Re: Codes sent by text message

On 2024-03-12 23:32, VanguardLH wrote:

"Carlos E.R." <robin_listas@es.invalid> wrote:
 

VanguardLH wrote:
>

Weren't some Europeans charged and fined for pretending to be someone
else's phone through SIM card swap they foisted on the carrier?

>
SIM swap attack is a thing, yes. They can thus receive verification
SMSs, but probably not banking app messages.

 My bank has apps for Android and iOS, but not for Windows where they
expect me to login via web browser.  They have apps for Android and iOS,
but I'll have to ask them if those use TOTP.  I doubt they will know nor
know who to pass my inquiry.
 I resist putting a bank app on my smartphone.  Anyone that has physical
access could get into my account using the .  My banks app says "Secure
your account with a 4-digit passcode or biometric on supported devices."
Sure wish the PIN were longer, like at least 8 digits, and more like a
password where I can use alphanumeric characters, capitalization, and
non-alphanumeric characters.  Or to use both a PIN *and* biometrics
(fingerprint sensor).

Normally the pin only allows "read" access, for operations there is some other authorization.

 

Maybe if all computers had biometric input (camera for eyes and
sensor for fingers and mic for voice) then the verification really
would be to a person, not the expectation of a device or service to
which that person -- or someone else -- has access.  Phones and
laptops have those bio devices (well, maybe not all have finger
sensors), but only a fraction of desktops have even 2 of them.

>
Most recent laptops have finger print sensors and cameras. But I don't
have software that uses the former (nor the later, for purposes of
ID).

 My desktop is not a laptop.  No camera, no mic (until I plug in the USB
headset), and no fingerprint sensor.  I'd have to buy those, but then my
bank could care less as they want me using their phone app (not usable
on my desktop) or the Symantec VIP authenticator (since Authy is soon
dropping their desktop app).

Certainly, for 2FA they want a mobile phone, not a computer. And a non rooted phone as that.
--
Cheers, Carlos.