4 ms·

2FA over SMS is fine. It’s not the most secure thing, but it’s an improvement over just having a password. The problem is when people forget the “2” part and a

2FA over SMS is fine. It’s not the most secure thing, but it’s an improvement over just having a password. The problem is when people forget the “2” part and allow SMS to be a substitute for having the password. That should never be done. The related problem is that, as a used, it’s hard to tell when some service wants your number for proper 2FA, or when they want it as a separate authentication mechanism they just happen to call “2FA.”

z3t4 8y ago
If you register your phone nr your password basically get useless as someone can remotely (from another country even) steal your phone number and then reset your password.
- mulmen 8y ago
  That would be one factor, no?
  - z3t4 8y ago
    I mean if SMS is not just used as second factor, but also used for password reset/override, it basically become a one factor. So yes.
ilikepi 8y ago
> ...it’s hard to tell when some service wants your number for proper 2FA, or when they want it as a separate authentication mechanism they just happen to call “2FA.” ...or when they want it to be able to call or text you with other BS entirely. I hesitate to give my cell number to any company. I have a separate number (formerly a landline, now strictly a voicemail box) that I use specifically for companies. I gave my cell number to a new dentist recently, thinking "medical office, probably important they be able to reach me." That turned out to be a mistake. They subscribed me to an automated appointment confirmation service, and they also send me a text (from a different number than the confirmation service) after I finish a visit to solicit reviews. This is exactly why I hate giving it out.
floatboth 8y ago
The "best" part is password recovery — where SMS is typically the "second factor" to a completely insecure "secure question"
- palunon 8y ago
  You have no obligation to answer the secure questions truthfully, or not to write a long random string of text... Starting with "Do not accept the answer if I can't spell this exactly" in case a human gets involved...
  - jandrese 8y ago
    Of course you'll be SOL if you legitimately lose your password and the answers to those questions.
    - psergeant 8y ago
      Sounds like a good reason to use a password manager and good backups to store them?
- Terr_ 8y ago
  It frustrates me how almost every company's "secure question" system is utterly retarded and recklessly dangerous. 1. They draw from fixed unimaginative pools of often-overlapping questions, so that a breach in one company compromises you on multiple others. 2. Unlike a password, the actual secret question is often plaintext If I had to design a replacement... The user would always be allowed to define custom questions, all questions could be assigned multiple synonymous correct answers (e.g. "Dr. Smith", "Doctor Smith"), and they all go through a one-way hash with salt.
hnaccy 8y ago
Just today Google prevented me from logging in with the correct password and asked for a phone number as additional verification. Any phone number. The account has no associated number so it's not a verification at all!
- cataflam 8y ago
  That's not for your benefit, that's for them to verify you're a human / not a spammer / collect information (at least that seems like the most reasonable explanation to me).

z3t4 8y ago

If you register your phone nr your password basically get useless as someone can remotely (from another country even) steal your phone number and then reset your password.

mulmen 8y ago
That would be one factor, no?
- z3t4 8y ago
  I mean if SMS is not just used as second factor, but also used for password reset/override, it basically become a one factor. So yes.

ilikepi 8y ago

> ...it’s hard to tell when some service wants your number for proper 2FA, or when they want it as a separate authentication mechanism they just happen to call “2FA.” ...or when they want it to be able to call or text you with other BS entirely. I hesitate to give my cell number to any company. I have a separate number (formerly a landline, now strictly a voicemail box) that I use specifically for companies. I gave my cell number to a new dentist recently, thinking "medical office, probably important they be able to reach me." That turned out to be a mistake. They subscribed me to an automated appointment confirmation service, and they also send me a text (from a different number than the confirmation service) after I finish a visit to solicit reviews. This is exactly why I hate giving it out.

floatboth 8y ago

The "best" part is password recovery — where SMS is typically the "second factor" to a completely insecure "secure question"

palunon 8y ago
You have no obligation to answer the secure questions truthfully, or not to write a long random string of text... Starting with "Do not accept the answer if I can't spell this exactly" in case a human gets involved...
- jandrese 8y ago
  Of course you'll be SOL if you legitimately lose your password and the answers to those questions.
  - psergeant 8y ago
    Sounds like a good reason to use a password manager and good backups to store them?
Terr_ 8y ago
It frustrates me how almost every company's "secure question" system is utterly retarded and recklessly dangerous. 1. They draw from fixed unimaginative pools of often-overlapping questions, so that a breach in one company compromises you on multiple others. 2. Unlike a password, the actual secret question is often plaintext If I had to design a replacement... The user would always be allowed to define custom questions, all questions could be assigned multiple synonymous correct answers (e.g. "Dr. Smith", "Doctor Smith"), and they all go through a one-way hash with salt.

hnaccy 8y ago

Just today Google prevented me from logging in with the correct password and asked for a phone number as additional verification. Any phone number. The account has no associated number so it's not a verification at all!

cataflam 8y ago
That's not for your benefit, that's for them to verify you're a human / not a spammer / collect information (at least that seems like the most reasonable explanation to me).