Assurance

["Farmer, Jacob" <>]

Tom,

This is certainly in interesting attack and I agree with the premise that 
SMS-based MFA is less secure than other forms of tokens.

However, this attack still requires that the endpoint be compromised, and as 
long as that happens, I don't think that all the MFA in the world will help.

Jacob

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Tom Scavo
Sent: Thursday, July 24, 2014 8:24 AM
To: 

Subject: [Assurance] attacks on SMS-based 2FA

You may have heard this news about attacks on SMS-based 2FA at banks around 
the world:

https://twitter.com/trscavo/status/492079055647559681

It's becoming clear that 2FA methods based on telephony, while better than no 
2FA at all, are less effective than other methods. The relative strength of 
authentication probably goes something like this:

telephony < soft tokens < hard tokens

but that would require further justification.

Tom