Feds Issue Another Warning About Texting Risks – Scary Reason To Stop Using Two-Factor Authentication Now

This security feature may not be so secure after all.

Apple and Android users have been urged to stop receiving two-factor authentication codes via text after government officials revealed that a massive telecom breach could expose unencrypted messages to malicious actors.

Earlier this month, the FBI urged smartphone users to use encrypted messaging platforms like Signal or WhatsApp after bad actors, suspected to be from China, attacked AT&T, T-Mobile, Verizon and five other networks for spy on customers.

On Wednesday, the Cyber ​​Security and Infrastructure Security Agency (CISA) published a new memo outlining best practices for mobile communications after a network hack, advising people to stop using SMS as a secondary factor for authentication of online accounts.

“SMS messages are not encrypted – a threat actor with access to a telecommunications provider’s network intercepting these messages can read them,” CISA stated.

Receiving codes via SMS is “not phishing-proof,” meaning it’s not a secure verification method for high-profile targets.

Instead, the agency encouraged the use of authentication apps — though they are still subject to breaches — or FIDO authentication and passkeys, which are considered the most secure verification method.

While some online services may not have another option for two-factor authentication, the agency urged users to use alternative methods when possible to minimize the risk of hacking. They also recommended using a password manager, using strong passwords, setting a PIN when possible and keeping personal devices up to date.

The advisory follows news earlier this month of network breaches, dubbed Salt Typhoon, which experts speculate are “ongoing and likely on a larger scale than previously understood”.

Officials were unable to state with certainty that the malicious actors had been successfully eradicated from the networks.

“We can’t say for sure that the adversary has been driven out,” Jeff Greene, assistant executive director for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CSIA), told Politico.

“We’re on top of tracking them down, but we can’t say with confidence that we know everything, and neither will our partners.”