Authentication Beyond SMS

on YouTube ↗25m

" summary

Passwords and SMS 2FA are often bypassed: carriers’ SS7 handoffs and SIM swap attacks let attackers intercept codes, and Reddit’s Aug 1 incident shows SMS-based 2FA can be defeated for employee cloud/git access. Alternatives actually used: hardware U2F keys (Google stops employee hacks), push auth (Duo/Authy public‑key flow), TOTP apps (Google Authenticator/Authy), and encrypted messaging (WhatsApp) as token channels. Twilio prototypes an app+contact‑center shared token flow. Measure reduced account takeover losses, support cost, and customer satisfaction before switching.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to authentication
2. 1:46Trust anchors in identity
3. 5:39Why SMS 2FA is popular
4. 7:25Risks of SMS vulnerabilities
5. 10:35Alternatives to SMS 2FA
6. 15:49Reddit breach case study
7. 17:56Tailoring MFA to user value
8. 20:08Contact center authentication flaws
9. 22:12Measuring MFA effectiveness
10. 23:37Balancing security and usability

" related talks

• 50mA tale of two sides of 2FAChristine Seeman · NDC London 2020
• 24m2FA in 2020 and BeyondKelley Robinson · BSidesSF 2020
• 17m2FA in 2020 & BeyondKelley Robinson · GOTO Chicago 2020
• 50mOne Does Not Simply Add MFAChristine Seeman · YOW! Melbourne 2022
• 24mTwo Factor FailureRyan Lackey · Black Hat Europe 2014
• 48m2FA2Furious: New Threats to MFANathaniel Okenwa · NDC London 2024
• 39m2FA, WTF?Phil Nash · Codemotion Amsterdam 2016
• 01h 02mWhy using SMS in the authentication chain is riskySimon Thorpe · AppSecUSA 2016