Microsoft is killing off SMS authentication codes as AI makes phishing attacks even more dangerous
IT admins will no longer be able to log into Microsoft Entra ID accounts using SMS-based 2FA codes starting February 1. The deadline is part of Microsoft's broader shift toward passkeys, widely considered one of the most secure login methods. Read Entire Article
Microsoft is set to discontinue support for SMS-based multi-factor authentication (MFA) codes due to the increasing threat of AI-powered phishing attacks. Starting February 1, IT administrators will no longer be able to log into Microsoft Entra ID accounts using SMS codes. This shift aligns with Microsoft's broader push towards passkeys, a highly secure login method.
Microsoft has been cautioning users against SMS codes for years, citing their susceptibility to interception. However, the move is also driven by AI-enhanced phishing methods that are more effective in deceiving users and executing SIM-swapping attacks. Additionally, a recent Windows 11 update has removed picture passwords, favoring PINs, biometrics, and passkeys.
Microsoft now urges users to abandon passwords and adopt passkeys as their primary login method. As of September 1, Entra will prompt users to create a passkey. While passkeys offer enhanced security by binding authentication to specific devices and eliminating server-side data storage, researchers have found that malware-infected systems can still leak passkey data from Google Chrome's memory.
Google has also been experimenting with a new sign-in method, where users can log in by uploading a selfie video following a selfie-based verification. The security implications of this method are yet to be determined.
Written by urgent.news from TechSpot's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
