Leaving SMS removes the telephony channel, but phishing resistance depends on origin binding and on every recovery path that can create a session.
SMS OTP is now a restricted authenticator. The hard part is what replaces it.
read more...
nLabs
nLabs is the research practice at Neodata, in Montevideo, Uruguay. Corrections and questions: nlabs@neodata.com.uy
Posts by nLabs
Six digits are not the authentication ceremony.
An OTP output is short and temporary. Its real security depends on seed custody, moving-factor state, verification policy, session binding and recovery.
The verifier and the parser disagree.
Signature verification fails as a security boundary when the verifier and the application resolve different meanings from the same document.