I mention Dorsey because his Twitter account was hijacked thanks to a SIM swap attack. So, if you're say, Jack Dorsey, Twitter's CEO, or have someone who's technically adept as an enemy then you want more than text-based 2FA. But, each requires real effort from a would-be attacker. Yes, there are at least three different, effective methods to bust text-based 2FA. There's SIM swapping, text-spoofing, SMS phishing (aka smishing), and security holes in the SS7 network, which telecoms use to manage calls and texts between phone numbers.īut, here's where I differ from most security experts, for most users most of the time, these methods will work just fine. That's because there are way too many ways to break text-based 2FA. Many security experts think you should stop using text-based 2FA altogether. Indeed, the National Institute of Standards and Technology (NIST) says using text-based 2FA is risky. But, the way they're implemented, which is most often in text-based 2FA, that's another matter. Phone-based 2FA typically relies on one of two standards: HMAC-based One Time Password (HOTP) and Time-based One Time Password (TOTP). Something you are, these are biometric factors such as a fingerprint, retinal scan, or voice print.Something you have, such as a secure ID card, a cellular phone, or a hardware security key.Something you know or can be given, this is commonly a one-time PIN.With 2FA you must have two out of three kinds of credentials to access an account. So, while personally you might be happy to use texting for your Facebook account, professionally, you'll be better off using a more sophisticated 2FA for your Microsoft 365 or Google Workspace. Doesn't every social network and business with an even pretense of caring about security use 2FA where the second factor is a six-digit number sent to your cell phone number? Well, while using a smartphone for 2FA is OK, a really determined adversary can intercept your smartphone 2FA traffic.

It's time, well past time, to say good-bye to simple passwords and move to two-factor authentication (2FA) for all our security and Identity and Access Management (IAM) needs. Worse was a company that ever allowed an intern to set such a password. The SolarWinds security fiasco, which Microsoft president Brad Smith described as 'the largest and most sophisticated attack the world has ever seen,' may have begun, suggested former SolarWinds CEO Kevin Thompson when an intern first set an important password to ''solarwinds123' and then shared it on GitHub.

U2f aws