News for hackers. Stuff that matters.

A comment on Passwords are obsolete. Parent comment

Re:Passwords are obsolete by anaphor on Sunday April 13, 2014 @05:06PM (#7583020)
>why do many companies use SMS as secondary auth (for the "2" in 2-factor)?

Because they don't know about TOTP or HOTP, and they instead decided to use a terribly insecure protocol as the basis for user authentication? The onus is on you to prove SMS is better than a shared secret + a nonce.

[ Parent | on HN ]
Re:Passwords are obsolete by sadfnjksdf on Sunday April 13, 2014 @05:13PM (#7583060)
Ok, valid point- to clarify, when I said 2-factor SMS, I was assuming a 30-second TOTP like Google's.

If you don't use TOTP, someone can login to your account just by knowing the password which they can use from almost anywhere. If you were to only use TOTP, they'd need your phone. To me them stealing your phone is tougher than stealing or guessing your password.

[ Parent | on HN ]