Why SMS’s authentication is not as sure as we believe

It is practical, but it is not worth an access key or a dedicated application. The double authentication of SMS, which consists of receiving a code by message and then entering and validating its identity, has become a need for both websites and video games.

But if he thought that these SMS are sent by the company or the website he tries to access, he is wrong. A vast survey conducted by Bloomberg and Lighthouse Reports reveals that behind this service often hides a Swiss company, Fink Telecom Services, which has links with several espionage agencies around the world.

SMS code, the worst solution to ensure authentication

The two media explain that Fink would be linked to piracy cases, which allows us to infiltrate certain users, in particular to follow them. Fink, for the voice of his boss and founder, refuted any idea of ​​analysis or interference in traffic between an operator and the client who expected his code.

However, SMS authentication remains the “double factor” authentication solution (a password and an attached solution) the least safe in general. In the first place, because it is possible to steal your phone number and, therefore, see this land of code on another device, but also for personal data reasons. He also wants the code sent by email.

Knowing this, it is not surprising that the great actors have abandoned the authentication of SMS, in particular Google and the signal of encrypted messages. Meta has announced that he had advised to use Flink for his partners.

What solutions easily identify?

Especially because with years, new solutions have appeared. This is the case of applications such as Google Authenticator or Microsoft Authenticator, which allow it to generate random code and valid for a few seconds. There is also the identification key, which uses your smartphone and frees it from any password.

To do this, thanks to a scan code, it can be authenticated with the fingerprint or the lines of your face. Finally, to ensure that everything is perfectly safe, you must use a password administrator, which can store and suggest diversified and robust passwords.