DEV Community

Discussion on: How to Process Passwords as a Software Developer

Collapse
 
martinscheringa profile image
Martin Scheringa

Why not use SMS?, see Note: Do not implement SMS for multi-factor authentication!

Collapse
 
phinor profile image
Philip Norton

SIM swaps can be done without the user's knowledge or consent and thus SMS codes are possible to intercept.

Collapse
 
nathilia_pierce profile image
Nathilia Pierce

Because it's easy to do SIM swam scams, spoof phone numbers, etc. It's another personally-identifying bit of information that we shouldn't need for authentication.

As attacks become more efficient, we're moving to better solutions like YubiKeys and TOTP-based authenticator apps. Both of which are still fairly easy to use.