FlyerTalk Forums - View Single Post - AM: Mobile number OTP commencing 16 Apr (mandatory 16 Jun)
Old May 12, 2018 | 3:00 pm
  #45  
percysmith
Ambassador, Hong Kong and Macau
Community Builder
Community Influencer
All eyes on you!
15 Years on Site
 
Join Date: May 2009
Location: HKG
Programs: Non-top tier Asia Miles member
Posts: 22,004
Originally Posted by hillrider
SMS is a very poor way and an insecure one to deliver two factor authentication, with very well known and easily exploitable vulnerabilities. Even the US National Institute of Standards and Technology's (NIST) discourages its use.

See a demo of exploiting SMS's insecurities to empty someone's bitcoin wallet at https://www.youtube.com/watch?v=mLh1Nmqa6OM

In addition, as most have pointed out here, SMS travels extremely poorly and does not work when you have multiple local SIMs (which is the preferred way to travel as a local) or when your phone is lost or stolen, which usually is when you need to access your accounts the most.

Two factor authentication over e-mail, if implemented by the vendor with TLS authentication, is secure. SMS never is. Email also has the advantage of being universally accessible, even in remote places where mobile phones don't work or your provider lacks roaming agreements (as long as you have internet access).

Resist CX's "offer" to send you SMS; if too many people don't do it, they will have no choice but to look into implementing better, and more secure, methods.
App-based token next. Given AM's lack of technical competence I expect another lockout
percysmith is online now