<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
No, every SMS 2FA should be prohibited by regulatory certifications. The telcos had years to secure SMS. They did nothing. The plethora of well-secured commercial 2FA authentication tokens, many of them free, should be a mandatory replacement for 2FA in every
security governance regime, such as PCI, financial account access, government web portals, etc. <br>
<br>
<div dir="ltr">-mel via cell</div>
<div dir="ltr"><br>
<blockquote type="cite">On Apr 17, 2021, at 6:27 PM, Tim Jackson <jackson.tim@gmail.com> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="auto">
<div>Every SMS 2FA should check the current carrier against the carrier when enrolled and unenroll SMS for 2FA when a number is ported out. BofA and a few others do this.</div>
<div dir="auto"><br>
</div>
<div dir="auto">--</div>
<div dir="auto">Tim<br>
<br>
<div class="gmail_quote" dir="auto">
<div dir="ltr" class="gmail_attr">On Sat, Apr 17, 2021, 8:02 PM Eric Kuhnke <<a href="mailto:eric.kuhnke@gmail.com">eric.kuhnke@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div><a href="https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80" target="_blank" rel="noreferrer">https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80</a></div>
<div><br>
</div>
<div><a href="https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/" target="_blank" rel="noreferrer">https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/</a></div>
<div><br>
</div>
<div><br>
</div>
<div>Anecdotal: With the prior consent of the DID holders, I have successfully ported peoples' numbers using nothing more than a JPG scan of a signature that looks like an illegible 150 dpi black and white blob, pasted in an image editor on top of a generic
looking 'phone bill'. <br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</body>
</html>