Two-factor authentication – a mechanism meant to verify ownership of an account via a text message to the account owner’s phone – has been compromised

For years, experts have advised account holders to implement two-factor authentication for critical applications such as banking and social media, to prevent the hijacking of accounts even when passwords have been compromised.  Recently, a long-standing flaw in the way text messages are transmitted has been used to circumvent two-factor authentication.

In order for the compromise to work, the attacker must know a person’s username and password (details which may have been obtained by a security breach or other method) as well as the person’s mobile phone number.  Using a special device, which can be purchased over the internet, the attacker can intercept the text message used to authenticate the login – thereby gaining the authority to access accounts.

Apparently, this flaw in the telecommunication protocols is so expensive to fix, it has basically been ignored.  However, for all practical purposes, unless you are a “high-worth” target (in terms of financial or intelligence value), you are probably not at risk.  Nevertheless, the technology is out there.

Two-factor authentication that relies on phone apps (as opposed to text messages) is not compromised, as communication through an app is typically encrypted.  If you are offered the opportunity to use two-factor authentication through an app, that is definitely the way to go.

Jack Eisenberg is the owner of Safe and Secure Computing and regularly monitors cyber security developments such as this one.