News for hackers. Stuff that matters.
Re:It’s time to stop using SMS for security by superasn on Tuesday March 16, 2021 @08:27AM (#26475784)
> has required me to contact my parents to turn on and check the old phone I left with them

Why didn't you use a sms to email forwarding app on a phone connected to a charger?

They are free on play store and work really well.

Re:It’s time to stop using SMS for security by chrismorgan on Tuesday March 16, 2021 @08:31AM (#26475828)
It never occurred to me to seek such a thing. As I wrote my earlier comment here, I wondered to myself whether there might be an app or service to help with this, but it’s too late now. But even then, I’m not sure I’d want to leave a phone plugged in all year, even with its battery removed.
Re:It’s time to stop using SMS for security by glitchc on Tuesday March 16, 2021 @12:34PM (#26479083)
That’s a horrendous hack. The security provisions of immediacy and liveness offered by SMS 2FA are rendered moot.

That one needs to do this to work around the limitations solidifies in my mind that SMS is a poor 2FA solution and should be discontinued.

Re:It’s time to stop using SMS for security by mindslight on Tuesday March 16, 2021 @12:43PM (#26479224)
I'm surprised to see people here treating SMS "2FA" as anything but some snake oil annoyance to be worked around. I setup mine to go to a VOIP number where texts show up in email. I have plans to write something that looks for these messages and spits the code to a terminal or XMPP. My goal is to get that code into my paste buffer as quickly as possible.

If you're using a password manager and have a security model that includes trusting your own computer, you really don't want the snake oil. In fact with US bank accounts, "2FA" steps make your account less secure, because the security of your bank account ultimately relies on checking your transactions every 30 days - anything that gets in the way of easily logging in undermines that.

Re:It’s time to stop using SMS for security by corty on Tuesday March 16, 2021 @01:05PM (#26479617)
> In fact with US bank accounts, "2FA" steps make your account less secure, because the security of your bank account ultimately relies on checking your transactions every 30 days - anything that gets in the way of easily logging in undermines that.

So much this, for Europe as well. Since PSD2, i cannot automatically check my bank account anymore, because of onerous and braindead 2FA requirements. And most banks do not offer a email-on-withdrawal function in any proper fashion, even their apps require regular reauthentication. But, since it is a braindead directive, you can install the 2FA app on the same phone as the bank app and have them talk to each other, thereby killing all the security benefit while still being annoying and non-automatic.

Re:It’s time to stop using SMS for security by glitchc on Friday March 19, 2021 @12:51PM (#26515588)
Sounds like we're in agreement.