The Limits of SMS for 2-Factor Authentication
Summary: A reader's daughter with Gmail two-factor authentication enabled received a text message posing as Google, warning of a login attempt from India and instructing her to reply with the 6-digit verification code that Google would text her. The scammers already had her password, likely from password reuse tied to the 2012 LinkedIn breach, and could trigger Google to send the code on demand by attempting a login, so the code was the only barrier to account takeover.
Bottom line: NIST's proposed digital authentication guidelines urge organizations to favor other forms of two-factor authentication, such as app-generated time-based one-time passwords, over text messaging, which is sent in plain text and makes the sender difficult to verify. Dropbox's head of security told KrebsOnSecurity that less than one percent of its 500 million registered users had enabled two-factor authentication, four years after the company began offering it.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026