MFA using an SMS is not secure.
If people reliably made good passwords and never reused them, we probably wouldn't need MFA as much.
Unfortunately, we live in a society. Bitwarden will remember your TOTP codes for you across any device you login from. It will even copy the code to you paste buffer during a login.
I enable MFA everywhere i can, even for stupid stuff. Its just not an inconvenience using bitwarden.
and it’s all developers will give you the tools to check every login session, including ip addresses used, and number of failed attempts
and off everybody uses full disk encryption and other measures so that your passwords cannot be stolen, such as only use signed applications and proper sandboxes
Why not? Is it that easy to intercept a SMS or is that just due to poor handling with some providers?
I don't know about other countries, but you can't even buy/activate SIM cards in Germany without "proper" identification through VideoIdent or another system where your passport is checked against. At least that's what I remember.
I'm not sure any type of "I've lost my SIM, please use this one" would work on German carriers without proper ID.
Moving numbers als requires some kind of paperwork, it's not that easy after all.
So... Is this a telco problem or a SMS problem?
So essentially they would have to breach the national 2factor authentication system first here.
And there is absolutely no way that you could "social engineer" the guy on the other end of the phone who works for the telecompany as there is no way you shouldn't be able to use their online tools.
SMS has weaknesses. Especially if you are a particularly high-interest target. But the benefit of "everybody already has a phone" is immense and the true recovery mechanism for "oh shit I dropped my phone in the toilet" is valuable. Something like a yubikey is the complete solution to login problems that don't involve malware or some security vuln, but they are an extra thing that people need to buy so the pathway to "everybody uses a yubikey" is a mess.
Both Android and iPhone are now offering similar functionality though phones, which mitigates the "you need to buy a new thing" problem, though it is harder to set up an effective backup here.
If you ever notice you lose connection to your carrier: begin to worry.