Re:SMS Multifactor Authentication in Antarctica
by jay7038 on Tuesday November 01, 2022 @04:23AM
(#33418396)
I strongly suggest not using TOTP, HOTP or similar MFA solutions based on a shared secret if security is important. It is basically the same as storing your password both at your provider and in your phone in cleartext. With SMS you have at least the possibility to do auditing when a token is generated.
[ Parent
| on HN ]
Re:SMS Multifactor Authentication in Antarctica
by pabs3 on Tuesday November 01, 2022 @06:00AM
(#33419065)
The problem with SMS is that it is allegedly trivial to convince a telco to port someone else's number to the new burner SIM you just bought. That seems slightly worse than shared secrets to me.
Re:SMS Multifactor Authentication in Antarctica
by kefyras on Tuesday November 01, 2022 @08:31PM
(#33429901)
SIM swap attack is really baffling to me. Over here, even if someone gained access to your account and initiated porting, you still need to go the store and present your ID to complete it.
Re:SMS Multifactor Authentication in Antarctica
by pabs3 on Tuesday November 01, 2022 @11:18PM
(#33431072)
Social engineering is really powerful, since the people you are engineering usually have elevated access privileges. In the ID scenario, presumably there are fake ID providers one could use, although with facial recognition in common use, maybe that scenario becomes harder.
Re:SMS Multifactor Authentication in Antarctica
by kevincox on Tuesday November 01, 2022 @08:11AM
(#33420117)
It's a second factor anyways. If the provider is fully compromised it doesn't matter much if the attacker can get the secret. If the secret leaks the password is hopefully hashed so attackers still can't get in.
I'd much rather have a reliable method of 2FA that works offline, on all of my devices and can only be hijacked from me or the service than use one that requires my phone to be nearby, working and having service and can also be hijacked by my phone company.