Linked Questions

44 votes
1 answer
6k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
Nathan Aw's user avatar
13 votes
5 answers
3k views

SMS verification, is it secure? [duplicate]

In my web app (everything works with HTTPS), I send the user an SMS with a unique 5-digit code to a cellphone number he provides. I then ask the user to enter in the browser the code he received. ...
frenchie's user avatar
  • 1,091
-1 votes
3 answers
1k views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
stevec's user avatar
  • 1,280
2 votes
1 answer
551 views

Send credentials by sms [duplicate]

If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
Jon smith optional's user avatar
-1 votes
2 answers
313 views

How to secure SMS functionlity in web application? [duplicate]

How to secure SMS sending feature in web applications? If an application is using third party SMS gateway then SMS also can be spoofed. Like attacker can change mobile number with firebug and abuse ...
Know Your Enemy's user avatar
0 votes
1 answer
112 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
david_adler's user avatar
88 votes
7 answers
22k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
Mohammed Rady's user avatar
65 votes
5 answers
50k views

Is sending passwords through cellphone text messages secure?

Both the sender and the receiver deleted the text after it was sent, but is it still possible that it exists somewhere and that someone can get to it?
Rachel's user avatar
  • 661
23 votes
6 answers
9k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
dbr's user avatar
  • 435
21 votes
4 answers
4k views

Could my bank's two-factor authentication be hacked?

When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account. Is this vulnerable to attack, without ...
user avatar
18 votes
3 answers
6k views

Is cell phone number based verification secure?

Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
Lone Learner's user avatar
17 votes
3 answers
69k views

How to spoof a cell phone tower (cell site, base station) -- homemade IMSI-Catcher

An answer to a recent question has given me an idea for a school project (security CS program). Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...
jtpereyda's user avatar
  • 1,600
13 votes
4 answers
987 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
makerofthings7's user avatar
11 votes
3 answers
6k views

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...
muru's user avatar
  • 394
2 votes
2 answers
10k views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
sixtyfootersdude's user avatar

15 30 50 per page