Linked Questions

23 votes
6 answers
9k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
0 votes
1 answer
459 views

Should i verify otp after login or before?

I am building a token-based authentication API, and I have three main methods: Register Method: It takes credentials (email, password, phone number) and creates the user, then sends an OTP message to ...
88 votes
7 answers
22k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
0 votes
1 answer
112 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
44 votes
1 answer
6k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
16 votes
3 answers
1k views

Should 2-factor authentication using SMS be deprecated?

Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for 2FA or for controlling the account (password reset, etc..). However, GSM was proven ...
-1 votes
3 answers
1k views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
18 votes
3 answers
6k views

Is cell phone number based verification secure?

Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
21 votes
4 answers
4k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
3 votes
3 answers
4k views

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
65 votes
5 answers
50k views

Is sending passwords through cellphone text messages secure?

Both the sender and the receiver deleted the text after it was sent, but is it still possible that it exists somewhere and that someone can get to it?
13 votes
4 answers
987 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
11 votes
3 answers
6k views

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...
9 votes
3 answers
2k views

Is a second, "old" (dumb) phone dedicated just to receiving bank tokens as safe as "modern" (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?
17 votes
3 answers
69k views

How to spoof a cell phone tower (cell site, base station) -- homemade IMSI-Catcher

An answer to a recent question has given me an idea for a school project (security CS program). Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...

15 30 50 per page