News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by ptoomey3 on Tuesday July 26, 2016 @12:59AM (#12163428)
Agreed. The choice isn't between SMS and TOTP for most users. The choice is between SMS and just a 6 character reused password (maybe an old pet name with an exclamation point on the end for extra security ;-)).
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by lloeki on Tuesday July 26, 2016 @02:07AM (#12163646)
> maybe an old pet name with an exclamation point on the end for extra security

Nope, this is the answer to the recovery question ;-) which amounts to a password anyway. I wish recovery questions would just die finally.

A pattern I've seen often is people not remembering their password and just resetting it via SMS each time, making SMS 1FA. Although very real, taking the real-world risk of SIM cloning is pragmatically still better than reused, ridiculous passwords and/or ones that end up in leaked lists which amount to no auth.

[ Parent | on HN ]