Re:Ransomware gang threatens release of Washington D.C. poli...
by selfhoster11 on Monday May 17, 2021 @06:16AM
(#27181867)
> it's trivial to social engineer phone companies into moving a phone number to a new phone
Obligatory "if you're in the US, then yes - elsewhere, it depends". In the UK, obtaining a PAC code is a bit more complicated/non-trivial for the attacker. I'd consider it fairly safe to use SMS 2FA over here.
It's also why SMS text messages do not meet the criteria for 2 factor authentication - it's trivial to social engineer phone companies into moving a phone number to a new phone - presumably one you would not have. Authentication apps are a PITA to move to new devices because having a way to move your keys around without some reliance on meatspace defeats the whole goal of "something you have".