News for hackers. Stuff that matters.

A comment on Ask HN: How can techies influence companies to stop implementing SMS/phone 2FA. Parent comment

Re:Ask HN: How can techies influence companies to stop imple... by jgilias on Wednesday November 02, 2022 @10:35AM (#33436474)
The security advantage is that an attacker using a completely different device doesn’t have your phone.
[ Parent | on HN ]
Re:Ask HN: How can techies influence companies to stop imple... by ale42 on Wednesday November 02, 2022 @11:03AM (#33436965)
Except that SMS messages can be intercepted, e.g. by having a proper access to the SS7 backbone, by abusing services provided for other reasons, or by SIM swapping attacks. All of this has already been done, so it's not just theory.

See e.g. https://arstechnica.com/information-technology/2021/03/16-at..., https://arstechnica.com/information-technology/2017/05/thiev..., https://arstechnica.com/information-technology/2016/08/congr...

[ Parent | on HN ]
Re:Ask HN: How can techies influence companies to stop imple... by jgilias on Wednesday November 02, 2022 @12:00PM (#33437978)
Yes, of course, the Ask:HN is basically about that! The parent comment asserted that having an SMS in addition to a password is functionally no different from having a password only. Which is not the case.
[ Parent | on HN ]