News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by Spivak on Tuesday July 26, 2016 @01:15AM (#12163483)
> They should be calling for secure, validated SMS.

Does such a think really exist?

More to the point wouldn't adding an (optional) standard push notification API to TOTP clients be a better solution. You login, your phone pops up a notification, you hit accept on the notification, done. Way less annoying than even SMS.

[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by voltagex_ on Tuesday July 26, 2016 @01:29AM (#12163530)
The Microsoft Account app does this when an MS app sends an additional challenge. I'm not entirely sure how secure it is but it sure beats looking at a code on GA or Authy.
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by askvictor on Tuesday July 26, 2016 @08:11AM (#12165005)
2fa via the Google app (not authenticator) does something like this. Login on computer, prompt appears on phone, tap yes to log in.
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by icebraining on Tuesday July 26, 2016 @04:09AM (#12164046)
More to the point wouldn't adding an (optional) standard push notification API to TOTP clients be a better solution. You login, your phone pops up a notification, you hit accept on the notification, done. Way less annoying than even SMS.

How would that work when you're trying to login on your desk/laptop?

[ Parent | on HN ]