News for hackers. Stuff that matters.

A comment on Hackers account for 90% of login attempts at online retailers. Parent comment

Re:Hackers account for 90% of login attempts at online retai... by jandrese on Wednesday July 18, 2018 @01:20PM (#17560243)
SMS is terribly insecure. Using it as a security system is a bad idea.

SMS verification is more for discouraging bots from making accounts by making it expensive--you need to buy a cell phone. Every SMS verification system refuses to send to VoIP type accounts for this reason.

[ Parent | on HN ]
Re:Hackers account for 90% of login attempts at online retai... by jsoverson on Wednesday July 18, 2018 @01:29PM (#17560313)
Couple this with the fact that mobile services are also subject to credential stuffing attacks constantly and, for the services that allow you to read SMS messages online, the attackers who take over your mobile account also gain a critical piece of your 2FA protection.
[ Parent | on HN ]
Re:Hackers account for 90% of login attempts at online retai... by davchana on Wednesday July 18, 2018 @03:44PM (#17561502)
Exactly that's why I have disabled my Google email recovery via phone number. Only possibilities are Auth via an existing signed-in device, Google Auth, or backup codes.
[ Parent | on HN ]