cross-posted from: https://lemmy.ml/post/46348914

TIL your phone apparently does no or easily spoofed authentication of the identity of the base station it decides to connect to. Anyone know more about this and how it’s possible?

    • Reannlegge@lemmy.ca
      link
      fedilink
      arrow-up
      4
      ·
      2 days ago

      A few years ago all banks were supposed to move to that, I was so unhappy with that. I sent so many emails to my back bencher do nothing MP the heads of the financial institutions I was using complaining about this saying how easy it was to spoof text messages or high jack peoples numbers, I considered doing some of the spoofing to them but decided better not.

      Yesterday, or the day before, my Credit Union started offering TOTP I was so giddy and excited! I figured out how to add all my keys that I was using in Raivo, because the app has sorta gone to poop town, onto my self hosted Vaultlocker. You cannot believe how happy I was today the first time I needed to use one of those numbers and I was able to open up Bitlocker on my phone and use the number today.

      My place flooded so a little more than half of my one level is to the sub floor my office has a lot off “stuff” stuff into it and I have been living out of my bedroom, home labing went from a hobby to something to keep me sane.

    • HiddenLayer555@lemmy.mlOP
      link
      fedilink
      English
      arrow-up
      8
      ·
      edit-2
      2 days ago

      TOTP is both more secure and cheaper to implement since you don’t have to pay for text messages or directly communicate with the 2FA device in general. Honestly whenever some obsecure app or website demands my phone number as the only 2FA option I immediately assume it’s a front to get my phone number for data brokerage. Like no way does a random online game or something care so much about security to demand 2FA but then proceed to choose the least secure and hardest to implement option. There’s another reason.