Tell HN: SMS-based two-factor authentication is not secure

Re:Tell HN: SMS-based two-factor authentication is not secure by sgerenser on Wednesday June 09, 2021 @01:25PM (#27450603)

Couldn’t this entire scenario play out exactly the same with SMS codes?

[ Parent | on HN ]

Re:Tell HN: SMS-based two-factor authentication is not secure by UncleMeat on Wednesday June 09, 2021 @01:39PM (#27450780)

Yes.

The point is the TOTP is precisely as bad as SMS for the common case (phishing) and only safer in a rare case (SIM-swap). This comes with large downsides (losing access).

TOTP is, at best, a very marginal improvement over SMS. This is what makes the online push to complain about services that use SMS 2FA and demand a switch to TOTP very strange.

[ Parent | on HN ]

Re:Tell HN: SMS-based two-factor authentication is not secure by dheera on Wednesday June 09, 2021 @02:15PM (#27451199)

TOTP is far, far better for travellers who need to swap their SIM cards frequently, or need to work out of places with internet access but no cell reception.

[ Parent | on HN ]

Re:Tell HN: SMS-based two-factor authentication is not secure by UncleMeat on Wednesday June 09, 2021 @02:58PM (#27451684)

Sure. I'm not opposed to supporting it. It is just weird to me to see people pushing for it with seemingly equal vigor as U2F.

[ Parent | on HN ]