SMS phishing is way too easy

Re:SMS phishing is way too easy by 0xbeefeed on Friday June 24, 2022 @03:13PM (#31867919)

A lot of people in this thread saying SMS is bad for 2FA. It’s not. Just because you can send spoof the sender field doesn’t mean you can spoof being a receiver. Only the valid number will ever receive the 2FA code.

[ Parent | on HN ]

Re:SMS phishing is way too easy by jkepler on Friday June 24, 2022 @05:32PM (#31869616)

SMS is bad for 2FA not because it can be spoofed, bit because of SIM-swapping attacks that let the attacker trivially take your 2FA codes from you---gaining access to your protected accounts while you're locked out. NIST recommended against using SMS for this reason in summer 2016.

[ Parent | on HN ]

Re:SMS phishing is way too easy by conductr on Friday June 24, 2022 @03:38PM (#31868285)

But who can read the messages that go to the valid number? How can unwanted people gain that access?

[ Parent | on HN ]