3 ms·
I had SMS as my backup and in testing this morning, FB sends the SMS by default, even before you either tap the key or say you want to use another method (like
by james_pm 10y ago
I had SMS as my backup and in testing this morning, FB sends the SMS by default, even before you either tap the key or say you want to use another method (like SMS).
That's a big flaw to me. It should only send the SMS if I specifically say, "Use my backup SMS method". I switched to use an authenticator app instead as a result.
- tptacek 10y agoI'm not sure I see the security advantage to opt-in SMS over opt-out SMS (both are bad). If the button exists to override the hardware token with a text message, the attacker will simply push the button after hijacking your phone number.
- james_pm 10y agoTrue that. More of an annoyance then with my phone lighting up with an SMS notification that I didn't need. Reminded me to disable SMS 2FA and stick with the authenticator app.