But this are randomly generated numbers, short term lived. They don’t make any sense to anyone, if not having the other authentication factors, in the multi factor authentication. That’s why they are multi factor (2nd in most cases). And those banks token apps, I guess they provide client server encryption, which bumps up security on the token sent a bit, but in my mind not enough to say just because you receive SMS tokens, it’s quite easy to get into you bank account, without having all authentication factors at hand, and all the time, remember those tokens are short lived.
SMS based 2FA terrifies me.
https://arstechnica.com/information-technology/2021/10/company-that-routes-sms-for-all-major-us-carriers-was-hacked-for-five-years/
But this are randomly generated numbers, short term lived. They don’t make any sense to anyone, if not having the other authentication factors, in the multi factor authentication. That’s why they are multi factor (2nd in most cases). And those banks token apps, I guess they provide client server encryption, which bumps up security on the token sent a bit, but in my mind not enough to say just because you receive SMS tokens, it’s quite easy to get into you bank account, without having all authentication factors at hand, and all the time, remember those tokens are short lived.
They aren’t going to bother trying to get the 2fa code until they already have your password, and by then, it’s already too late.
Like this kid, did a SIM swap attack and hijacked 2fa codes.
https://www.engadget.com/canada-cryptocurrency-arrest-171617452.html