- fucking annoying
- can’t believe they sold people that it’s BETTER to have to get your phone out to login
- incredibly annoying
- if you’re using this willfully you’re clearly just as worried about security as before anyway
- companies love having real phone numbers to pair with ‘their’ data
I don’t think thats necessarily true. If diverting phonecalls were so easy there are a bunch of reasons outside of two factor attacks that it would be used for.
There actually are lots of things it’s been used for in addition to stealing 2FA codes. SMS based 2FA is better than no 2FA at all, but it’s insecure and not recommended to be used when dedicated authenticators are available instead. The NIST has warned against their use since 2016.
you seem to be limiting it to sms. you do realize your talking to a person who mentioned microsofts option to call you and you hit pound. They actually have an app where you input a two digit number and if anything I would have liked them to expand the phone call function with that. Anyway I was not speaking about sms but I still feel the vulnerabilities are overblown when used with a good password.
That’s semantics, the same insecurities apply to all telephone based methods. I personally wouldn’t want my phone company’s customer service to play any role in my online security. Even Microsoft wants people to stop using them.
yes microsoft was the one I was complaining about but you can’t redirect phone calls in the same way as sms and sms itself is mostly vulnerable due to legacy things that they could stop using and finally that article was not just 2 factor but bringing in using sms for a password reset which is really insecure but unrelated to 2factor. 2factor will always be safer than non 2 factor because more has to be done than just the one side.
You can, the concern here is with people, not the specifications of SMS. People can be social engineered to give control of your phone number to someone else. It’s happened before, it’s not a hypothetical, and it’s why security experts advise against using phone based methods.
Im pretty sure that you would realize something was wrong with your phone then and its useless to them 2factor wise unless they have your password.
deleted by creator