Multi-factor authentication isn't necessarily strong

Re:Multi-factor authentication isn't necessarily strong by leroy_masochist on Friday December 27, 2019 @10:09AM (#21891723)

If you have the latest iPhone/Mac, you can still get iMessages delivered to your desktop, easily facilitating a state in which (almost by default, given how eager Google is to remember your passwords) anyone who has access to your unlocked computer can log into your bank account just by visiting the bank's website and get immediate access to the 6-digit verification code that they text you.

Sending codes within a native app that exists only and specifically on your handset is a much more robust solution; I'd imagine the reason why it's implemented so infrequently is that its upshot is a lot of angry, frantic calls to tech support.

[ Parent | on HN ]

Re:Multi-factor authentication isn't necessarily strong by acdha on Friday December 27, 2019 @12:55PM (#21892887)

> If you have the latest iPhone/Mac, you can still get iMessages delivered to your desktop … to your unlocked computer can log into your bank account just by visiting the bank's website and get immediate access to the 6-digit verification code that they text you.

What you're thinking of is the Handoff feature which allows your desktop to get access to SMS, not iMessage, and that's been recommended against for exactly this reason for many years. It's also somewhat dwarfed by the fact that SMS is inherently insecure and not a responsible choice for MFA in any scenario.

In the case of banks, they really need to be pushing FIDO since that protects against this threat and also the phishers who create very realistic sites including requests for SMS/TOTP codes.

[ Parent | on HN ]