NIST declares the age of SMS-based 2-factor authentication over

Re:NIST declares the age of SMS-based 2-factor authenticatio... by original_idea on Tuesday July 26, 2016 @01:45AM (#12163586)

Wouldn't PUSH notifications over the Google and Cloud networks resolve this? I know Google Prompt and Authy do this already because of SMS. Authy posted this a couple weeks ago: https://www.authy.com/blog/security-of-sms-for-2fa-what-are-...

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by bdcravens on Tuesday July 26, 2016 @02:54AM (#12163794)

Interestingly, when you sync a new device with Authy, one of the options to verify is SMS.

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by vel0city on Tuesday July 26, 2016 @12:16PM (#12166672)

IIRC, Authy uses this SMS challenge to authenticate users to allow you to download the database of secrets. This db is encrypted by a passphrase which never leaves the device. So, Authy is using SMS as one part of a multi-auth system to get to the final unencrypted data.

That said, anyone with a SIM card able to get messages for your phone number can download the encrypted database and attempt offline passphrase recovery. It might take a while to brute force, they seem to use a lot of hashing rounds as it takes a couple of seconds to verify the passphrase on a 2014 Moto X.

[ Parent | on HN ]