<story><title>Companies embracing SMS for account logins should be blamed for SIM-swap attacks</title><url>https://keydiscussions.com/2024/02/05/sim-swap-attacks-can-be-blamed-on-companies-embracing-sms-based-password-resets/</url></story><parent_chain><item><author>rlt</author><text>&amp;gt; we just had TOTP codes that 1password could auto fill for me on any device in any location&lt;p&gt;Doesn’t using your password manager as TOTP code generator reduce the number of factors back to 1?</text></item><item><author>zaptheimpaler</author><text>Before this new wave of SMS trash, we just had TOTP codes that 1password could auto fill for me on any device in any location. Now i need to pull out my phone constantly and pay for international roaming or setup SMS forwarding to travel even if I don&amp;#x27;t need the number. Yay security!&lt;p&gt;If the argument is that phone number can always be recovered from real world identity, link the damn authenticator app to SMS instead of having to hand out your phone number to every company in the world.</text></item></parent_chain><comment><author>artimaeis</author><text>If the attacker is targeting your 1P, then yes.&lt;p&gt;If the attacker got a list of passwords from a leak and your password was on it, the 2nd factor provided by the TOTP will still save you.&lt;p&gt;So, it just depends on your threat vectors. I’d rather people I support keep unique passwords alongside TOTP in a manager they’ll actually use than skip or use SMS TOTP because of a vague concern about targeted hacking of their manager.</text></comment>
<story><title>Companies embracing SMS for account logins should be blamed for SIM-swap attacks</title><url>https://keydiscussions.com/2024/02/05/sim-swap-attacks-can-be-blamed-on-companies-embracing-sms-based-password-resets/</url></story><parent_chain><item><author>rlt</author><text>&amp;gt; we just had TOTP codes that 1password could auto fill for me on any device in any location&lt;p&gt;Doesn’t using your password manager as TOTP code generator reduce the number of factors back to 1?</text></item><item><author>zaptheimpaler</author><text>Before this new wave of SMS trash, we just had TOTP codes that 1password could auto fill for me on any device in any location. Now i need to pull out my phone constantly and pay for international roaming or setup SMS forwarding to travel even if I don&amp;#x27;t need the number. Yay security!&lt;p&gt;If the argument is that phone number can always be recovered from real world identity, link the damn authenticator app to SMS instead of having to hand out your phone number to every company in the world.</text></item></parent_chain><comment><author>klempner</author><text>In practice the only widespread attack that either TOTP or SMS authentication help with is credential stuffing, and if you use a password manager to use unique passwords on each site you&amp;#x27;re not susceptible to credential stuffing to begin with.</text></comment>