News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @08:48AM (#12165209)
> Isn't that BETTER compared to anybody getting a phone number and using it to hack into your 2FA account?

Huh? Are we talking about the same thing?

> There are websites using SMS for 2FA that DO offer a backup way to authenticate in case you have an issue with your phone.

A backup is not the same thing as a master key (even if we call those "backup codes"). I'll grant you that those are usually enough.

[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by coldtea on Tuesday July 26, 2016 @01:18PM (#12167193)
>Huh? Are we talking about the same thing?

What I'm saying is that a potential attacker that might divert PINs to their mobile phone, would at least have to be registered to get that phone account in the first place.

[ Parent | on HN ]