FBI warns against using two-factor text authentication | Morning in America

[@gs8527]

How about laws that prohibit businesses from selling our personal data? Why does every scammer out there has our phone numbers?

[@mannycp]

Vizio makes more money from selling personal data then selling tvs . Walmart owns Vizio now

[@taramcdonough3599]

OUR own Govt is collecting all citizens data with these "hacks'. Think about who hit--ler had spies collecting data on citizens...same same just easier for the govt to use the internet data hacks these days to get data on everyone. Its all part of the future e^il "social credit system" that is coming world wide including the US which will "allow" or "not allow" you to buy, sell, travel etc. Its already in Commie China. WAKE UP. ch tim truth, The healthy american peggy hall etc have info.

[@DevilDogZak]

Sounds like they don’t like 2 factor authentication with how hard of a time they have getting into modern phones like Apple. Yah stop using 2 factor authentication sounds suspicious

[@gostfalcon]

Nice try AI. Per google, AI-generated anchors to debut on Channel 1 in 2024... Look at the mouth it's clearly fake...

[@Ryan_Christopher]

@@DevilDogZakThey're warning against TFA by TEXT, not TFA per se. You can use a SECURE Authenticator App that generates the proper codes for whatever site you're trying to log into. Facebook, Amazon, Lastpass, Microsoft Live, Google? I haven't used Text-based TFA for those in years. Instead I use Microsoft Authenticator. I know Marines can't read but damn.

[@PhrontDoor]

Stop warning USERS. Warn the telecom and device makers to STOP using unencrypted methods.

[@LimitedWard]

The device makers already offer better more secure alternatives. The problem is that both users and websites refuse to switch to them. Using an authenticator app like Google Authenticator, Authy, Aegis, etc. are significantly more secure than SMS authentication because the one-time passwords are generated directly on your phone. Even better, use Passkeys are hardware security keys (like Yubikeys) if the website supports it. They are the industry standard best practice since they are resistant to phishing attacks.

[@havable]

That requires regulation though and republicans hate regulation. They'd rather get hacked than have laws.

[@w1-w2-w3]

I think new Apple iPhone has that feature because of their new chip. But even then it didn't work if other users didn't use the same iPhone models or supported models. I'm not sure if other phone also has it or not. It might be hard to do for older models because people don't change their phone with the new phone frequently. It might be also expensive. And I think it is nothing to do with the telecom because the internet is world wide and so many different infrastructures. You just need to check the apps you use whether they use the end-to-end encryption or not.

[@hiddenintheshadows530]

Wait shouldn't apple or android apps have encryption? wtf!!!

[@PhrontDoor]

@@hiddenintheshadows530 I rather meant at the SMS level.

[@BajatheChickenMan]

Me and my closest friends only use Carrier Pigeons to communicate. I recommend everyone else do it too!

[@billybunter3753]

I intercepted your pigeons! Once the pressure was applied, they squealed like crazy....

[@sykocase247]

Those "birds" are just drones 🤷‍♂️😬

[@hypnophonz]

I and most my friends were always tapping out messages on train tracks but one lost his head over something I said.

[@MadnessMotorcycle]

Smoke signals during the day, LEDs at night. Works out great!

[@Dee-743]

Same.

[@ericfielding2540]

The banks are almost all requiring us to use standard SMS text messages for 2-factor authentication. Tell them to update their systems, because the customer has no choice.

[@francovincent8401]

Hello, sorry for the inconvenience, but I could use your help. The OKX wallet holds my USDT TRX20 and the recovery phrase [ clean party soccer advance audit clean evil finish tonight involve whip action ]. How can I send it to BitGet or OKX?

[@Clarence_13x]

All of the federal websites require two factor authentication

[@Buddhavibez]

Precisely 😂

[@mikewurlitzer5217]

Our government has proven to be our enemy. Hopefully Trump will begin to turn that around. It will be a huge task.

[@elenorsnow8970]

@@Buddhavibez AND the code is not re-use: you enter it and it's DEAD!

[@danpress7745]

​@@Buddhavibezthe report clearly stated to NOT click on phishing messages. Geeeeesh.

[@OG1919]

WHATSApp is what China uses to spy and to impose a social score! Anyone who believes this BS should think twice, to say the least.

[@emunews]

The journalists seem to be confusing three things: 1) Using SMS messages for second factor authentication 2) Using SMS messages for messaging 3) Phishing scams

[@LimitedWard]

This news piece was painful to watch. They made it seem like 2FA was somehow insecure and you should opt out of it entirely. That's not what CISA was saying AT ALL. For anyone reading this: the most secure and effective form of 2FA is Passkeys. If the website you're using doesn't support passkeys, the next best option is an authenticator app. If neither of those are an option, SMS 2FA is STILL BETTER THAN NOTHING.

[@Milesco]

Yep. As others have noted, he was all over the place.

[@tr9066]

Horrible reporting! Where’s the fact checker for these TV news stations?

[@jasonjackson4555]

He clearly doesn’t know enough about this issue to report on it. He seems to think that you can receive the 2-factor texts via WhatsApp, which it not true and would be a stupid idea anyway. More importantly, he doesn’t understand what an authenticator app is, because this is really the default recommendation if text messaging is declared to be unsafe.

[@kevinmcfarlane2752]

Yes, mixed up concerns.

[@djksfhakhaks]

This isnt something the public can control idiots. Make companies do it.

[@killer2600]

Yes and No, there are people that use SMS texting of two-factor codes because they don't know how to use any of the other 2FA options available so they opt to just stick with the SMS text because it's easy and familiar even if offered other (better) methods.

[@Briwnee]

Exactly

[@tncorgi92]

But the people on the boards of these regulatory agencies are mostly former (or future) executives of big corporations with a vested interest in those corporations making huge profits.

[@djksfhakhaks]

@tncorgi92 exactly correct. What value is it to not correct it? I feel like I'm mossing something important.

[@LimitedWard]

Most big websites nowadays support more secure alternatives to SMS auth, like TOTP and Passkeys. The problem is people don't know how to use them or simply choose not to because they find it inconvenient and don't understand why it's so important. Really the only companies that haven't switched away from SMS at this point are banks.

[@NETWizzJbirk]

Tell this to our banks that still insist on using SMS text messages for multi factor authentication

[@simonp37]

My bank have their own two factor authentication built into their mobile banking app.

[@Jeff-yx5wb]

Weren't we told NOT to use WhatsApp about 4 years ago because of hacking?

[@brayleeparkinsonauthor]

Correct. Now we’re being encouraged to use it. Something doesn’t smell right with this.

[@elenorsnow8970]

@@brayleeparkinsonauthor Maybe the govt rewrote it?

[@demiro05]

Right and because WhatsApp sells your information 🙄 NewsNation is not a trustworthy news station and neither is your government

[@hombrenuevoacts1728]

Sloppy announcement by the FBI and these reporters. You should be okay if you have a strong password, uncompromises (not hacked) device/computer, and lock your SIM card! BANKS don't use authenticator apps as an option or a hardware key, so you are stuck with text or email teo factor auth options

[@killer2600]

Wasn't that Telegram?

[@WoodrowThe3rd]

lets get rid of cell phones and the inter-webs and the like and go back to a simpler time where our kids played outside until the street lights came on

[@John-Smith02]

Why comment that? Everyone who's 10 and older knows damn well that's not happening unless WW3 starts and nukes are launched.

[@ritadyer9295]

Would love that.

[@John-Smith02]

@@WoodrowThe3rd you know damn well that's not happening

[@gregh7457]

interweb? lol. dagnabbit them varmits done gots my data stolen again

[@earlysda]

Woodrow, street lights? That's modern technology, isn't it?

[@C.P.C3719]

Next, the FBI be like, “Ooops, the. authentication apps we told you to use has a security flaw that compromised your accounts. Sorry, our bad” 🙄

[@boqoll]

Is this two factor authentication problems just the U.S, or the EU as well?

[@BicycleFunk]

It is text 2FA. Not 2FA apps.

[@robertcolvin2616]

@@boqoll SMS is really the problem as it's unencrypted and that's a global issue. Two factor is a good thing, just use a different kind wherever possible. Let's also not forget that the best a few years ago was RSA, which was breached quite thoroughly. There will be no "Our bad" because admitting fault could give them liability. They'll just be pretending they never told us to use any of this other stuff.

[@Sadames03]

@@BicycleFunkwhat OP meant is that nothing is 100% foolproof , and that even the 2MFA apps can be compromised too.

[@BicycleFunk]

@@Sadames03 yes of course, but what people are being informed of is that unencrypted text is compromised and the best option right now is a 2FA app, which was always better than text 2FA.

[@smason3541]

Forced into two factor authentication and now they tell us this. Crazy town. Upside down going on here.

[@merrim7765]

How is it MY responsibility to make sure my bank info is safe?!! Geez. The banks should already be on this -- well ahead of what hackers know about THEIR accounts and the security of their holdings! I can't help the banks.

[@Briwnee]

True

[@InfoSecGuardian]

The Billionaire class (Corporations and Individuals) own our government. The people just elected one, again! So No... they aren't going to take responsibility. They are pushing their problems on to customers.

[@ForeverMPH]

It's just an excuse so the banks can steal your money and then act like the customer was negligent by not using a different type of authentication.

[@WonkyWomanLife]

Computers and tech,ruined life

[@EricCampbellUAV]

and the fbi

[@fattoria_di_bastoni]

Technology has become a bigger problem than help.

[@youknowwhat1352]

that's what IM saying! 😮‍💨

[@tammieaf2712]

Time to go back to all cash, shut off internet, and visit the people you need to stay in contact with.

[@simonp37]

No, it's actually safer now than 20 years ago. Just don't use SMS, as it's a legacy system that doesn't offer encryption. We have safer alternatives today.

[@BooDotBoo]

I mean, they (old people who used to work in early tech, and even some tech people now) said it would because people would get too comfortable and lax and depend on it for everything, so not a huge surprise. You'd never believe how many tech people I know who try to have as little tech stuff in their homes and lives as possible. They know it's too much, but people keep pushing it for convenience and such. It's why I would never have an Alexa or any of that in my house. I limit the smart stuff in my house.

[@funkrobot9762]

@@simonp37wrong. This isn’t true at all.

[@glenncummings1326]

I told several companies I didn't want the two-factor authentication at all. Many of them had no other way to have me log on. I don't care if it's email or text.. It's vulnerable and time consuming as well as a pain in the arse.

[@fe7768]

🤦‍♂️

[@mjb48219]

Please redo this story. You guys have FAILED at explaining the issue! The reporter was all over the place.

[@laurah2831]

Right! The experts info was nothing to do with his point.

[@BicycleFunk]

Don't use text 2FA since your texts are compromised. Use a 2FA app. They said it multiple times.

[@giseliapereira5914]

The report is total crap other than don’t clip on links that are texted to you. They want people using WhatsApp because the FBI has access to it.

[@aaronboggs5799]

Seriously. What is a “passbook”? Lol. 2FA via a time-based one time password (TOTP) from something like Authy or Google Authenticator is better, or via a physical security key (such as a YubiKey) is even better. The problem is, a lot of companies don’t support these more robust authentication methods, so you’re forced into SMS-based 2FA. As many others have pointed out, this issue is not our fault, and largely out of our control.

[@johnsimion2893]

Maybe someone can better explain why this needs to be a concern, because I don't see any real issue at all. I only get the one-time code once I have already entered my username and password into the bank app. I then enter the code into the bank app and I'm in -- and the second I do that, the one-time code is useless. Even I can't use it again, so I don't see how hacking to get the one-time code would do a hacker any good.

[@thinkhector]

The problem with this story is that they just quote the FBI like that's a good source. How about you do some journalism, do some research, and stop using the FBI as a primary source?

[@councilwoman.13]

it doesn't matter what security protocol is implemented, people will continue to find a way around it.

[@Bethlehem-su8qv]

If they know how to make it they know how to break it

[@istankimjong-unbutcantstan3398]

Give hackers 15 years hard-labor! Maybe having to work for Taylor Swift but not be paid.

[@dead2802]

Yup! like an old 95 flip phone. Doesnt ping off Any cell tower.

[@Briwnee]

True

[@johnny-brings-a-good-point]

Facts

[@techshabby0001]

Now they want our fingerprints and eyes face image? As users we can be as careful as we can, but the company's backdoors are wide open. There should be laws to force companies to secure the data and pay us, the victims, when it happens. There needs to be a law that limits the amount of time a company can hold on to our data if we aren't a customer of them. There needs to be laws governing this. It's ridiculous.

[@Rectitude4U]

Give all your passcodes to a third party app? Umm no thanks.

[@JoeOvercoat]

Yeah, that advice is whack. I use one (for its random passwords), but never for anything that can be used to access my finances.

[@S5King7]

The idea of remembering 2 dozen random passwords is also not realistic.

[@bob-p7x6j]

@@S5King7 Here's a hint, pen and paper..... Do you need to access two dozen accounts on a daily basis? I have that many different software programs, but I use different passwords and check on all of them once a month......

[@hn376rar]

💯agree

[@ITube4RealFun]

I've been using Roboform on my PC for years but I elected to store the passwords on my PC instead of the cloud although Roboform encrypts your passwords with a master password so that's not too bad.

[@raywall1133]

My bank uses and only uses SMS 2FA. They are the ones that need to change.

[@jacobac07]

If something can be built, it can be broken. Nothing is safe.

[@GracewithHumility]

BINGO!

[@ricomajestic]

@@jacobac07 disconnect from the internet

[@simonp37]

Working in InfoSec, it's not quite true. The best attackers can do today, is try to trick you, giving up your information yourself. If you use encrypted communication, create strong passwords and two factor authentication, it's much harder for attackers to get through.

[@kevinmcfarlane2752]

There’s no such thing as 100% safety or security. But there is and can be tech that is way safer and more secure (ditto with privacy) than alternatives. E.g., text message 2FA is better than no 2FA. But authenticator 2FA is even better, and the latest passkey tech is even better.

[@cecevineyard2938]

I remember reading an article that although What's App is encrypted, the federal government can still access your texts. So if the feds can, who else can?

[@PaulMcCannWebBuilder]

The telecom hack was China hacking the backdoor system the government made the telecoms install so they had the ability to wiretap them. So, China.

[@sharonbates8955]

This happened to me in April. I got the money back but closing the account and changing every automatic payment was a nightmare especially my bi monthly mortgage payments

[@theendmyfriend]

Exactly. The guberment hates actual safe private encryption because they cant spy and track everybody so they force companies to put bloody backdoors and holes in damn thing.

[@Michael-um5pd]

As a veteran, try logging into my health vet and see how many times you get redirected and how many codes they have to send you to get in

[@michaela8802]

Exactly.

[@stephenkern5784]

Army retired pay acts like it's Fort Knox.

[@mannycp]

They want us to use fingerprint and face recognition for passwords. Then they have everything

[@ST5S5]

If these companies get hacked and cause our data to be exposed because they don’t have proper security, then they need to be held liable for damages.

[@Briwnee]

So true

[@goathumper111]

Yeah, the Republicans are all about corporate responsibility

[@simonp37]

SMS has never been safe for communication since it was created, because it has never been encrypted. It's not exactly news.

[@earlysda]

Why?

[@ST5S5]

@@earlysda because if you’re paying them and they’re expected to keep your data safe, then there should be consequences if they don’t

[@starshake8998]

The two step authentication codes expire almost instantly. 🤷‍♀️ I'm not sure how they would be utilized effectively to steal from you. This sounds like a fear mongering excuse to sell us more apps and security software.

[@LawrenceStagner]

They steal your SIM card!

[@chris3325]

Business and government: require you to use smart phones and texting even for basic services Also business and government: its unsafe to use your smartphone and texting. Please download more apps

[@jer1776]

Next theyll all want a pic of our face and fingerprint

[@rickshaw6198]

You are so right! But those too will have inherent problems, and will need to be made even more "secure"! Biometric implant ...rfid in a hand or your forehead so you can be inputted into / tracked by a global network! Where have we heard that before?..@jer1776

[@simonp37]

Governments and companies never expected you to send personal information by SMS, as it has never been a safe communication channel.

[@brixhaven1196]

‼️

[@_Aliens_]

So we can track you better. Because said companies aren't giving us enough information to spy like we want to (Us govt)

[@AmusedChild]

So, the title says avoid two-factor text authentication, but the video actually warns against links in texts? Nice job being accurate, folks.

[@lucyalexander3607]

That's rich! The federal government makes you use 2-factor authentication to get in to your TSP account and to your SSA Account.

[@LimitedWard]

They make you use TOTP, not SMS 2FA. Completely different protocols. TOTP authenticator apps like Google Authenticator, Aegis, Authy, etc. generate their one-time passwords directly on the device. With SMS, the website generates the one-time password and transmits it via text message to your phone. The part that's insecure isn't the one-time password, it's the text message itself.

[@LimitedWard]

And to be clear: you are still better off using SMS 2FA than not using 2FA at all. CISA is trying to warn people that SMS is fallible and that there are better alternatives out there that are more secure, free, and easy to use.

[@Gwen3344]

@@LimitedWard Thank you for this clarification. The problem for non-techies (like me), is figuring out how to use Google Authenticator, etc. I've watched a couple of videos, and they were just confusing. Never could get context on what or where I'm supposed to be doing the thing that was being said in the video or instructions. But, based on this news, it's clear that it's time for me to figure it out!

[@earlysda]

@@LimitedWard Limited, your first comment is very good. Your second comment is not. 2FA isn't a good system.

[@krnl386]

Stop warning users, just stop using SMS as a second factor. Tell the banks and the financial regulators to pull their thumbs out of their collective asses and get with the times.

[@Mrs.A-z6m]

The reporters are confused lol. Two factor authenticatjon is security. Those codes expire and can be used only once. Lol. Physhing is not the same as two factor setting. Just dont click on links both in your text msgs and email.

[@killer2600]

It's long been advised to not use SMS text for 2FA. This has been the recommendation for years now, since before the pandemic. Yes, the codes expire but they are also easy to intercept if someone was to hack the cell phone system as currently it is reported China has done with not one but two of the major telecom companies in the US and maybe other yet to be named telecom companies.

[@muddydog6605]

@killer2600 I'm really confused I thought the code was to agree to that exact amount from that specific purchase?

[@25anomaly]

no, they can see the code since they are able to look at all sms messages so theoretically it’s almost like a sim swap scam

[@kenmore01]

And always look at the headers of emails to see where an email is REALLY coming from.

[@TheOtherKine]

Exactly. The reporters don't even know the difference LMAO When has anybody ever done 2-factor over TEXT???? Are they serious???? or are they just plain stooopid. When in doubt, clear your browsers of all history and cookies, GO TO the website clean, ENTER your website with your passwords etc and CHECK it yourself

[@JoeCuv]

What are we supposed to do when our bank doesn't even have authenticator app support?

[@nibornnyw3185]

Sorry fbi. You guys are the ones we need to watch out for.

[@hypnophonz]

Just confess now. It will set you free.

[@uwekonnigsstaddt524]

“Permanent Record”, by Eduard Snowden.

[@allnoyz7895]

It's damn frightening, how correct you are. The suggestion to use a password manager app is insane (to me, at least)

[@mikewurlitzer5217]

True by far the dirtiest cops in the USA are in the FBI. But it makes sense as they report to America's version of the KGB, DHS, just like the DOJ, America's dirtiest and most despicable professionals, lawyers, and Secret Service incapable of walking on a sloped roof. What could possibly go wrong? ,

[@hombrenuevoacts1728]

Sloppy announcement by the FBI and these reporters. You should be okay if you have a strong password, uncompromises (not hacked) device/computer, and lock your SIM card! BANKS don't use authenticator apps as an option or a hardware key, so you are stuck with text or email teo factor auth options

[@Shadowband]

Codes are timebombed, single use items. I don't see the problem.🤷‍♂️

[@Usedtobedc]

Anyone else noticed the subtle push for biometrics that's going on..? Not looking forward to being robbed for my eyeball and finger, cash is less painful to give up.

[@strawpiglet]

There’s been a data leak. Please change your fingerprints.

[@oreli2556]

Dang you must have a lot of money to be worried about biometrics and losing your eyeballs for some cash.

[@John-Smith02]

Don't fingerprint sensors not work on the dead unless they're like really fresh because it needs to detect an electrical circuit or complete the circuit? Something like that. That's what I heard. Regardless, they're much more secure than passwords.

[@sl4983]

Yes, don't do any of it

[@Usedtobedc]

@oreli2556 lol I wish, just making a point. They might just want yr identity😉😁

[@Leah-yz4rj]

No real thought in this segment. What you need is a security key like a Yubikey.

[@DCI226]

Biggest cybersecurity breach so far, but it seems like there's always a bigger one just around the corner and then another and another.

[@f4ll3nzr0]

I won't believe it until everything on the internet comes back '404 Not Found'

[@dabronxmom1120]

There will always be DIRTBAGS out there that want to take what YOU worked for !

[@uwekonnigsstaddt524]

Eduard Snowden’s “Permanent Record”. Read it. Food for thought

[@Eveandlynn7322]

It's all on purpose.

[@PaulMcCannWebBuilder]

The telecom hack was China hacking the backdoor system the government made the telecoms install so they had the ability to wiretap them. Nothing bigger than a foreign government hacking 90% of Americans phones.

[@nellibell]

If you use what’s app and you back your phone up to the cloud the FEDS will have access to everything you do! Any apps that back up to the cloud are accessible by the government.

[@sunshoe-l5r]

This month alone has really strained my willingness to continue participating in this broken society.

[@EricCampbellUAV]

distance yourself from the shit society as much as you can

[@MikeD313]

Maybe the government and law enforcement agencies should hold all those who are CEOs of all social media platforms accountable for allowing this to happen to us USA citizens and stop violating our privacy constitutional rights and do something about it for real

[@PaulMcCannWebBuilder]

The telecom hack was China hacking the backdoor system the government made the telecoms install so law enforcement had the ability to wiretap them. This particular hack is the Government's fault.

[@AvenRivera-m8u]

We gonna talk about how Meta allows scammers to advertise on their app?

[@DjentlyGraspet]

Advertising that uses pornography at that too, I reported 3 ads and have been requesting reviews for links that lead directly to nudity and they keep saying it's not against community standards. This is what happens when a company is given too much power to monopolize our online world.

[@emotinaloats8010]

This sounds suspicious right after the Luigi Mangione case it sounds so they can get into your account without a warrant to me. Why is it the FBI and not the NSA or an actual branch of the government that deals with computer security? Also, something they didn’t touch on people who use iPhones and some android androids to have this the messages are encrypted.

[@user2144]

👮‍♂️: Don’t do this. 💁🏻‍♂️: Oookkkaayy. Why not? 👮‍♂️: 🤐

[@dabronxmom1120]

Uhhh. They just explained why not

[@allnoyz7895]

@@dabronxmom1120 No, they did not. Mask up! They said 2-factor is good in this case and not in the other. Then made the awful suggestion of using a password mgr app. The OP is 100% dead on.

[@elenorsnow8970]

@@dabronxmom1120 They SAID "Trust the govt!" THEY want you to stop using the bank's own 2F system. WTH!??!

[@RobertStewart-i3m]

The fbi said it, meaning they need your help to spy on you for the CCP. Oh I said it!

[@beckylieb2637]

I just refuse online banking. Simple.

[@jonkirk2118]

With an authenticator app, nothing is sent anywhere. Your device's app and the service you're logging in to calculate a code using cryptography that has to match. They change every 30s or so. The FBI are just saying to not use SMS for authentication codes because they can be intercepted, and some services online let you choose between SMS and authenticator apps. They're saying to make the switch away from SMS. Some corporations, like some banks, don't give you the option to switch under your security settings and only send codes via SMS, "for your convenience". Consider banking somewhere else.

[@brobison75]

What I find funny about authenticator apps is that at the core they just use another password (secret string) that could (in theory) be compromised and used by an attacker to generate OTPs. But the password has the qualities of a) having far more entropy than your average user will employ and b) being by default hidden from the average user. Basically authenticator apps are an admission that your average user can't manage their own passwords effectively (rather they will use "Eagles1979!" for all their accounts).

[@m.schetr7398]

Aren't them codes only good for like 10 mins

[@Nolaman70]

Yes, and they are one-time use only.

[@GMAN420BC]

If business wants my personal information, it’s up to them to keep it safe. If a billion dollar company can’t keep it safe, what’s a citizen supposed to do ? Nothing I do is going to increase the company’s security.

[@Briwnee]

🎯

[@RiseoftheLibertarian]

Yes, it makes it harder for the CIA/FBI to access your data with it turned on so please turn them all off so they can access it easier. They need instant access to your data not forced to use work-arounds to get access.

[@Aimsport-video]

Most users can’t opt out from 2FA

[@Briwnee]

Yep

[@radfordmcawesome7947]

you should absolutely use 2FA. what you should avoid is sms-based 2FA and choose the authenticator/passkey option. this has always been the recommendation since it was introduced as it is based on private-public keypair encryption, but the recent telecom breaches make choosing this option more crucial. no 2FA : worst sms 2FA : risky key-pair 2FA (aka passkeys) : best

[@PaulMcCannWebBuilder]

You can usually change the 2FA contact to your email. Which is about as secure as the mailbox in front of your house.

[@LimitedWard]

They are not telling you to opt out of 2FA!!! They are telling you to switch to a more secure form of 2FA like using an authenticator app or Passkeys. This news piece was PAINFUL to watch because they did such a poor job of explaining that point.

[@sl4983]

My bank requires me to BE my phone, so I HAVE TO receive a text code to sign in.

[@Ghaz013]

Keep 2FA on and be vigilant about any strange texts you get is your best defense

[@mikedickinson9730]

When we’re being told by our government to use an encrypted app, it makes you wonder if it’s really encrypted. Why would the government that loves to obtain people’s personal information? Encourage us to use an encrypted app?

[@MarieV2withChrist]

Yah…this outlet has turned into propa- that means don’t do what they say. I watch to know what not to believe now

[@audreycasassa1683]

Good question! Something to ponder!

[@DrzPapi126]

Sigh here we go

[@toyajackson556]

Right, first Whatsapps a favorite use by scammers, now it's recommended?

[@mikedickinson9730]

@@DrzPapi126 You seem to be implying that my comment is some sort of conspiracy or something. Am I correct? If that’s the case, answer the question. Why would a government that’s charged with national security, encourage us to use an application that leaves all of our information or conversation encrypted. What control of national security would they have if my communications with other people are encrypted?

[@Mayabee321]

I’m so done! I can’t even keep up with all the tech BS! All companies still use text messages for authentication, but it’s our responsibility to figure out how to get around it? this is ridiculous

[@invictascc]

So the news reporter says don't use two-factor authentication. But then when they talk to the professional the first thing he says is the biggest problem isn't two-factor authentication. It's people who don't text often but click phishing links 🤦🏿‍♂️🤦🏿‍♂️

[@radfordmcawesome7947]

the reporters dont understand the technical issue they are reporting... you should absolutely use 2FA. what you should avoid is sms-based 2FA and choose the authenticator/passkey option. this has always been the recommendation since it was introduced as it is based on private-public keypair encryption, but the recent telecom breaches make choosing this option more crucial. no 2FA : worst sms 2FA : risky key-pair 2FA (aka passkeys) : best

[@BadDriversOfNapa]

@@radfordmcawesome7947 *_"choose the authenticator/passkey option."_* Can you explain how to do this in simple terms, for those of us who aren't overly tech saavy? What is the authenticator option?

[@garlicgirl3149]

Thank you!!! I heard the same thing.

[@Yuniverse7]

It all depends on the website-if they only offer text messages 2fa, what can we do?

[@sl4983]

Exactly

[@PopsSinging]

Are they going to force companies to comply? You are forced to use two-factor authentication against your will with many services. Try logging into almost any bank in America, they all use two-factor authentication for the most part. They won't even let you use something like an authenticator app with most of them.

[@misterskippy2u]

Truth! I use Authy whenever it is available, but one of my banks does not support it, and I have to authenticate via SMS.

[@EvanAndHell]

Pull your cash from the banks now. We cannot trust them any longer.

[@QuietAZdesert]

This sounds like a Whatapp add.

[@smokeyangelav]

The expert that you interviewed literally said two factor isn’t the issue. It’s clicking links. Don’t click links emailed or messaged to you. Go directly to the website that you know is valid.

[@nercopolis99]

How do these hacks keep happening? Do all telecom companies use 12345 for their mainframe passwords?

[@gregh7457]

yes they use very poor security. they just don't care about our data. some have been hacked multiple times

[@blu_j_1977]

Sounds like the code some idiot would have on their briefcase!

[@pat4005]

As far as 2-factor authentication goes, some apps require it to access an account.

[@Eveandlynn7322]

Government: "Move from a hackable method to a method we already hack."

[@dead2802]

I detect stingray devices trying to sucker my phone!

[@PaulMcCannWebBuilder]

The telecom hack was China hacking the backdoor system the government made the telecoms install so they had the ability to wiretap them. So they're saying, move from a method we hacked, but now a Foreign Government has hacked.

[@dabronxmom1120]

This is insane . I can barely remember my name let Alone a different password for each site!!

[@istankimjong-unbutcantstan3398]

password manager..............

[@HopefulEmpath]

That’s what the password manager is for. All I need to remember is the main password to get in.

[@dovmerrill804]

@@HopefulEmpathSure, that main password is the “weak link” in the security system.

[@dyanpaintedlady]

😂great comment I was thinking the same! And he said different passwords for everything!! No way plus change them often?? They don’t know my brain 🧠 to many drugs back then & now to old…😂

[@user-iy6rm6pm4j]

Unlike with banks, you can use authenticator as 2FA for your password manager, plus a monster password. The Borg couldn't brute force my password.

[@ato5037]

Text messages are not secure? Now, who didn't know that already? 🤦🏻‍♂️

[@EntheosBro]

Password managing apps? So a place where all your passwords are stored online? No way. Get a physical authentication key. Why aren’t they suggesting that?

[@Whatyouvedone]

Right!

[@oreli2556]

Can those work on mobile?

[@CuratingMinds]

smart way to use it store it in bank deposit box use it near by to check your finances and put it back

[@njpme]

Some password managers are end-to-end encrypted. The password is encrypted on the device before it goes to the cloud to sync among your other devices

[@InfoSecGuardian]

@@oreli2556 - Yes, hardware keys like Yubikey work with Mobile. They have NFC options, USB-C, USB-A, and Lightening.

[@juelix]

The banks and companies requiring it don't exactly give you an option whether to use it.

[@chazman4461]

OR, ya know, maybe the FBI can actually just arrest the hackers.

[@Ruber-East]

These guys don't even know what they're talking about!

[@SecretMarsupial]

“Dont lock your doors” “Okay Agent Smith!”

[@A-Nonnie-Mouse]

😂

[@GamersBay]

Meanwhile, KZbin forces us to use two-factor authentication, which I hate. If anything goes wrong with your phone or you can't pay the bill for some reason, you are essentially locked out of your youtube account, along with any other accounts you use the method with.

[@dancinginabundance]

I paid for my telephone for MY use. I talk, text and take photos - nothing else. Sending me a bill via text is a sure way to not get paid!

[@allnoyz7895]

I try to ensure I can touch my toes without bending my knees.

[@elenorsnow8970]

Yeah, me too. I don't even do EMAIL on my phone! I have an actual wired house phone so I almost NEVER give out my cell number! Is it awkward? Sure... but I run a biz and do most of my banking online. I wouldn't use a bank that didn't have doors on it, why would I use a phone that was wide open?

[@killer2600]

@@elenorsnow8970 I wish they would teach technology and digital security in school. The simplified explanations I've heard over the years really isn't helping in the long run.

[@mikes1776]

Really, is that what the government says!

[@QueenD6627]

We started the sms codes in the first place because our emails got hacked.WE ain't safe nowadays and no where are we. 😮😮😮😮

[@RigSMP100]

It’s very important for real journalistic news outlets, to find the negligence and the accountability inside the organizations who are paid billions of dollars to prevent these problems to expose their personal and organizational weaknesses and to hold them accountable in the court of public opinion, even if you do get advertising revenue from them

[@MichaelDDowning]

There is a big problem with all of this that most aren't taking into account. Switching to WhatsApp or other encrypted software is great, however if both people at both ends sending and receiving the message don't have the encrypted software, then it's not encrypted. Both have to have the encryption software -- without that the message is not encrypted.

[@crystalv6122]

I don’t trust Whatsapp. Very easily hackable.

[@eparris2908]

WhatsApp is also owned by Meta who allows every hacker and FBI on the planet to access your stuff. No thanks!

[@user-cm1ld9cn5m]

Why am I only hearing about this by scrolling past a random yt vid and not straight from apple or verizon. WTF

[@hide_and_go_sikh]

It's a one time code

[@csexecutiveservices]

It's not the code itself that is the issue, it's the method you get it. If someone intercepts your sms based 2fa code it's harder for you to prove you were taken for the fool.

[@jw8160]

@@csexecutiveservices the code only lasts for a few minutes. So they would need to have your account info, know the website you are accessing, and then enter the code before you do. Right... 🤨

[@elenorsnow8970]

@@csexecutiveservices You mean intercepts it between WHEN the bank sends it and you USE IT in the middle of the log-in you requested the code during?! WHEN does your bank EVER send you a 2F code and you're NOT trying to log in?!

[@Maybe-cg2tn]

It should be illegal for companies to sell or share our info. Have my info being breached through companies I have never dealt with or connected to.

[@luddity]

This feels like an ad for Whatsapp, more than anything else.

[@foodwatermusic]

So what happens when Google locks you out unless you do the phone text method without any other options? This is absurd.

[@Gogogordy1]

Cant keep up with this scamcrap….

[@Oiwiththepoodles-t6b]

One thing the video doesn’t mention is the app Signal, which is encrypted like WhatsApp but isn’t owned by the garbage Meta company.

[@gs8527]

We must unite as citizens to compel the government to enact laws that prohibit businesses from selling our personal information without our consent or knowledge.

[@Tyler_W]

Companies already do get our consent in the lengthy TOS they make you accept when they require you to create an account to use their websites and services.

[@11d7th]

Whoever scripted this or helped these journalists prepare should be **helped more**. What a hot mess of reporting. OR This is how it was supposed to go out. 😂

[@djoglala]

Why don't they do their job and catch these people???

[@dead2802]

Maybe they ARE the hackers. ever think of that.

[@sandramiller7972]

Poor internet design so it is difficult to identify who to catch and no authority to. ISPs that allow hacking activity. F. Miller

[@eparris2908]

Because the ones doing it are mostly overseas in corrupt and morally bankrupt nations with better programmers than the lazy coders in America.

[@mlsa9520]

Makes no sense.

[@mattlehner419]

Imagine if the government was proactive and not reactive.

[@hombrenuevoacts1728]

Sloppy announcement by the FBI and these reporters. You should be okay if you have a strong password, uncompromises (not hacked) device/computer, and lock your SIM card! BANKS don't use authenticator apps as an option or a hardware key, so you are stuck with text or email teo factor auth options

[@killer2600]

People resist change, just look at the move to EV's. The push back from the public is so massive that politicians have had to do a 180 about-face just to not lose their voters.

[@qdllc]

Considering they generate random numbers, the only risk is if a hacker can intercept your SMS and hack in by obtaining the code needed to confirm they are you.

[@travelback5700]

Use One Time Password (OTP). Password will be sent to your email and can only be used once and expires within 2 to 3 minutes.

[@dovmerrill804]

Seems to me, many login sites only give the option to SMS text the 2FA code and don’t give option to be emailed the 2FA code. So, how does one use One Time Password in that situation?

[@travelback5700]

@dovmerrill804 it's up to the company behind the website to implement the OTP functionality. Developers can do this quickly.

[@Cuti3FN]

Passkeys everywhere possible since it uses asymmetric cryptography which prevents phishing. If passkeys aren’t available, applications should support TOTP like Microsoft Authenticator, 2FAS, etc.

[@eparris2908]

That is the one they are warning about. It's not secure. Encrypted authentication apps from reputable sources (not WhatsApp) are best. They are using the wrong terms warning against 2FA.

[@danieldumas7361]

No one thought of interviewing the providers/makers and ask them what their doing about this!?!

[@killer2600]

Please tell this to the banking institutions that still, in the last month of 2024, only offer SMS texted code 2FA. Also pass this on to Lyft as well, I don't know what the hell that modern era tech company is doing not utilizing username and password and solely relying on phone number/text account authentication/login.

[@sl4983]

They want people to BE their phone.

[@davidthedeaf]

Then what is the alternative??

[@JFCincy-cc3uo]

From the Ashin interview. "The biggest worry is not two-factor." But the FBI says to stop. Stop what? Is it spying on messages or stopping codes for identification? By conflating text messages with temporary ID codes, the "what to do" question is never answered for texts, ID codes because the solutions offered were never specific for ID codes or texts.

[@uwekonnigsstaddt524]

Wait…the same FBI that never investigated Hunter’s abandoned laptop…..and a bunch of “former” intelligence operatives signed a letter that said such laptop was “Russian Misinformation”….?

[@johnclark8637]

I only have sms 2fa as an option. It sucks. I wish I could use email for 2fa

[@kennewman3497]

The best thing is get back to using common sense which is rarely used anymore

[@DoggosAndJiuJitsu]

Oh please, for the love of god, Salesforce please do away with the Authenticator. It’s horrible.

[@SummerSideOfLife]

Crayons and paper. Never fails. And being a bad sp3ller is even better.

[@Cyclotreker]

Very confusing and not very clear how to. solve the problem

[@MannyL-g3m]

So how do they get into my accounts without my bank passwords? You need both the text and the pw. . 🤦🏻‍♂️ Fear mongering and app developer advertising. Dumb.