I'm surprised they're putting SMS 2fa in now. In 2016 the NIST released new guidelines that essentially "banned" SMS 2fa use. It's heavily suggested that US banks follow NIST guidelines, I'm unsure if there's any actual legal requirement for them to.

You could always send the portion of the guidelines to as many credit union people as possible. Someone may bite.

> Is there a compliance check box that requires SMS over something with at least some security?

Yes - it ticks the box for 2FA.

Like everything in computer security, it's complicated, and there are tradeoffs.

First, intercepting SMS is not that easy. It's "easy" for someone who knows what they are doing and is willing to expend some resources, but it's not a casual attack that can be mounted by a script kiddie. It's a lot easier to steal your phone number using a social engineering attack. The easiest one to execute is to impersonate you somehow and get your number transferred to a "new" phone. That one got me a few years ago. Very scary.

Second, in order to exploit an SMS attack you have to be able to link the number to e.g. a bank account. One mitigation for this is to use different and non-obvious user IDs for critical accounts.

Third, despite its weaknesses, SMS 2FA is better than no 2FA at all. Even if breaking SMS is "easy" it's still an additional cost for a prospective hacker. You don't have to outrun the bear.

But it is good to be aware that SMS 2FA is weak. It's better than nothing, but for things that are really mission-critical you should seek alternatives.

These vulnerabilities are something we know and is already scary. I wonder how much 3 letter organization are capable.

I had the same thought on SS7 being kept vulnerable on purpose. With continuous attempts in EU and elsewhere on tapping the E2EE communication and the fact that email remains insecure despite so many proposals makes me think this really is one of those things that get agreed upon behind closed UN doors. And I am NOT a fan of conspiracy theories.

I think that lack of information, i.e. any effort to remediate this, is an information in itself.

It’s kind of nuts, with one of those SS7 tickets you could easily use a bot to drain 1000s of bank accounts an hour based on the 2FA vulnerabilities.

I'm not looking for perfect location privacy from the government. What's that got to do with the subject at hand?

Youtubers regularly swap the video thumbnail + title. Youtube even has tools to A/B test various thumbnails + titles nowadays for different users.

I can confirm that the title "I Hacked My Friend's Phone to Show How Easy It Is" was the actual title when the video was uploaded. However you're right that it now looks like it changed to "Exposing The Flaw In Our Phone System" a day later.

Watch an older Veratasium video about Youtube's title+thumbnail clickbait: https://www.youtube.com/watch?v=S2xHZPH5Sng