Of course it’s avoidable! Phone spoofing has been known to be a vulnerability for years, yet so many companies still insist on using SMS for 2FA “for security”. ffs, if you are concerned about security, use a proper TOTP or HOTP, or a hardware token.
I think the fault lies squarely in the hands of telcos. They're meant to send you an SMS or call you to confirm any port before it happens. If they're not following those rules they should be held liable.
On another note I wish banks and other financial institutions would provide other 2FA options in addition to SMS. It's just crazy that I have better security tech on my Steam account than my bank account.
but they call and pretend to be you and get the number ported to the SIM they have
check out the Hot Swaps episode of Darknet Diaries
It's funny in a sad way that 2FA was supposed to be real secure but like all other security, the human element is the biggest weak point, and the custodians of it (telcos) are asleep behind the wheel.
2FA works. It is supposed to be something you know (password) and something you control (like a secure hardware key or app). The problem is people don't control their phone numbers, the telcos do.
It's worth noting that 2FA is still a security improvement. Using SMS for 2FA doesn't introduce any vulnerabilities compared to no 2FA. It's just not nearly as good as doing 2FA using a TOTP app or dongle. Or using hardware security tokens like FIDO2.
Unless the "2FA" channel is what they use to verify password resets.
Sure, but that's separate from 2FA and is pretty common even in places that don't offer any 2FA.
A place to discuss Australia and important Australian issues.
If you're posting anything related to:
If you're posting Australian News (not opinion or discussion pieces) post it to Australian News
This community is run under the rules of aussie.zone. In addition to those rules:
Congratulations to @[email protected] who had the most upvoted submission to our banner photo competition
Be sure to check out and subscribe to our related communities on aussie.zone:
https://aussie.zone/communities
Since Kbin doesn't show Lemmy Moderators, I'll list them here. Also note that Kbin does not distinguish moderator comments.
Additionally, we have our instance admins: @[email protected] and @[email protected]