NIST declares the age of SMS-based 2-factor authentication over

Re:NIST declares the age of SMS-based 2-factor authenticatio... by coldtea on Tuesday July 26, 2016 @07:56AM (#12164940)

>in some countries, that legally requires a passport/national ID tied to the phone number

Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account?

>-Offers no means of backup*

That has nothing to do with SMS for 2FA. There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone.

- Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @08:48AM (#12165209)

> Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account?

Huh? Are we talking about the same thing?

> There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone.

A backup is not the same thing as a master key (even if we call those "backup codes"). I'll grant you that those are usually enough.

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by coldtea on Tuesday July 26, 2016 @01:18PM (#12167193)

>Huh? Are we talking about the same thing?

What I'm saying is that a potential attacker that might divert PINs to their mobile phone, would at least have to be registered to get that phone account in the first place.

[ Parent | on HN ]