a smart phone. You & maybe a very tiny cohort want this, the ge…
I use it normally to declare my taxes for instance, with a small desktop card reader (ReinerSCT CyberJack) as a "security device" in Firefox to authenticate for instance, just putting the card on the reader, open firefox going to the relevant website, click on eIDAS login, entering the national ID card PIN and being in. A pin for all public sector services, no apps needed, no regular password changes and so on.