Either by sending a code to SMS or Email, you are able to sign into your account without ever needing to or being able to add a password. Why has this become a thing recently?

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 year ago (4 children)

I never understood why SMS is insecure, are you saying it's easy to intercept someone's number? How would that even work without the SIM?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 1 year ago

    Getting a replacement SIM from the phone company is often shockingly easy, just a tiny bit of social engineering. And then you have access to the number and everything that 2FA "protects"

  • source
  • parent
  • [–] 7 points 1 year ago

    It is but only if you are targeted. I completely disagree with people who say it’s insecure because most attacks are remote and in bulk. Which your password they can login from any browser but are stopped by the SMS code.

    For the SMS code they can use mostly automated social engineering to trick a certain percentage into giving it up.

    However while A SIM attack may be easy enough for a targeted individual, I don’t think it scales: they have to do work that only helps with one user. It’s too “expensive” compared to automated social engineering against a million vulnerable users

  • source
  • parent
  • [–] 3 points 1 year ago

    The most common way is basically calling up your phone company and pretending to be you saying you needed to switch phones

    But also beyond just that the networks that route calls and texts globally are not very secure... and it's not as hard as it should be to get access to it.

  • source
  • parent