Avatar

brie

brie@programming.dev
Joined
0 posts • 24 comments
Direct message

Not true. SMS is encrypted in 3G, LTE, 5G. Block cyphers like Kasumi and A/9 are used. SMS is reasonably secure, because it’s hard to infiltrate telecom systems like S7

permalink
report
parent
reply

S7 will be retired or extended with access control. TOTP apps don’t work for edge cases like broken phone. Dedicated token devices get lost. SMS will continue being the main solution for 2FA.

permalink
report
parent
reply

Simply paying is not sufficient. You need to be a telecom company, or a researcher afaik.

In what world would the US gov care to get into your bank account? Or your Facebook account when it’s already tightly controlled?

permalink
report
parent
reply

Is it more effective than feeding them via TikTok, Twitter, Instagram?

permalink
report
parent
reply

Watch the video again to see how hard it was for Derrick to get access. He got it via his telecom/academia researcher contact.

permalink
report
parent
reply

Pedantic types always mention that secure is only relevant in the context of a particular threat model. The elderly can use hardware authentication like those RSA devices or ubikey. Unfortunately, this is expensive, and banks don’t believe there’s demand for that. Would you switch banks for this feature?

permalink
report
parent
reply

With current kWh/token it’s 100x of a regular google search query. That’s where the environmental meme came from. Also, Nvidia plans to manufacture enough chips to require global electricity production to increase by 20-30%.

permalink
report
parent
reply

AGI or human level intelligence has a hardware problem. Fabs are not going to be autonomous within 20 years. Novel lithography and cleaning methods are difficult for large groups of humans. LLMs do not provide much assistance in semiconductor design. We are not even remotely close to manufacturing the infrastructure necessary to run human level intelligence software.

permalink
report
parent
reply

Yes, you can have multiple devices with the same seed for the pseudorandom number generator. You can turn any computer into a hardware authenticator. In practice, it depends on the bank or your employer. Google reduced phishing success rate to zero after switching to ubikey.

As for perception, you really nailed it. It’s more important than actual difficulty of gaining access to your accounts. Remember that most articles are written by low skill blue teamers who manipulate your perception into thinking it’s really easy while they don’t possess the skills to do it. Always call them out in a manner like “you claim it’s easy, have you done it?”. They will always say no.

permalink
report
parent
reply