4

My bank started using 2-factor authentication with phone being part 2, so I am wondering is it difficult for someone to impersonate my mobile phone to receive the text message with the code?

  • 3
    It is certainly better than no two-factor but there have been instances where attackers sweet-talked customer service into redirecting texts to another phone. Generally speaking, Google Authenticator and similar apps that generate the code locally based on the time are more secure, but unfortunately some sites only offer SMS two-factor. – tlng05 Oct 1 '16 at 0:53
5

NIST (National Institute of Standard and Technology) is recommending not to use SMS based 2 factor authentication. According to NIST guidance.

OOB [out-of-band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

This article by Brian Krebs has details on how the current 2 factor auth using SMS can be used by bad guys to scam people. It also has details on the alternatives which are more secure.

SMS is easy to intercept because of the SS7 protocol used by carriers which was designed with no security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.