News for hackers. Stuff that matters.

A comment on Tell HN: SMS-based two-factor authentication is not secure. Parent comment

Re:Tell HN: SMS-based two-factor authentication is not secure by raesene9 on Wednesday June 09, 2021 @01:12PM (#27450466)
Sure, no security measure is perfect. Hardware tokens are likely to have better properties than TOTP, which has better properties than SMS, which has better properties than nothing.

you can phish SMS exactly the same way you can phish TOTP, I'd say :)

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by UncleMeat on Wednesday June 09, 2021 @01:41PM (#27450803)
TOTP is marginally safer than SMS.

It also comes with large downsides. Security is an economics game. Marginal improvements in security posture are not always worth the cost.

There are a bunch of people who insist that web services should drop SMS completely and demand that all users use TOTP (at least). I question the value of this change given that TOTP only protects you in comparatively rare cases.

[ Parent | on HN ]