Linked Questions

16 votes
3 answers

Should 2-factor authentication using SMS be deprecated?

Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for 2FA or for controlling the account (password reset, etc..). However, GSM was proven ...
T.Todua's user avatar
  • 2,727
9 votes
3 answers

Is a second, "old" (dumb) phone dedicated just to receiving bank tokens as safe as "modern" (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?
Joelty's user avatar
  • 219
3 votes
3 answers

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
Sayan's user avatar
  • 2,031
4 votes
2 answers

SMS / voice call interception with a fake base station

This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
pfust75's user avatar
  • 425
3 votes
3 answers

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
Double's user avatar
  • 31
0 votes
1 answer

Should i verify otp after login or before?

I am building a token-based authentication API, and I have three main methods: Register Method: It takes credentials (email, password, phone number) and creates the user, then sends an OTP message to ...
Lana Hanna's user avatar
1 vote
2 answers

Understanding the strength of mobile two-factor and alternatives to this

I'm currently using two-factor between my Mac and iPhone. And I also use it for my Google account. (Those are the two only ones at the moment.) How I can protect access to my accounts if I don't have ...
forthrin's user avatar
  • 1,811
2 votes
0 answers

How can I go about securing services that require SMS tokens as backups?

I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
Steve Rukuts's user avatar

15 30 50 per page