Re:Security Analysis of SMS as a Second Factor of Authentica...
by tialaramex on Tuesday November 10, 2020 @01:36PM
(#25049390)
> it shifts the attack from a passive opportunistic one to a targeted one
This isn't true. You can bulk phish SMS, TOTP and the push confirmation stuff. Software to do this isn't theoretical you can just download it ready to use, because in each case you only need to fool a human into believing this is really their bank/ web mail/ government/ etc.
If you want to get rid of the opportunistic stuff you need technology like WebAuthn that makes it simply not work.
This isn't true. You can bulk phish SMS, TOTP and the push confirmation stuff. Software to do this isn't theoretical you can just download it ready to use, because in each case you only need to fool a human into believing this is really their bank/ web mail/ government/ etc.
If you want to get rid of the opportunistic stuff you need technology like WebAuthn that makes it simply not work.