3 ms·
How does an insecure second factor affect the security of the original factor? EDIT: apparently the OP meant SMS password reset without requiring the second f
by otterlicious 8y ago
How does an insecure second factor affect the security of the original factor?
EDIT: apparently the OP meant SMS password reset without requiring the second factor, not SMS 2FA. Of course that's terrible.
- dustyleary 8y agoHow does a wooden screen door on the back of your bank vault affect the security of the vault door?
- otterlicious 8y agoThat analogy doesn't make sense. It's more like you have a deadbolt and a regular lock. Sure, you can open the regular lock with just a credit card, but that doesn't help you with the deadbolt...
- ericd 8y agoNo, because in your scenario, you have to get through the deadbolt AND the regular lock. In the Vanguard scenario, you have to get through the deadbolt OR the regular lock.
- otterlicious 8y agoThat's not what the OP said originally. It's a bit disappointing that people are dispensing security advice without understanding the difference between password reset mechanisms and 2FA mechanisms. :-(
- ericd 8y agoOops, I see, sorry, you're totally right.
- JumpCrisscross 8y ago> How does an insecure second factor affect the security of the original factor? If I want to compromise your account, I force fallback and then compromise your SMS. Security is as strong as the weakest link.
- otterlicious 8y agoI understand that it could reduce your security to the level of one-factor authentication. That's really easy to do. It is not reducing the security below what one-factor authentication provides, like the OP argued it did.
- vanguard_u2f 8y agoI compromise your SMS. I initiate password recovery, and tell Vanguard "I forgot my password -- but look! It's still me! I can receive SMS challenges!"
- otterlicious 8y agoThat's a SMS password reset mechanism, e.g. one-factor authentication, not two-factor authentication.
- vanguard_u2f 8y agoThat's my point. Adding an SMS number to your account reduces the security of your account to one-factor SMS authentication.
- Latteland 8y agoThe point here is that if you cannot remove the much lower sms sec then it's no more secure than sms only