NIST declares the age of SMS-based 2-factor authentication over

Re:NIST declares the age of SMS-based 2-factor authenticatio... by nickpsecurity on Tuesday July 26, 2016 @01:56PM (#12167496)

Excellent points. I'll add that physical safes and human-level protections have been standard in INFOSEC since Schell et al invented it as a formal field. All the early SCM for high-assurance systems was basically safes, locked rooms, and vetted people. Black programs (SAP's), like NIPSOM manual, also depend on such methods at some point.

Cool thing is that there's less laws of physics trying to break your security model if you take transistors, wires, and wireless comms out of your implementation. Paper without a line of sight has excellent security properties against remote attackers. :)

Note: Your point on the legal angle is wise and rarely made. I probably need to bring it up more often myself with these ridiculous rulings on privacy & data protection.

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by Spooky23 on Wednesday July 27, 2016 @11:44AM (#12173745)

For awhile I ran a really large email system for an enterprise with lots of different lines of business -- right after the change in Federal rules of civil procedure that made email the best place to hunt for evidence in litigation. At the same time, we were working with archivists on some of the issues around preserving documents -- the ODF vs Microsoft format thing was a hot item at the time.

That really opened my eyes to the often ignored downsides of electronic media. In the US, we have constitutional protections around our "papers" in our homes, but third party doctrine dramatically weakens the protections around all sorts of things.

[ Parent | on HN ]