3 ms·
Does this mean they've eliminated that vulnerability where no matter what 2FA option you chose, someone could always get into your account by tricking Verizon o
by mtgx 9y ago
Does this mean they've eliminated that vulnerability where no matter what 2FA option you chose, someone could always get into your account by tricking Verizon or some other carrier that they are the owner of the phone number?
I never understood the point of offering additional so-called "stronger" 2FA options when the mandatory fallback was always the SMS code. Why even bother? Services should at least give users the option to disable SMS fallback. But really they need to start thinking about a SMS-less 2FA future. Even NIST has deprecated SMS 2FA.
- skizm 9y agoWould that work if you were using the Google Authenticator app?
- erichurkman 9y agoYou no longer get the option to use Google Authenticator until you've already set up 2FA the first time using SMS, at least in the US. You can remove your mobile number _after_ setting up Google Authenticator, but you have to remember to do that step.
- gruez 9y agois that even an issue to begin with? afaik you need a phone to enable 2fa, but you can remove it after adding another token.
- tonyztan 9y agoExactly. Google has always (at least since 2012) provided the option to remove any and all phone numbers from your account after enabling 2FA.
- sowbug 9y agoIt doesn't mean that because that vulnerability never existed. You've always been able to remove SMS 2FA after setting up a second method (backup codes or U2F).