Compromising online accounts by cracking voicemail systems
Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
Breaking Password Dependencies: Challenges in the Final Mile at Microsoft youtube.com
The primary source of account hacks is password spraying (on legacy auth like SMTP, IMAP, POP, etc.), second is replay attack. Takeaway: password are insecure, use and enforce MFA.
-
SMS: The most popular and least secure 2FA method allthingsauth.com
-
SMS 2FA auth is deprecated by NIST techcrunch.com
NIST has said that 2FA via SMS is bad and awful since 2016.
-
A Comparative Long-Term Study of Fallback Authentication maximiliangolla.com
Key take-away: “schemes based on email and SMS are more usable. Mechanisms based on designated trustees and personal knowledge questions, on the other hand, fall short, both in terms of convenience and efficiency.”
-
Your Pa$$word doesn't matter techcommunity.microsoft.com
Same conclusion as above from Microsoft: “Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.”
-
Is SMS 2FA Secure? No. issms2fasecure.com
Definitive research project demonstrating successful attempts at SIM swapping.
IAM › Multi-factor auth: “Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems.”