Week 12, In the News: Microsoft urges users to stop using phone-based multi-factor authentication

Microsoft is urging users to abandon telephone-based multi-factor authentication (MFA) solutions like one-time codes sent via SMS and voice calls and instead replace them with newer MFA technologies.  Alex Weinert, Director of Identity Security at Microsoft said in a blog post last year that users who enabled multi-factor authentication (MFA) ended up blocking around 99.9% of automated attacks against their Microsoft accounts.  SMS and voice calls are transmitted in cleartext and can be easily intercepted by determined attackers, using techniques and tools like software-defined-radios, FEMTO cells, or SS7 intercept services.  SMS-based one-time codes are also phishable via open source and readily-available phishing tools like Modlishka, CredSniper, or Evilginx.  Weinert goes on to say that users should enable a stronger MFA solution for their accounts, recommending Microsoft’s Authenticator MFA app as a good starting point.  But if users want the best, they should go with hardware security keys, which Weinert ranked as the best MFA solution in a blog post he published last year.

https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/