News for hackers. Stuff that matters.

A comment on YubiKey 4C. Parent comment

Re:YubiKey 4C by merijnv on Monday February 13, 2017 @11:01AM (#13636220)
Isn't disabled SMS overkill for most casual thread models? As I understand it SMS would require someone to MITM the telecom network OR snoop the local antenna when you receive it on your phone. Which is a danger if you expect, like, nation-state adversaries.

But if I'm, say, protecting my GitHub account against Russian mafia hackers, that still seems perfectly fine?

[ Parent | on HN ]
Re:YubiKey 4C by pfg on Monday February 13, 2017 @11:12AM (#13636325)
The bigger problem for SMS-based 2FA are social engineering attacks on the support personnel of mobile network operators. They typically don't have fancy authentication schemes - it's fairly easy to get them to redirect messages to a different SIM or something like that.
[ Parent | on HN ]
Re:YubiKey 4C by problems on Monday February 13, 2017 @11:09AM (#13636293)
I can't speak to current day, but in the past it's been very easy to social engineer telecoms. So especially for high value accounts this shouldn't be used.
[ Parent | on HN ]
Re:YubiKey 4C by tptacek on Monday February 13, 2017 @11:10AM (#13636299)
No, defeating SMS security is not a state-level-adversary task.
[ Parent | on HN ]