Whistleblower warning: 2FA codes sent via SMS are trivially easy to intercept

...the one-time passcode before it reached the intended user. This is a significant security concern, as it can lead to potential unauthorized access to the user's account. SMS-based two-factor authentication (2FA) is indeed vulnerable to interception, SIM swap attacks, and other forms of social engineering.

There are several reasons why SMS-based 2FA is considered insecure:

1. **Interception**: Advanced attackers can intercept SMS messages using techniques such as man-in-the-middle attacks, malware-infected devices, or rogue base stations.
2. **SIM Swap Attacks**: Attackers can trick mobile carriers into swapping the victim's phone number to a SIM card under their control. Once they have control over the victim's phone number, they can receive the one-time passcodes and bypass the 2FA.
3. **SS7 Vulnerabilities**: Signaling System No. 7 (SS7) is a telephony signaling protocol that is used to set up and tear down most of the world's public switched telephone network (PSTN) calls. It has known vulnerabilities that can be exploited by attackers to intercept SMS messages, including one-time passcodes.
4. **Social Engineering**: Attackers can use social engineering techniques, such as phishing emails or phone calls, to trick users into revealing their one-time passcodes.

To mitigate these risks, it is recommended to use more secure alternatives for two-factor authentication. These include:

1. **Hardware Tokens**: Devices like YubiKey generate one-time passcodes locally, without relying on network connectivity. They are resistant to remote attacks and social engineering.
2. **Time-based One-Time Password (TOTP)**: This method generates a one-time passcode based on a shared secret and the current time. It can be implemented using apps like Google Authenticator, which are less susceptible to SIM swap attacks.
3. **Biometrics**: Fingerprint or facial recognition are more secure than SMS-based 2FA and provide a seamless user experience.
4. **WebAuthn**: This is a web standard for passwordless authentication, supported by modern browsers and platforms. It enables strong authentication using biometrics, platform authenticators, or security keys.

While SMS-based 2FA is better than using no two-factor authentication at all, it is crucial to understand its limitations and consider more secure alternatives to protect user accounts effectively.