Multifactor auth done right

chris@l.roofo.cc to Programmer Humor@programming.dev – 455 points –
21

Wow would you look at that, still none of them cover what SMS is >:( Almost like it's not a second factor, and fuck every corporation that tries to claim that it is

SMS is something you have, IE access to your phone. Doesn't mean it's the best option, SMS is notorious for being insecure

The 10,000 support staff with dubious social engineering training at your service provider are not "something you have". Case in point literally a few weeks ago https://arstechnica.com/tech-policy/2023/12/verizon-fell-for-fake-search-warrant-gave-victims-phone-data-to-stalker/

This is an article describing someone impersonating an officer and submitting a fake warrant. It's incredible that Verizon fell for it, but what does it have to do with SMS?

It means that if I want access to something that has been texted to you, I don't exactly need to be a government in order to get it.

1 more...
1 more...
1 more...

It would be fine if it weren’t for sim swapping.

But try asking anyone at your bank about a yubikey and watch them stare at you like you have broccoli growing out of your ears.

1 more...

Something random as fuck like what hand your married to and when you broke up with your hand and married your other hand

Now I want to go play Cultist Simulator or Book of Hours. This list is also a list of the sorts of cards the games use to represent the narrative/puzzle you're playing through. Highly recommend.

Something you only know in a parallel dimension.