3 ms·
I'm not sure I fully agree, in a situation where you reuse passewords everywhere, having SMS 2FA on top of it is still more secure that no 2FA at all, it makes
by nolok 8y ago
I'm not sure I fully agree, in a situation where you reuse passewords everywhere, having SMS 2FA on top of it is still more secure that no 2FA at all, it makes it harder/more costly to break through.
My understanding of it is if you can use anything other than SMS 2FA then use that and remove SMS, but if your choice if between no 2FA or SMS 2FA then go with SMS. Also, use it stictly as 2FA, not as identity.
This is not my area of expertise so if I'm wrong I would genuinely like to understand why.
- tptacek 8y agoI don't think I'm being clear. I'm saying that in the presence of SMS 2FA, people use weaker passwords than they would otherwise. The SMS 2FA itself weakens their security: they remain vulnerable to targeted attacks and gain a vector for targeted attacks.
- reitanqild 8y agoDo you have hard data? My feeling after supporting end users on and off since '95 is they won't differ if they have 2FA or not.
- SpaethCo 8y agoYou find examples like this all over the place: https://security.stackexchange.com/questions/49521/does-two-factor-authentication-reduce-the-need-for-a-long-password https://security.stackexchange.com/questions/49521/does-two-... It gets worse if you search around for people talking about how they use 2FA codes to protect their accounts when logging into services on public computers. The perception of the security added by 2FA emboldens people to make all kinds of poor security choices.