Microsoft wants you to ditch SMS-based multi-factor authentication mechanisms

[Gandalf_The_Grey]

Content source

https://www.neowin.net/news/microsoft-wants-you-to-ditch-sms-based-multi-factor-authentication-mechanisms

With a large portion of people working from home in light of the ongoing pandemic, digital security and privacy has become more important than ever. And while we may not be observing the National Cyber Security Awareness Month (NCSAM) anymore, Microsoft has not given up on promoting cybersecurity initiatives.

Now, Alex Weinert, who is the Director of Identity Security at Microsoft, has penned a blog post highlighting the need to move away from multi-factor authentication (MFA) mechanisms which are based on publicly switched telephone networks (PSTN).

The executive has highlighted various reasons to let go of MFA systems based on PSTN such as SMS and voice. However, Weinert has emphasized that MFA itself is essential, it's just the way people use it that should change.

To that end, the executive has stated that mechanisms based on PSTN are the least secure MFA methods out there because practically every exploitation technique such as phishing and account takeover can still be carried out. This situation is only expected to get worse once attackers shift their interest to breaking MFA systems, which is dependent upon how much of the public use them. Furthermore, PSTN messages aren't adaptable to different users either, so the potential to further improve security via them is limited.

Read the full article here at Neowin:

Microsoft wants you to ditch SMS-based multi-factor authentication mechanisms

In a new blog post, Microsoft has highlighted several vulnerabilities present in PSTN-based multi-factor authentication (MFA) mechanisms such as SMS, and encouraged transition to app-based MFA.

www.neowin.net

Microsoft blog post:

It's Time to Hang Up on Phone Transports for Authentication

Learn why we think it's time to move away from the SMS and voice Multi-Factor Authentication mechanisms.

techcommunity.microsoft.com