Content deleted Content added
The statement, "[2FA] is a technology... that provides identification of users..." is inaccurate. 2FA is a method of AUTHENTICATING a user (or claimed ID). A userID is an example of identification. IDs can be provided by a user or an admin. |
→Mobile phone two-factor authentication: SIM-cloning and wiretapping |
||
Line 21:
Mobile phone two-factor authentication was developed to provide an alternative method that would avoid such issues. This approach uses mobile devices such as mobile phones and smartphones to serve as "something that the user possesses". If users want to authenticate themselves, they can use their personal access license (i.e. something that only the individual user knows) plus a one-time-valid, dynamic passcode consisting of digits. The code can be sent to their mobile device by [[SMS]] or via a special app. The advantage of this method is that there is no need for an additional, dedicated token, as users tend to carry their mobile devices around at all times anyway. Some professional two-factor authentication solutions also ensure that there is always a valid passcode available for users. If the user has already used a sequence of digits (passcode), this is automatically deleted and the system sends a new code to the mobile device. And if the new code is not entered within a specified time limit, the system automatically replaces it. This ensures that no old, already used codes are left on mobile devices. For added security, it is possible to specify how many incorrect entries are permitted before the system blocks access.
Security of the mobile-delivered security tokens fully depends on the mobile operator's operational security and can be easily breached by wiretapping or [[SIM cloning|SIM-cloning]] by national security agencies.<ref>{{Cite web|url=https://www.bellingcat.com/news/2016/04/30/russia-telegram-hack/|title=How Russia Works on Intercepting Messaging Apps - bellingcat|date=2016-04-30|website=bellingcat|language=en-US|access-date=2016-04-30}}</ref>
'''Advantages of mobile phone two-factor authentication:'''
| |||