Assurance

["Caskey, Paul" <>]

I would not throw all telephony-based MFA under the bus along with SMS...

A crypto-based solution would not suffer from these problems.



> -----Original Message-----
> From: 
> 
>  
> [mailto:]
>  On Behalf Of Tom
> Scavo
> Sent: Thursday, July 24, 2014 7:24 AM
> To: 
> 
> Subject: [Assurance] attacks on SMS-based 2FA
> 
> You may have heard this news about attacks on SMS-based 2FA at banks
> around the world:
> 
> https://twitter.com/trscavo/status/492079055647559681
> 
> It's becoming clear that 2FA methods based on telephony, while better than
> no 2FA at all, are less effective than other methods. The relative strength 
> of
> authentication probably goes something like this:
> 
> telephony < soft tokens < hard tokens
> 
> but that would require further justification.
> 
> Tom