3 ms·
That depends. If you're a sufficiently valuable target, it's actively worse, because it creates a false sense of security.
by rosser 8y ago
That depends. If you're a sufficiently valuable target, it's actively worse, because it creates a false sense of security.
- SkyPuncher 8y agoI disagree that it's worse. I have SMS on some of my accounts. I am aware of the risks, but it's inherently better than nothing at all.
- ksec 8y agoI have yet to see how SMS / Mobile Phone account can be hijacked in places where getting a new SIM card requires some form of ID. So SMS being unsafe for 2FA is mostly (?) a problem in US and some part of EU.
- diroussel 8y agoDoes this explain it well enough? https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ https://arstechnica.com/information-technology/2017/05/thiev...
- gammateam 8y agoIf I know your phone number I can get your 2fa code. It a security HOLE. Instagram accounts get swiped all the time. There is a vibrant account trading economy on IG, and there are no reassurances that the account won't get swiped back. Facebook knows how to do to 2fa without SMS, but they want everyone's phone numbers and social graph too much. Account trading lives in the shadows and it won't have a favorable public view, therefore the problems inherent to the platform itself don't get attention right now. Putting Facebook on blast is the way to change this.
- gammateam 8y agothe only reason its not worse is because nobody's leaked a phone number database yet with accuracy regarding who is using it for 2fa. Currently strangers can't look at a list of phone numbers and tell if they are used with Instagram or Facebook and if that account is even valuable, quickly. just security through obscurity.