NIST has been saying since 2016 not to use SMS for MFA. It’s always been horribly insecure.

Oh it turns out we needed NSA to do its actual fucking job after all rather than holding onto exploits for the surveillance state.

Now — for the second time — we have an adversarial administration eager to weaponize government departments while Americans are vulnerable. Why? Because America is the good guys and would never abuse its extrajudicial powers (say, by detaining, rendering and torturing Americans with names similar to those of POIs.)

We could have had twenty-four years of robust communications security developments if NSA didnt sell the public out like Judas.

Authentication for my work email: Enter 28 character password, receive sms, enter message, log in

Authentication for my Battle.net account:

-Enter email made before 2000 because they don’t let you change email

-Enter password

-Get rejected

-Solve CAPTCHA

-Try backup passwords, get rejected

-Request new password

-Send request to 24 year old email

-Try to log on to 24 year old email, email is suspicious and sends Authentication request to my newer email

-Open newer email, Authenticate older email

-open old email, Put in code to battle.net

-Battle.net requests Authenticator code from Battle.net app

-Open battle.net app (no requests)

-Try manual code, doesn’t work

• Realize Battle.net app Authenticator not connected

-Try to connect Battle.net app Authenticator to account

-Realize you cannot connect Authenticator without signing in AND signing in requires Authenticator

-Close Battle.net app

-Open Blizzard Authenticator

-Close warning that this app got depreciated in January

-Enter manual code

-it works

-Attempt to change password to password I first attempted

-Won’t let me use same password

-Try logging in using that password

-Still doesn’t work - Solve one more CAPTCHA

-Change password to backup password and back to original password - have to solve 2 more Captchas

-Finally works

-Log in

Always has been

Didn’t this happen quite awhile ago? I don’t see anything new in this article

Thank god, give me my HMAC hash please.

Nothing more terrifying than losing your phone number these days because of all the accounts tied to it via 2FA.

The end of an era.

Or actually, probably not until we redo whole cellular phone technology works and kick out all the bad actors using SS7 vulnerabilities for stuff like spoofing numbers and stealing messages. We really shouldn’t be using a 45 year old system for almost all communications.

Since when was sms ever secure? My understanding is that messages are sent in the clear, meaning your carrier and the recipient’s carrier both have the opportunity to intercept messages.

I mean that’s the message content, not the authentication, but still, sms is the opposite of secure, always has been.