It’s time to stop using SMS for security

Re:It’s time to stop using SMS for security by hlandau on Tuesday March 16, 2021 @11:45AM (#26478347)

"Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear.

By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is.

Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox can only be accessed by me over an SSH tunnel is truly laughable. In fact since sites which demand phone numbers seem to have some completely baseless idea that the phone number is somehow more "secure" than email, often adding a phone number will enable phone number-based recovery methods which therefore actually reduce account security.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by tptacek on Wednesday March 17, 2021 @01:31AM (#26486947)

No mainstream email providers support DANE, which is about as realistic an option as SSH tunnels.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by ClumsyPilot on Tuesday March 16, 2021 @07:02PM (#26484351)

"mailbox can only be accessed by me over an SSH tunnel"

Thats basically fantasy territory for an average user. If you consider the real world" abundant phishing, etc. then you will realise that in practice there is very little daylight between them.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by bawolff on Tuesday March 16, 2021 @03:10PM (#26481430)

Attackers who can defeat your password typically can also defeat your password protected email account.

Being an on-path attacker against SMTP is not a realistic threat model for most users.

[ Parent | on HN ]