Why using SMS in the authentication chain is risky
summary
Argues that SMS-based OTPs are insecure because of SS7 vulnerabilities and real-world SIM swapping incidents, demonstrates push-notification flows using Apple/Google services and a Twilio/Authy-style API, compares alternatives like TOTP apps and hardware/FIDO keys, and shows a working push demo that succeeds and sometimes times out when cellular or Wi‑Fi fails. Gives concrete failure modes, attack examples, deployment tradeoffs, and practical fallback recommendations.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:41About Me
- 1:55Clarification...
- 2:48History
- 7:16Not designed for security use
- 11:13Specific threats
- 20:53Alternatives
- 23:58Push what now?
- 27:28Who's doing Push?
- 38:06Demo
- 43:17Bye bye SMS for 2FA?
- 44:28Already built SMS?
- 46:54In Summary
