• fucking annoying
  • can’t believe they sold people that it’s BETTER to have to get your phone out to login
  • incredibly annoying
  • if you’re using this willfully you’re clearly just as worried about security as before anyway
  • companies love having real phone numbers to pair with ‘their’ data
  • atocci@kbin.social
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    Right but the point they’re making is it’s a lot easier for a third party to intercept a code that has to be sent to you than it is for them to get the code from an authenticator app since they’re generated on your device. At that point you pretty much need physical access to the phone.

    • HubertManne@kbin.social
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      im osrry so a hacked device would not show the authenticator code? I really don’t see the difference here. Again its not each bit being so un breachable as much as they would have to have to breach both parts. I really don’t think its taht easy to redirect all the calls that are supposed to go to my phone.

      • atocci@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        One is much easier to accomplish than the other and doesn’t give the target the same chance to realize something is going on.

        • HubertManne@kbin.social
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          I don’t think thats necessarily true. If diverting phonecalls were so easy there are a bunch of reasons outside of two factor attacks that it would be used for.

            • HubertManne@kbin.social
              link
              fedilink
              arrow-up
              1
              ·
              1 year ago

              you seem to be limiting it to sms. you do realize your talking to a person who mentioned microsofts option to call you and you hit pound. They actually have an app where you input a two digit number and if anything I would have liked them to expand the phone call function with that. Anyway I was not speaking about sms but I still feel the vulnerabilities are overblown when used with a good password.

                • HubertManne@kbin.social
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  1 year ago

                  yes microsoft was the one I was complaining about but you can’t redirect phone calls in the same way as sms and sms itself is mostly vulnerable due to legacy things that they could stop using and finally that article was not just 2 factor but bringing in using sms for a password reset which is really insecure but unrelated to 2factor. 2factor will always be safer than non 2 factor because more has to be done than just the one side.

                  • atocci@kbin.social
                    link
                    fedilink
                    arrow-up
                    1
                    ·
                    edit-2
                    1 year ago

                    You can, the concern here is with people, not the specifications of SMS. People can be social engineered to give control of your phone number to someone else. It’s happened before, it’s not a hypothetical, and it’s why security experts advise against using phone based methods.