you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 4 months ago (8 children)

Briefly: look into sim swapping, which is the most obvious, day to day risk.

Then there's SS7 and how inherently trusting the whole system is.

Then depending on where you are, some mobile networks still have terrible link encryption (were talking so bad a normal laptop is enough these days to break it on the fly). Granted, this is rare these days, in part thanks to the efforts of Karsten Knohl, SRLabs and other security researchers who did a lot to shine a light on this and SS7

Not sure how up to date it still is, but https://gsmmap.srlabs.de/ shows how unequal networks are.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 4 months ago

    This is becoming less of an issue as US Mobile has anti-SIM-hijacking protection; hopefully other carriers will follow suit. Of course, the carriers themselves can still read your msgs, but so can WhatsApp, probably (despite their claims to the contrary).

  • source
  • parent
  • [–] -4 points 4 months ago (6 children)

    That’s all sms though, not 2fa in general.

    All valid points and good information within that scope.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 4 months ago (5 children)

    (...) and sms is an insecure system to begin with.

    citation needed on the second half

    That’s all sms though, not 2fa in general.

    Are you an LLM?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 4 months ago* (4 children)

    It’s been edited, bud. Originally it said that 2fa in general is insecure.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 4 months ago* (last edited 4 months ago) (3 children)

    The edit icon is a bit not-obvious in Voyager...
    And I can't view the original text.

    Edit: Speeling on a phone is hard (read: annyoing)

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 4 months ago (2 children)

    I don't think the original text before edits is viewable by anyone other than possibly instance admins.

  • source
  • parent
  • hideshow 2 child comments