Re:Tell HN: SMS-based two-factor authentication is not secure
by UncleMeat on Wednesday June 09, 2021 @01:39PM
(#27450780)
Yes.
The point is the TOTP is precisely as bad as SMS for the common case (phishing) and only safer in a rare case (SIM-swap). This comes with large downsides (losing access).
TOTP is, at best, a very marginal improvement over SMS. This is what makes the online push to complain about services that use SMS 2FA and demand a switch to TOTP very strange.
Re:Tell HN: SMS-based two-factor authentication is not secure
by dheera on Wednesday June 09, 2021 @02:15PM
(#27451199)
TOTP is far, far better for travellers who need to swap their SIM cards frequently, or need to work out of places with internet access but no cell reception.
The point is the TOTP is precisely as bad as SMS for the common case (phishing) and only safer in a rare case (SIM-swap). This comes with large downsides (losing access).
TOTP is, at best, a very marginal improvement over SMS. This is what makes the online push to complain about services that use SMS 2FA and demand a switch to TOTP very strange.