▲ 644 ▼ Feds Warn SMS Authentication Is Unsafe After ‘Worst Hack in Our Nation’s History’ (gizmodo.com) submitted 2 years ago by return2ozma@lemmy.world to c/technology@lemmy.world 158 comments fedilink hide all child comments
[–] frostysauce@lemmy.world 2 points 2 years ago (5 children) Wait, how is email more secure than SMS? permalink fedilink source parent hideshow 5 child comments replies: [–] Screen_Shatter@lemmy.world 3 points 2 years ago (4 children) https://en.m.wikipedia.org/wiki/SMS_spoofing So, it's not that the message itself is insecure, but the inability to verify the sender makes phishing attacks possible or similar things. I get a text from a random number saying "click this link to pay your bill!" And I don't have any way to trust its legit. SIM swaps make it so people can take over your phone number temporarily and then generate 2fa requests to gain access to accounts. Doing the swap usually involves bribing someone or gaining access to a providers database by other means, but its been done a lot. There are ways to prevent this, but the most straight forward is using a MFA app. Barring that 2FA via email is the next best thing. permalink fedilink source parent hideshow 4 child comments replies: [–] frostysauce@lemmy.world 2 points 2 years ago (3 children) Forgive my ignorance, aren't emails sent in plain text that can be read by any of the networks they are passed between? I've always been taught email is the least secure of any communication. permalink fedilink source parent hideshow 3 child comments replies: [–] Screen_Shatter@lemmy.world 3 points 2 years ago (2 children) I'm not a security expert so my ability to explain is limited, but no, emails have long used encryption protocols like SSL to prevent such problems. However, your email provider may scan and read your emails. That's not much different than a text message service reading those messages, but you can choose your provider. From what I can tell proton.me is the way to go for resolving that issue - they provide encryption which prevents their own machines and employees from being able to read your messages and other data. Otherwise, your email is basically as secure as your passwords are. permalink fedilink source parent hideshow 2 child comments replies: [–] frostysauce@lemmy.world 2 points 2 years ago (1 child) OK, I had no idea what I was talking about, lol. Thanks for responding! permalink fedilink source parent hideshow 1 child comment replies: [–] Screen_Shatter@lemmy.world 2 points 2 years ago No prob, this stuff is difficult to keep up with. I'm still always learning and hoping I'm doing it right permalink fedilink source parent
[–] Screen_Shatter@lemmy.world 3 points 2 years ago (4 children) https://en.m.wikipedia.org/wiki/SMS_spoofing So, it's not that the message itself is insecure, but the inability to verify the sender makes phishing attacks possible or similar things. I get a text from a random number saying "click this link to pay your bill!" And I don't have any way to trust its legit. SIM swaps make it so people can take over your phone number temporarily and then generate 2fa requests to gain access to accounts. Doing the swap usually involves bribing someone or gaining access to a providers database by other means, but its been done a lot. There are ways to prevent this, but the most straight forward is using a MFA app. Barring that 2FA via email is the next best thing. permalink fedilink source parent hideshow 4 child comments replies: [–] frostysauce@lemmy.world 2 points 2 years ago (3 children) Forgive my ignorance, aren't emails sent in plain text that can be read by any of the networks they are passed between? I've always been taught email is the least secure of any communication. permalink fedilink source parent hideshow 3 child comments replies: [–] Screen_Shatter@lemmy.world 3 points 2 years ago (2 children) I'm not a security expert so my ability to explain is limited, but no, emails have long used encryption protocols like SSL to prevent such problems. However, your email provider may scan and read your emails. That's not much different than a text message service reading those messages, but you can choose your provider. From what I can tell proton.me is the way to go for resolving that issue - they provide encryption which prevents their own machines and employees from being able to read your messages and other data. Otherwise, your email is basically as secure as your passwords are. permalink fedilink source parent hideshow 2 child comments replies: [–] frostysauce@lemmy.world 2 points 2 years ago (1 child) OK, I had no idea what I was talking about, lol. Thanks for responding! permalink fedilink source parent hideshow 1 child comment replies: [–] Screen_Shatter@lemmy.world 2 points 2 years ago No prob, this stuff is difficult to keep up with. I'm still always learning and hoping I'm doing it right permalink fedilink source parent
[–] frostysauce@lemmy.world 2 points 2 years ago (3 children) Forgive my ignorance, aren't emails sent in plain text that can be read by any of the networks they are passed between? I've always been taught email is the least secure of any communication. permalink fedilink source parent hideshow 3 child comments replies: [–] Screen_Shatter@lemmy.world 3 points 2 years ago (2 children) I'm not a security expert so my ability to explain is limited, but no, emails have long used encryption protocols like SSL to prevent such problems. However, your email provider may scan and read your emails. That's not much different than a text message service reading those messages, but you can choose your provider. From what I can tell proton.me is the way to go for resolving that issue - they provide encryption which prevents their own machines and employees from being able to read your messages and other data. Otherwise, your email is basically as secure as your passwords are. permalink fedilink source parent hideshow 2 child comments replies: [–] frostysauce@lemmy.world 2 points 2 years ago (1 child) OK, I had no idea what I was talking about, lol. Thanks for responding! permalink fedilink source parent hideshow 1 child comment replies: [–] Screen_Shatter@lemmy.world 2 points 2 years ago No prob, this stuff is difficult to keep up with. I'm still always learning and hoping I'm doing it right permalink fedilink source parent
[–] Screen_Shatter@lemmy.world 3 points 2 years ago (2 children) I'm not a security expert so my ability to explain is limited, but no, emails have long used encryption protocols like SSL to prevent such problems. However, your email provider may scan and read your emails. That's not much different than a text message service reading those messages, but you can choose your provider. From what I can tell proton.me is the way to go for resolving that issue - they provide encryption which prevents their own machines and employees from being able to read your messages and other data. Otherwise, your email is basically as secure as your passwords are. permalink fedilink source parent hideshow 2 child comments replies: [–] frostysauce@lemmy.world 2 points 2 years ago (1 child) OK, I had no idea what I was talking about, lol. Thanks for responding! permalink fedilink source parent hideshow 1 child comment replies: [–] Screen_Shatter@lemmy.world 2 points 2 years ago No prob, this stuff is difficult to keep up with. I'm still always learning and hoping I'm doing it right permalink fedilink source parent
[–] frostysauce@lemmy.world 2 points 2 years ago (1 child) OK, I had no idea what I was talking about, lol. Thanks for responding! permalink fedilink source parent hideshow 1 child comment replies: [–] Screen_Shatter@lemmy.world 2 points 2 years ago No prob, this stuff is difficult to keep up with. I'm still always learning and hoping I'm doing it right permalink fedilink source parent
[–] Screen_Shatter@lemmy.world 2 points 2 years ago No prob, this stuff is difficult to keep up with. I'm still always learning and hoping I'm doing it right permalink fedilink source parent