3 ms·
Agreed. The choice isn't between SMS and TOTP for most users. The choice is between SMS and just a 6 character reused password (maybe an old pet name with an ex
by ptoomey3 10y ago
Agreed. The choice isn't between SMS and TOTP for most users. The choice is between SMS and just a 6 character reused password (maybe an old pet name with an exclamation point on the end for extra security ;-)).
- lloeki 10y ago> maybe an old pet name with an exclamation point on the end for extra security Nope, this is the answer to the recovery question ;-) which amounts to a password anyway. I wish recovery questions would just die finally. A pattern I've seen often is people not remembering their password and just resetting it via SMS each time, making SMS 1FA. Although very real, taking the real-world risk of SIM cloning is pragmatically still better than reused, ridiculous passwords and/or ones that end up in leaked lists which amount to no auth.