Re: BGP Graceful Restart

2021-04-17 Thread Mark Tinka
On 4/16/21 16:11, Graham Johnston wrote: I do believe that I understand the intended purpose of BGP graceful-restart. With that said, I was watching a video of a talk given by someone respected in the industry the other day on the use of graceful-shutdown and at the beginning of the talk there

Re: BGP Graceful Restart

2021-04-17 Thread lobna gouda
Hello Graham, I had a chance to analysis this topic GR and GR helper mode( default) for EoR msg and for the LLGR timer afterwards and had e-mail correspondence with the RFC auther. I would say based on your environment topology and the type of BGP fault/error. You keep the default mode unless

Malicious SS7 activity and why SMS should never by used for 2FA

2021-04-17 Thread Eric Kuhnke
https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ Anecdotal: With the prior consent of the DID holders, I have successfully ported peoples' numbers using nothing more than a JPG scan of a

Re: Malicious SS7 activity and why SMS should never by used for 2FA

2021-04-17 Thread Tim Jackson
Every SMS 2FA should check the current carrier against the carrier when enrolled and unenroll SMS for 2FA when a number is ported out. BofA and a few others do this. -- Tim On Sat, Apr 17, 2021, 8:02 PM Eric Kuhnke wrote: > > https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-2

Re: Malicious SS7 activity and why SMS should never by used for 2FA

2021-04-17 Thread Mel Beckman
No, every SMS 2FA should be prohibited by regulatory certifications. The telcos had years to secure SMS. They did nothing. The plethora of well-secured commercial 2FA authentication tokens, many of them free, should be a mandatory replacement for 2FA in every security governance regime, such as

Re: Malicious SS7 activity and why SMS should never by used for 2FA

2021-04-17 Thread Dan Hollis
paypal used to openly support token 2fa, but have since made it nearly impossible to use hardware tokens. they try very hard to ram sms down everyones throats. -Dan On Sun, 18 Apr 2021, Mel Beckman wrote: No, every SMS 2FA should be prohibited by regulatory certifications. The telcos had ye