<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Bill,
<div><br>
</div>
<div>SMS for 2FA is not fine. I recommend you study the issue in more depth. It’s not just me who disagrees with you:</div>
<div><br>
</div>
<div><a href="https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html">https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html</a><br>
<br>
<div dir="ltr"> -mel </div>
<div dir="ltr"><br>
<blockquote type="cite">On Apr 18, 2021, at 6:31 AM, William Herrin <bill@herrin.us> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr"><span>On Sat, Apr 17, 2021 at 6:00 PM Eric Kuhnke <eric.kuhnke@gmail.com> wrote:</span><br>
<blockquote type="cite"><span>Anecdotal: With the prior consent of the DID holders, I have successfully ported peoples' numbers using nothing more than a JPG scan of a signature that looks like an illegible 150 dpi black and white blob, pasted in an image editor
on top of a generic looking 'phone bill'.</span><br>
</blockquote>
<span></span><br>
<span>Hi Eric,</span><br>
<span></span><br>
<span>SMS for 2FA is fine. It's understood that a single authentication</span><br>
<span>factor is not secure enough; that's why you use two. SMS for 1FA is</span><br>
<span>hugely risky and should not be used for anything important, like</span><br>
<span>money. SMS for a password reset is an example of 1FA -- your ability</span><br>
<span>to receive SMS messages at the required phone number becomes the sole</span><br>
<span>authentication factor needed to access the account.</span><br>
<span></span><br>
<span>If the adversary has captured your password -and- reprogrammed your</span><br>
<span>phone number, what makes you think they lack the wherewithal to have</span><br>
<span>captured the shared secret used to generate your TOTP code?</span><br>
<span></span><br>
<span>Regards,</span><br>
<span>Bill Herrin</span><br>
<span></span><br>
<span>-- </span><br>
<span>William Herrin</span><br>
<span>bill@herrin.us</span><br>
<span>https://bill.herrin.us/</span><br>
</div>
</blockquote>
</div>
</body>
</html>