2FA2Furious: New Threats to MFA
summary
Shows that a new attack called SMS pumping drives fake OTP traffic through weak carriers, costing platforms millions (Twitter reports ~$60M/year) while breaches expose 12.9 billion email/password combos. Recommends concrete defenses: measure OTP conversion rates and country/prefix spikes, maintain carrier allow/block lists, enforce rate limits and backend retry counters with TTL, use bot detection and number-lookup services, diversify to WhatsApp/email/authenticator apps, and adopt carrier-based silent network authentication or a provider solution like Twilio Verify fraud guard.
AI-written summary · about
chapters (20)
- 0:00Welcome
- 1:12Background on 2FA
- 6:09Security vulnerabilities
- 7:33Password breaches and 2FA
- 10:24New threats to 2FA
- 11:47SMS pumping explained
- 14:18Twitter’s response
- 15:22Detecting SMS pumping
- 17:30Mitigating SMS pumping
- 19:37Diversifying 2FA channels
- 21:04Silent Network authentication
- 22:51Authenticator apps trade-offs
- 26:00Usability vs security in 2FA
- 27:04Bank security model
- 31:59Flexible 2FA verification
- 33:45Frontend 2FA recommendations
- 37:41Backend 2FA security
- 42:12Offloading 2FA
- 43:39Further resources
- 44:24Q&A
