Linked Questions

0 votes
0 answers

How to make SMS-based 2FA safer?

This is a problem that many of us face: A surprising number of financial institutions' websites offer additional authentication only via SMS and/or phone call. But I will refer to my situation ...
23 votes
6 answers

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
0 votes
1 answer

Should i verify otp after login or before?

I am building a token-based authentication API, and I have three main methods: Register Method: It takes credentials (email, password, phone number) and creates the user, then sends an OTP message to ...
88 votes
7 answers

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
0 votes
1 answer

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
44 votes
1 answer

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
16 votes
3 answers

Should 2-factor authentication using SMS be deprecated?

Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for 2FA or for controlling the account (password reset, etc..). However, GSM was proven ...
-1 votes
3 answers

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
18 votes
3 answers

Is cell phone number based verification secure?

Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
21 votes
4 answers

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
3 votes
3 answers

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
65 votes
5 answers

Is sending passwords through cellphone text messages secure?

Both the sender and the receiver deleted the text after it was sent, but is it still possible that it exists somewhere and that someone can get to it?
13 votes
4 answers

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
11 votes
3 answers

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...
9 votes
3 answers

Is a second, "old" (dumb) phone dedicated just to receiving bank tokens as safe as "modern" (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?

15 30 50 per page