Re:Can We Stop Pretending SMS Is Secure Now?
by indymike on Wednesday March 17, 2021 @07:00AM
(#26489290)
SMS is not secure. Neither is email. Neither is a voice call. Cracked password = easy, free. Getting SMS or voice rerouted? costs money, extra step. A strong, unique password + even SMS 2FA is a relatively safe access control. Ultimately, we're all living with the legacy of a lot of tech that got mass adoption before it was mature (I started my career writing medical device software. I shudder to think how little thought went into security when we were all just trying to get things to work in the 80s).
[ Parent
| on HN ]
Re:Can We Stop Pretending SMS Is Secure Now?
by jjav on Wednesday March 17, 2021 @04:29PM
(#26496398)
> SMS is not secure. Neither is email.
That's too much of a simplification. At an absolute level, true.
But security is relative and needs to be measured with the threat models you care about.
Intercepting an email from your bank (let's say) to your email server (whoever provides it) is in practice exceedingly difficult, requires the attacker is in control of a transit point between them.
Intercepting SMS, as described in the article, is trivial and can be done by just about anyone who cares to go for it.