2 ms·
As a 2nd or 3rd factor SMS is usually fine. Hijacking a text message is still an "extra hurdle" that improves security over just a password. The problem comes w
by c22 8y ago
As a 2nd or 3rd factor SMS is usually fine. Hijacking a text message is still an "extra hurdle" that improves security over just a password. The problem comes when a site allows account resets over SMS because then they've just traded one single factor (a password) for another weaker one (SMS).
- loeg 8y ago> As a 2nd or 3rd factor SMS is usually fine. Hijacking a text message is still an "extra hurdle" that improves security over just a password Perhaps, but often 2FA is leaned on to reduce the significance of the primary factor or shift liability. > The problem comes when a site allows account resets over SMS because then they've just traded one single factor (a password) for another weaker one (SMS). Yeah, exactly — that would be one way some "2FA" systems weaken the primary factor.