It’s time to stop using SMS for security

Re:It’s time to stop using SMS for security by heroprotagonist on Tuesday March 16, 2021 @06:37AM (#26475014)

Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app.

Like Microsoft Authenticator. It wanted way too many permissions on my phone, and provided less security than my Yubikey authenticator. My yubikey provides a standard open OTP but requires the device to generate it (phone tap or plugin via USB to computer or phone).

Open standards are better. I don't want a different authenticator app for every website. It's so much simpler to use a single app.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by corty on Tuesday March 16, 2021 @07:14AM (#26475258)

Microsoft Authenticator can be replaced by any app that does standard OTP, e.g. FreeOTP+.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by heroprotagonist on Tuesday March 16, 2021 @10:49AM (#26477425)

Oh nice, I just checked my account and it has the option now. It didn't when I last looked a couple years ago. I'm glad they added this.

Thanks for the heads up!

Still, the principle stands for a number of other sites. eg, Steam (using their app or email), Twitch (authy or bust), etc. I'd rather use an open standard than be limited to a custom or specific authenticator.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by sodality2 on Tuesday March 16, 2021 @08:09AM (#26475636)

TOTP is definitely an open standard. https://tools.ietf.org/html/rfc6238

[ Parent | on HN ]