Many people are becoming aware of enhanced security measures taken by banking, internet, email and other institutions. Commonly known as “two-factor authentication” or 2FA, the user has a choice of receiving the one time PIN or password by text message or on an app loaded on the phone, known as an authenticator. Another less common format is a security token that can be kept with the user; the token generates a PIN number randomly usually every minute.
Having your email hacked or bank account drained can be daunting for anyone, but for those of us who travel having this happen while you are in a foreign country or on an airplane with not internet access poses another problem and can easily ruin a trip.
If I have 2FA enabled, I’m safe, right?
In short, no, or maybe. The answer is a bit complicated. It really depends on HOW you have enabled 2FA. If you use your text messaging or SMS to receive your code you are vulnerable. Why? Read on…
Why is 2FA via text messaging or SMS not secure?
To fully understand why we have to look a little deeper and explain how cellular networks work. Specifically we have to understand how cellular networks are connected and why they need to be connected. Because networks pass information such as text messages, billing information, roaming information and other data a connection called SS7 exists. This network has been vulnerable to hacks and outside access for a long time. Without getting very technical once someone has access to the SS7 network, your cellular movement, calls, and texts are easily accessible. The text messages sent and received are not encrypted over SS7, so a hacker can read them. If they have access to your messages, they can see any message, including PIN numbers from your bank, internet provider, email service, etc. For more information and an example watch the video below.
https://youtu.be/-pEcTv3kX74
