4 ms·

See I was all for 2FA, but there were a number of high profile heists that actually used 2FA to gain control first of your mobile number, then email, then anyth

See I was all for 2FA, but there were a number of high profile heists that actually used 2FA to gain control first of your mobile number, then email, then anything else they valued. Since mobile operators care even less then hosting companies, I am not sure having 2FA with sms code to be a good security practice. I do have yubikey keyfob but sites that are supporting it are very few unfortunately. Gmail being one, which is great.

Avernar 10y ago
Many don't consider mobile phone two-factor authentication as real two factor authentication. The reason being is that while the phone looks like "something you posess" it is really just an interface for another "something you know" which is your phone account information. As you said, this info can be compromized to intercept or take control of your SMS. Real 2FA uses a token generator device or an app like google authenticator which does the same thing. This is a real "something you possess" as it can't be compromized without getting access to the device.