New answers tagged

1

The problem I see with this statement is that both of these attacks to me feel like they're essentially only really feasible for attacks targeted at a specific user with the goal of breaching a targeted service. [...] You can't do SIM swap attacks in an automated way or even at scale (unless there is a serious issue with a phone provider). [......


5

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability and risk against cost and inconvenience. A different question you could ask is whether SMS 2FA is sufficient mitigation against criminal teams working on mass ...


10

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new system that comes up every few months and that completely obsoletes everything else is usually based on personal financial interests, dogma, belief, and snake oil. ...


37

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the attack. Even an "average user" might have crypto wallets or precious twitter accounts. Sometimes the gain of an attack is also not that obvious, like when a ...


2

Although SMS 2FA is not as strong as TOTP base MFA or the use of a hardware security key (e.g. yubikey) it still offers a significant amount of protection against the typical attacker who's just trying to make use of weak or compromised passwords.


7

Having multiple factors of authentication are always more secure than any one of those factors apart. A password and a token from an SMS message is harder for an attacker to circumvent than just a password or just a token sent through SMS. However, SMS itself is currently considered the least secure authentication method, and there does not seem to be any ...


0

Getting access to your SMS is much more complex than getting access to your password. That's why even if resetting the password based on SMS is possible on some sites, it is still more secure than password. How can you password be hacked? For instance, there is some malware on your computer that can read your password database and thus knows web sites, user ...


0

I can see how it is considered a good practice to have upon changing authentication settings (Change password/Setup 2FA etc.) to close all of the sessions, but I don't see any real world security benefits from that. I think that it's more important to make sure that Logout works for all sessions not just the one involved. This is meant as a close all ...


1

Section 5.2 of RFC 6238 says that the code should not be used multiple times: Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP....


2

This is an intended functionality. There is no point in sending separate 2FA code every time within, for example, 5 minutes if it hasn't been used. From a security perspective this isn't a problem, for if your 2FA method is compromised it won't matter if you send different or the same code. The main thing is for the pin code to not be easily guessable ...


0

The main question is if the MFA code is predictable enough or not. Just because "the same code" (so likely not a specific code known to the attacker) will repeat within a "certain time" (no idea how long this is and if it is a fixed time) does not mean it is predictable. And absence of these does not mean it is not predictable. In fact, if you have a ...


2

The backup keys essentially become equivalent to your password. The guidelines you are looking for are the same guidelines for storing your personal passwords. There won't be different guidelines. The one slight difference between passwords and MFA codes is that you tend to need those codes very infrequently (maybe only ever once), and when something has ...


1

No, it won't negate the advantages of 2FA, even if it reduces it a little. Security is only effective if it does not makes the user resort to workarounds, otherwise they won't use the security option. I would not use a 2FA token if it took 5 minutes to arrive, for example. In this case, remembering the device for a while will not force the user to enter the ...


Top 50 recent answers are included