And SMS messages can be intercepted. Not a good option, use physical security keys instead!
Even authenticator apps are generally better than SMS.
One thing no one talks about with SMS verifications, though, is that it frequently confirms your phone number to the business you're giving it to. If they're in the habit of trading user data, this makes the data much more valuable. I think this is the real reason for many businesses that push for it, when normally they could hardly care less about user security.
Seriously, while 2FA via SMS is generally much better than nothing, it has zero security so might even make things worse in some cases by providing a false sense of security!
RCS messages are encrypted using TLS.
RCS isn't SMS though, nobody mentioned RCS!
RCS is a replacement for SMS, used by the majority of mobile carriers in Europe, Northern America, and Asia. It is used by default in all supported regions.
I know what it is, but it's got nothing to do with this discussion. What company provides 2FA codes via RCS instead of SMS?
Most of them do, because as you have noted before, SMS protocol is not secure.
Do they? I've never seen this as an option. In fact, I've never even seen RCS mentioned anywhere outside Android enthusiast forums!
It's not surprising if you haven't come across the rollout of RCS. Google developed this feature as a replacement for the less secure SMS standards and aimed for a seamless implementation without causing user disruptions. This could be a rare instance where we commend Google for a change that benefits users, not just their bottom line.
Except there's still very little support for it as they haven't opened up the protocol for people to actually write clients to use it
And it appears Apple isn't on board, and since the vast majority of my text messages go to my wife on her iPhone, it's largely useless for me.
I'm also considering moving to a Linux phone (PinePhone), which I assume also won't be able to use this. So it's a nice gesture, but ultimately has limited impact.
And SMS messages can be intercepted. Not a good option, use physical security keys instead!
Even authenticator apps are generally better than SMS.
One thing no one talks about with SMS verifications, though, is that it frequently confirms your phone number to the business you're giving it to. If they're in the habit of trading user data, this makes the data much more valuable. I think this is the real reason for many businesses that push for it, when normally they could hardly care less about user security.
Seriously, while 2FA via SMS is generally much better than nothing, it has zero security so might even make things worse in some cases by providing a false sense of security!
RCS messages are encrypted using TLS.
RCS isn't SMS though, nobody mentioned RCS!
RCS is a replacement for SMS, used by the majority of mobile carriers in Europe, Northern America, and Asia. It is used by default in all supported regions.
I know what it is, but it's got nothing to do with this discussion. What company provides 2FA codes via RCS instead of SMS?
Most of them do, because as you have noted before, SMS protocol is not secure.
Do they? I've never seen this as an option. In fact, I've never even seen RCS mentioned anywhere outside Android enthusiast forums!
It's not surprising if you haven't come across the rollout of RCS. Google developed this feature as a replacement for the less secure SMS standards and aimed for a seamless implementation without causing user disruptions. This could be a rare instance where we commend Google for a change that benefits users, not just their bottom line.
Except there's still very little support for it as they haven't opened up the protocol for people to actually write clients to use it
And it appears Apple isn't on board, and since the vast majority of my text messages go to my wife on her iPhone, it's largely useless for me.
I'm also considering moving to a Linux phone (PinePhone), which I assume also won't be able to use this. So it's a nice gesture, but ultimately has limited impact.
Only if you have the access to the same mast, otherwise no. This vastly reduces the number of attack vectors.