This advice is not from Yubico’s marketing team but from a person who makes his living stealing people’s online accounts and is a powerful testimony. People don’t need to handle your mobile phone to steal your number but are powerless if they can’t get their hands on your YubiKey.

Fortunately, these guys aren't out to rob you, but even so, the message is you can’t ultimately rely on SMS-based authentication to protect you.Ī helpful, if that's the right word, hacker divulges his recommendations to the Gimlet team how to keep yourself truly safe online and to protect yourself from people like him - which includes using Yubico’s hardware-based YubiKey solutions for your authentication, not SMS. There's a good example in the Gimlet Media “Reply All” podcast episode where cybercriminals use this tactic to steal social media accounts with prized usernames, which they then sell.

Well, except for the fact the bad guys started using identity theft to transfer mobile services to blank SIM cards and thus gain control of all your incoming SMS messages. The principle was sound - a bad person could get your username and password but they wouldn’t have the time-limited code sent directly to your mobile phone, and thus even if your credentials are compromised nobody else can log in as you. So too the emphasis today on SMS text message-based MultiFactor Authentication might be doing more harm than good. Of course, the end result was less security, not more, and today’s best practice is different. Just like so-called “best practice” in corporate environments used to be frequent password changes which ultimately caused users to write their password-de-jour on sticky notes or simply increment a number at the end. However, you might possibly not know sometimes our efforts to be secure lead us the wrong direction.

Yubikey 5c nfc usb c