3 ms·
No, I did not. And I certainly should have. However, 2fa would not have prevented the problem. The problem is twofold -- 1) account recovery (using email, SMS
by ghouse 9y ago
No, I did not. And I certainly should have.
However, 2fa would not have prevented the problem. The problem is twofold -- 1) account recovery (using email, SMS, or anything other than a secret key) is an effective attack vector. Especially SMS. 2) a human who will change the account recovery settings (in my case, FM changing the account recovery email address).
- nvarsj 9y agoHmm you think they would have bypassed your 2fa as well? I wonder if FM can comment on that - it would be concerning. The "sms backdoor" is the same with gmail, etc. unless you explicitly disable it.
- soufron 9y agoWhat is the sms backdoor?
- rbritton 9y agoProbably this [0]. They can get phone companies to issue a SIM for your number, which will then receive the SMS reset or 2FA code. [0]: https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...
- snowpanda 9y agoSim swapping: http://www.fraud.org/sim_swapping_alert http://www.fraud.org/sim_swapping_alert
- deleted 9y ago[deleted]
- brongondwana 9y agoOur account recovery process won't allow you through at all if you lose your password, and your 2FA, and your recovery key, then you're not getting that account back.