Timeline for IT will only give password over phone - but is that really more secure than email?
Current License: CC BY-SA 4.0
26 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 23, 2018 at 17:05 | vote | accept | Chris Cirefice | ||
| Aug 23, 2018 at 3:08 | comment | added | Anthony | One crucial aspect of 2FA is that the factors need to be totally independent streams of delivery. Thus a 2FA authentication that is a password plus a smart card, or a password plus a key exchange, is not really effective. All three are fine authentication methods, but combining them isn't enforcing two factors. A phone call would do this (assuming you aren't answering your phone via a desktop app) as well as the added benefit Andrew Greer mentions of not leaving any record of the phone call audio. | |
| Aug 22, 2018 at 15:24 | comment | added | Falco | An additional reason could be verification if there is still an actual person using the account. A threat model could be an account hijacking, where the original user does not even use the account anymore. - In this case the attacker would need to simulate a complete personal conversation, which is much harder for a botnet or a non native speaker who might have compromised the account. | |
| Aug 22, 2018 at 14:11 | comment | added | Laurent S. | Actually having someone on the phone giving you the password is already 1 person too much knowing this password... And is an indication that this password reset is managed in such a way there is somewhere a list of all these passwords in clear-text (or whatever 2-way encryption). I'm surprised they go over such an hassle when the whole process already has from the beginning some security flaws that I find more concerning. And I'm not a security expert... | |
| Aug 21, 2018 at 15:17 | answer | added | Machavity | timeline score: 1 | |
| Aug 21, 2018 at 0:48 | comment | added | Joe W | A couple of key points to remember when talking about passwords being more secure is that if the end user has the phone on speaker, repeats the password or writes it down so they remember it the extra security from it not going over email can be lost especially if it is a password they are not forced to change or can't change. Another key point is that not everyone can use the phone such as deaf, hearing impaired and people who have lost their voice for some reason which means that other means of giving the user a password is needed. | |
| Aug 20, 2018 at 21:52 | comment | added | Hagen von Eitzen | If only there was a secure channel ... such as the already existing VPN | |
| Aug 20, 2018 at 8:35 | history | protected | Rory Alsop♦ | ||
| S Aug 20, 2018 at 8:33 | history | mod moved comments to chat | |||
| S Aug 20, 2018 at 8:33 | comment | added | Rory Alsop♦ | Comments are not for extended discussion; this conversation has been moved to chat. | |
| Aug 20, 2018 at 1:55 | answer | added | Cort Ammon | timeline score: 1 | |
| Aug 19, 2018 at 21:12 | answer | added | bluninja1234 | timeline score: -4 | |
| Aug 18, 2018 at 7:44 | answer | added | Scott McMahan | timeline score: 12 | |
| Aug 17, 2018 at 17:29 | answer | added | James Jenkins | timeline score: 0 | |
| Aug 17, 2018 at 8:11 | answer | added | Ben | timeline score: 58 | |
| Aug 17, 2018 at 7:24 | answer | added | AMADANON Inc. | timeline score: 32 | |
| Aug 16, 2018 at 22:47 | comment | added | nasch | @dandavis Just because your connection to gmail or whatever is secure does not mean the message will be encrypted all the way to the destination. superuser.com/questions/260002/… | |
| Aug 16, 2018 at 21:52 | answer | added | Sufferer | timeline score: 2 | |
| Aug 16, 2018 at 21:27 | answer | added | ETL | timeline score: 8 | |
| Aug 16, 2018 at 21:01 | history | tweeted | twitter.com/StackSecurity/status/1030197872543887360 | ||
| Aug 16, 2018 at 18:08 | answer | added | Joe M | timeline score: 3 | |
| Aug 16, 2018 at 17:50 | history | edited | Chris Cirefice | CC BY-SA 4.0 |
Question focus
|
| Aug 16, 2018 at 17:49 | answer | added | Mike Ounsworth | timeline score: 56 | |
| Aug 16, 2018 at 17:44 | comment | added | Luc | A phone call is usually not recorded for indefinite history, whereas an email is usually not deleted. The transport security of either depends on a lot of things (phone: was it a landline, 2G/3G/4G, VoIP; email: does SMTP use TLS, does the client use TLS, etc.) | |
| Aug 16, 2018 at 17:42 | answer | added | Rocket | timeline score: 121 | |
| Aug 16, 2018 at 17:39 | history | asked | Chris Cirefice | CC BY-SA 4.0 |