It’s time to stop using SMS for security

Re:It’s time to stop using SMS for security by ksec on Tuesday March 16, 2021 @06:51AM (#26475103)

I actually love SMS 2FA ( And the rare few on HN ). It is the simplest form of 2FA that non-tech people will actually understand and use. Unless people want to argue 1FA is better than crappy 2FA.

SMS gets hatred especially in US because of how easy it is to socially engineer their way for SIM replacement or other SMS uses. Mostly because for unknown reason US has the absolute worst MNO in the world. In other places SMS replacement requires official forms to be filled as well as physical presence. It doesn't matter whether SMS is a form of 2FA of not, getting my SIM card without decent form of protection from Carrier is wrong in the first place.

And RCS doesn't seems / want / willing to replace SMS anytime soon. Carrier have little incentive to do so. It is backed by Google which means not everyone is on board including Apple. And GSMA has no intention to make a better SMS either.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by Mauricebranagh on Tuesday March 16, 2021 @06:59AM (#26475162)

Having built a system to handle SMS for a previous employer about 10 years ago the US's fractured mobile phone system did not help back then you could not reliably deliver SMS across systems.

Unfortunately yet another example of the US's poor regulation of telecoms receiver pays is another example.

[ Parent | on HN ]