Tag Info

Hot answers tagged

6

It is more secure than a password in some ways, but as you describe, it also makes accounts more vulnerable to other attack vectors. As a best practice, properly implemented two-factor authentication offers much superior security to a single factor, regardless if that single factor is a memorized password or an "on demand" password. Reduced Vulnerability ...


3

In the United States, generally anyone can subpoena anyone or anything as part of the "discovery" process. It is up to the presiding Judge to decide whether or not this is relevant or allowable. In a civil action, as opposed to a criminal one; some typical protections (e.g. 5th amendment protection against self-incrimination) do not apply. Thus, it is far ...


3

By definition, 2FA is if you authenticate users based on two of the following: Something you know (like a password) Something you have (like a key) Something you are (biometrics) I see that people often argue in which category e-mail should belong. Although many argue that it belongs in the "Something you have" category, I think that it should rather ...


1

You still have the same advantage. Two factor authentication with SMS/TOTP is based on two things : Something you know - your password Something you have - your phone If you log in using your phone you need to know the password and... have the phone. This way it's still the same amount of security.


1

I also discourage using email in this scenario. Obviously - if you are only using it internally - the attacker could only be internal (or an external first have to become interal). The email flow internally is probably more easy to sniff than dealing with the BTS for delivering the SMS. But both ways deliver the second component (to avoid the discussion ...


1

Note that I am not an expert in this field, this information is gleaned from other sources. 3G Interception tools are about to appear (or may well have already done so). The "Stingray" from Harris is the most commonly quoted product and is widely used by US "law enforcement" (or maybe that should be law ignorement!) The tech blog Techdirt is a blog I ...


1

Unfortunately not the way you are thinking. But things are never simple on information security. Most of phones that I'm aware of, does not let you select a specific tower you want to connect. This is a usual GUI for Android: and the relevant ones on Engineering mode GUI: Why you want WCDMA only There are others too, but I won't add here since it's ...


1

Tapping a cell phone is doable, but very difficult, especially for someone who has little tech knowledge, and providers generally do not give the capability to listen in on specific calls either. The bill may show the duration of the call and who the call was made to/from, but generally they wouldn't be able to listen in. Consider each cell phone on the plan ...



Only top voted, non community-wiki answers of a minimum length are eligible