News for hackers. Stuff that matters.

A comment on Two-factor Authentication. Parent comment

Re:Two-factor Authentication by IgorPartola on Wednesday September 04, 2013 @12:58AM (#6325654)
SMS is not a secure channel. For example transmitting patient info over SMS violates HIPPA.
[ Parent | on HN ]
Re:Two-factor Authentication by bri3d on Sunday September 15, 2013 @01:46AM (#6388219)
Wait - I was disagreeing with the GP's assertion that SMS-only was a good idea, so I think we very much agree. Maybe you meant to respond to my parent post?

IMO a shared-secret OTP app is certainly not unbreakable but is more secure than SMS.

SMS is known to be easily subpoenaed and universally stored while believing in a widespread OTP app trojan-horse requires some form of tinfoil-hattery. Both are still orders of magnitude more secure than single-factor authentication anyway and hence I believe both should be included in a reasonable 2-factor authentication solution.

Personally I can't adopt an SMS-only 2-factor solution due to service issues anyway.

[ Parent | on HN ]