Linked Questions

0 votes
0 answers
66 views

How to make SMS-based 2FA safer?

This is a problem that many of us face: A surprising number of financial institutions' websites offer additional authentication only via SMS and/or phone call. But I will refer to my situation ...
23 votes
6 answers
9k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
0 votes
1 answer
497 views

Should i verify otp after login or before?

I am building a token-based authentication API, and I have three main methods: Register Method: It takes credentials (email, password, phone number) and creates the user, then sends an OTP message to ...
88 votes
7 answers
22k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
0 votes
1 answer
115 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
44 votes
1 answer
6k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
16 votes
3 answers
1k views

Should 2-factor authentication using SMS be deprecated?

Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for 2FA or for controlling the account (password reset, etc..). However, GSM was proven ...
-1 votes
3 answers
1k views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
18 votes
3 answers
6k views

Is cell phone number based verification secure?

Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
21 votes
4 answers
4k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
3 votes
3 answers
4k views

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
65 votes
5 answers
50k views

Is sending passwords through cellphone text messages secure?

Both the sender and the receiver deleted the text after it was sent, but is it still possible that it exists somewhere and that someone can get to it?
13 votes
4 answers
988 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
11 votes
3 answers
6k views

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...
9 votes
3 answers
2k views

Is a second, "old" (dumb) phone dedicated just to receiving bank tokens as safe as "modern" (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?
17 votes
3 answers
70k views

How to spoof a cell phone tower (cell site, base station) -- homemade IMSI-Catcher

An answer to a recent question has given me an idea for a school project (security CS program). Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...
2 votes
0 answers
145 views

How can I go about securing services that require SMS tokens as backups?

I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
1 vote
2 answers
201 views

Understanding the strength of mobile two-factor and alternatives to this

I'm currently using two-factor between my Mac and iPhone. And I also use it for my Google account. (Those are the two only ones at the moment.) How I can protect access to my accounts if I don't have ...
3 votes
3 answers
381 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
13 votes
5 answers
3k views

SMS verification, is it secure? [duplicate]

In my web app (everything works with HTTPS), I send the user an SMS with a unique 5-digit code to a cellphone number he provides. I then ask the user to enter in the browser the code he received. ...
-1 votes
2 answers
315 views

How to secure SMS functionlity in web application? [duplicate]

How to secure SMS sending feature in web applications? If an application is using third party SMS gateway then SMS also can be spoofed. Like attacker can change mobile number with firebug and abuse ...
2 votes
2 answers
10k views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
2 votes
1 answer
556 views

Send credentials by sms [duplicate]

If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
4 votes
2 answers
5k views

SMS / voice call interception with a fake base station

This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...