2 ms·
Not necessarily. Some services allow you to reset your forgotten password with a 2FA token. If your 2FA token comes by SMS, your account security relies solely
by foepys 8y ago
Not necessarily. Some services allow you to reset your forgotten password with a 2FA token. If your 2FA token comes by SMS, your account security relies solely on SMS. Yes, this bad practice. Yes, you should not do that. Yes, you actually only have a single factor then. But some do it that way, so don't use SMS.
- mikeash 8y agoThat’s the whole point of my second paragraph. SMS 2FA is fine, but SMS recovery masquerading as 2FA is not.
- ReverseCold 8y ago> Some services allow you to reset your forgotten password with a 2FA token Don't do this either. It makes 2FA into 1FA.