3 ms·
2FA isn't _this_ problem. It's password resets via SMS that are the problem here.
by ghouse 8y ago
2FA isn't _this_ problem. It's password resets via SMS that are the problem here.
- LyndsySimon 8y agoSMS is 2FA. I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
- tinco 8y agosms password resets are not 2fa. 2fa means you have two factors of authentication. If the only thing you need to authenticate is control over a phone number, then that's just one factor. Two factor authentication is when you need both a password and an SMS token, like how GitHub does it. I'm not saying SMS 2fa is strong enough, often passwords are weak and/or weakly guarded, and ostensibly phone numbers can be fidgeted with. But having a phone number be the only thing guarding your entire identity is a whole next level of weak.