Either by sending a code to SMS or Email, you are able to sign into your account without ever needing to or being able to add a password. Why has this become a thing recently?
Either by sending a code to SMS or Email, you are able to sign into your account without ever needing to or being able to add a password. Why has this become a thing recently?
I never understood why SMS is insecure, are you saying it’s easy to intercept someone’s number? How would that even work without the SIM?
Getting a replacement SIM from the phone company is often shockingly easy, just a tiny bit of social engineering. And then you have access to the number and everything that 2FA “protects”
Veritasium did a great video on it. Anything I can say about it will be 10x worse than that video.
It is but only if you are targeted. I completely disagree with people who say it’s insecure because most attacks are remote and in bulk. Which your password they can login from any browser but are stopped by the SMS code.
For the SMS code they can use mostly automated social engineering to trick a certain percentage into giving it up.
However while A SIM attack may be easy enough for a targeted individual, I don’t think it scales: they have to do work that only helps with one user. It’s too “expensive” compared to automated social engineering against a million vulnerable users