3 ms·
SMS is 2FA. I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
by LyndsySimon 8y ago
SMS is 2FA.
I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
- tinco 8y agosms password resets are not 2fa. 2fa means you have two factors of authentication. If the only thing you need to authenticate is control over a phone number, then that's just one factor. Two factor authentication is when you need both a password and an SMS token, like how GitHub does it. I'm not saying SMS 2fa is strong enough, often passwords are weak and/or weakly guarded, and ostensibly phone numbers can be fidgeted with. But having a phone number be the only thing guarding your entire identity is a whole next level of weak.