4 ms·

HTTPS isn't automatically secure. It depends on certificates being issued correctly. But certificate issuance depends on insecure protocols: DNS and BGP. Also

HTTPS isn't automatically secure. It depends on certificates being issued correctly. But certificate issuance depends on insecure protocols: DNS and BGP. Also there's hijacking account recovery and 2 factor codes via SMS. https://www.theverge.com/2017/9/18/16328172/sms-two-factor-authentication-hack-password-bitcoin https://www.theverge.com/2017/9/18/16328172/sms-two-factor-a...

ndnxhs 8y ago
SMS 2fa has long since been considered harmful.
- Thorrez 8y ago
  Yes, but many sites still use it for 2fa. And regardless of 2fa, it's also commonly used in account recovery which is even worse than 2fa.