Assurance

[Von Welch <>]

> telephony < soft tokens < hard tokens

Why are "soft tokens" - which I interpret as mobile app based approaches - 
stronger than SMS?

Is the inter-application separation stronger such that it is  harder for a 
trojan to scrape SMS messages than data from another App? How much harder and 
how long before we expect that to fail? 

Thanks,

Von


On Jul 24, 2014, at 8:23 AM, Tom Scavo 
<>
 wrote:

> You may have heard this news about attacks on SMS-based 2FA at banks
> around the world:
> 
> https://twitter.com/trscavo/status/492079055647559681
> 
> It's becoming clear that 2FA methods based on telephony, while better
> than no 2FA at all, are less effective than other methods. The
> relative strength of authentication probably goes something like this:
> 
> telephony < soft tokens < hard tokens
> 
> but that would require further justification.
> 
> Tom