When SMS and voice protocols were developed, they were designed without encryption.
Unfortunately, the SMS and voice formats aren’t adaptable, so the experiences and opportunities for innovations in usability and security are very limited. One of the significant advantages of services is that we can adapt to user experience expectations, technical advances, and attacker behavior in real-time. Your PSTN account has all the vulnerabilities of every other authenticator and a host of other issues specific to PSTN.īecause so many devices rely on receiving PSTN messages, the format of the messages is limited – we can’t make the messages richer, or longer, or do much of anything beyond sending the OTP in a short text message or a phone call. It’s worth noting that every mechanism to exploit a credential can be used on PSTN – OTP. Use of anything beyond the password significantly increases the costs for attackers, which is why the rate of compromise of accounts using any type of MFA is less than 0.1% of the general population.” Quoting an earlier blog, “Multi-factor Authentication (MFA) is the least you can do if you are at all serious about protecting your accounts. It bears repeating, however, that MFA is essential – we are discussing which MFA method to use, not whether to use MFA. Plan your move to passwordless strong auth now – the authenticator app provides an immediate and evolving option. That gap will only widen as MFA adoption increases attackers’ interest in breaking these methods and purpose-built authenticators extend their security and usability advantages. These mechanisms are based on publicly switched telephone networks (PSTN), and I believe they’re the least secure of the MFA methods available today. Today, I want to do what I can to convince you that it’s time to start your move away from the SMS and voice Multi-Factor Authentication (MFA) mechanisms. In my blog Your Pa$$word doesn't matter, I laid out the key password vulnerabilities, and in response to a gazillion “but other creds can be compromised, too” DMs and emails, I wrote All our creds are belong to us, where I outlined vulnerabilities in credentials other than passwords and highlighted the promise of passwordless, cryptographically protected creds like FIDO, Windows Hello, and the Authenticator App.
0 kommentar(er)
