SMS 2FA auth is deprecated by NIST
NIST has said that 2FA via SMS is bad and awful since 2016.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
SMS: The most popular and least secure 2FA method allthingsauth.com
-
Is SMS 2FA Secure? No. issms2fasecure.com
Definitive research project demonstrating successful attempts at SIM swapping.
-
Compromising online accounts by cracking voicemail systems martinvigo.com
Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems.
-
Your Pa$$word doesn't matter techcommunity.microsoft.com
Same conclusion as above from Microsoft: “Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.”
-
Attacking Google Authenticator unix-ninja.com
Probably on the verge of paranoia, but might be a reason to rate limit 2FA validation attempts.
-
SMS Multifactor Authentication in Antarctica brr.fyi
Doesn't work because there are no cellphone towers at stations in Antarctica.
IAM › Multi-factor auth > SMS-based: “NIST has said that 2FA via SMS is bad and awful since 2016.”