<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF">
<div>
<div>
<div>
<div>
<div>SMS's and calls over cell phone networks are known to be vulnerable to spoofing and interception making them unsuitable for 2FA. As a matter of fact there have been high profile media reports of attacks against social media accounts and online banking
that took advantage of said flaws.</div>
<div><br>
On 30 Jun 2017, at 19:14, "Ngigi Waithaka" <<a href="mailto:ngigi@at.co.ke">ngigi@at.co.ke</a>> wrote:<br>
<br>
</div>
<div></div>
<blockquote type="cite">
<div>
<div dir="ltr">
<div>
<div>
<div>Mark,<br>
<br>
</div>
On a security vs affordability basis, how exactly would SMS 2FA not be an effective solution?<br>
<br>
</div>
Unless you are going to hack the Telco SMS Gateway where the SMS is in clear txt, in which case I would think even our M-Pesa Pins would be vulnerable, where else is do you have a credible attack surface?<br>
<br>
</div>
Rgds<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Jun 30, 2017 at 3:25 PM, Mark Kipyegon via kictanet
<span dir="ltr"><<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF">
<div>
<div><span class="m_6617591784149783904Apple-style-span">SMS as a form of 2FA is unsuitable considering the sensitivity of such information. On the other hand a government backed smart card would offer the appropriate level of authentication without locking
out access to a section of users.</span><br>
</div>
<span class="">
<div><br>
On 30 Jun 2017, at 12:30, "Denis G. Wahome" <<a href="mailto:dwahome@gmail.com" target="_blank">dwahome@gmail.com</a>> wrote:<br>
<br>
</div>
<div></div>
<blockquote type="cite">
<div>
<div dir="ltr">Mark,
<div><br>
</div>
<div>While I do concur completely with your observation. I was considering the user group for the service. Other more advanced mechanisms would reduce the usability/accessibility by a large portion of the Country.</div>
<div><br>
</div>
<div>A better way would be a registration process to access your records where one can select a Channel for 2FA</div>
<div><br>
</div>
<div>Denis</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Jun 30, 2017 at 10:54 AM, Mark Kipyegon via kictanet
<span dir="ltr"><<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><wbr>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
SMS is not a secure implementation of two factor authentication.<br>
<span class="m_6617591784149783904im m_6617591784149783904HOEnZb"><br>
On 30 Jun 2017, at 10:40, "<a href="mailto:kictanet-request@lists.kictanet.or.ke" target="_blank">kictanet-request@lists.kictan<wbr>et.or.ke</a>" <<a href="mailto:kictanet-request@lists.kictanet.or.ke" target="_blank">kictanet-request@lists.kictan<wbr>et.or.ke</a>>
wrote:<br>
<br>
<br>
><br>
> A simple 2 Factor Authentication mechanism via SMS would suffice to start<br>
> with.<br>
<br>
</span></blockquote>
</div>
</div>
</div>
</blockquote>
</span></div>
</div>
</blockquote>
</div>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div>
<div style="border-collapse: collapse; color: rgb(136, 136, 136); font-family: 'Droid Sans', arial, sans-serif; font-size: 13px; ">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<div></div>
</div>
</div>
</div>
</body>
</html>