News for hackers. Stuff that matters.

A comment on Show HN: Evilpass – A slightly evil password strength checker. Parent comment

Re:Show HN: Evilpass – A slightly evil password strength che... by fpgaminer on Saturday February 18, 2017 @12:51PM (#13675753)
Text messages are incredibly insecure because of how easy it is for someone to take over your phone number.
[ Parent | on HN ]
Re:Show HN: Evilpass – A slightly evil password strength che... by dTal on Saturday February 18, 2017 @07:32PM (#13677506)
Yet another reason to use SMS encryption (which seems oddly rare) like SilenceIM (formerly SMSSecure, formerly the dropped SMS code in TextSecure [now Signal]).
[ Parent | on HN ]
Re:Show HN: Evilpass – A slightly evil password strength che... by dpweb on Saturday February 18, 2017 @12:55PM (#13675777)
So Google and Microsoft use 2FA cause texts are more insecure? If I lose control of my phone they're into all my websites anyway.
[ Parent | on HN ]
Re:Show HN: Evilpass – A slightly evil password strength che... by simple10 on Saturday February 18, 2017 @01:07PM (#13675840)
Yes, texts are insecure for 2FA. It's better to use Google Authenticator or similar.

https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...

[ Parent | on HN ]
Re:Show HN: Evilpass – A slightly evil password strength che... by pdpi on Saturday February 18, 2017 @01:07PM (#13675841)
Not losing control of your phone. Losing control of your phone _number_.

There's plenty of stories around of spear phishing attacks involving attackers taking over the victim's phone number. Mobile operators are notoriously vulnerable to that sort of shenanigans.

[ Parent | on HN ]
Re:Show HN: Evilpass – A slightly evil password strength che... by kkl on Saturday February 18, 2017 @01:08PM (#13675843)
Losing control of your actual phone is not the same as losing control of your phone number.

I'm not sure about Microsoft, but Google supports several other 2FA mechanisms in addition to SMS.

[ Parent | on HN ]