4 ms·
SMS is worse than nothing.
by def_true_false 8y ago
SMS is worse than nothing.
- ptoomey3 8y agoSMS does still help to mitigate a common attack...folks trying out password dumps on other sites. But, I don’t disagree we need to move on when we have more options to choose from. Right now the best looking option is webauthn with platform authenticators.
- def_true_false 8y agoIf password reuse is a problem, one should be solving that problem instead of it's symptoms. "Have I Been Pwned" comes to mind. https://haveibeenpwned.com/API/v2#PwnedPasswords https://haveibeenpwned.com/API/v2#PwnedPasswords
- UncleMeat 8y agoThis is grossly untrue. SMS prevents scalable password reuse attacks.
- JoshTriplett 8y agoSMS as a second factor is not a net reduction in security. The ability to hijack a phone via number porting or similar could give access to SMS messages, but by definition a second factor should never reduce your security. What does reduces security is the use of SMS as a password reset mechanism, or any similar method that uses SMS as the only factor for authentication. Don't do that.
- def_true_false 8y agoIt gives users a false sense of security and providers an excuse not to implement something better. Most (all?) of those who only support SMS 2FA also get the part about no resets wrong.