5 ms·
Large tech companies like Google push 2-factor auth to "increase" security, but this article shows that 2-factor auth with SMS verification opens up a huge secu
by maxlamb 7y ago
Large tech companies like Google push 2-factor auth to "increase" security, but this article shows that 2-factor auth with SMS verification opens up a huge security hole since the attacker can access your email if they can get your provider to port your SIM over to their device. Am I missing something and if not how did companies like Google not foresee this huge security hole?
- deleted 7y ago[deleted]
- latortuga 7y agoGoogle offers many different 2 factor methods including Google Prompt, TOTP, and security key - all of which are better choices than SMS. The author is right to say that SMS is not enough but he didn't go far enough: only use SMS-based 2FA if it's your only 2FA choice for your critical accounts, and consider alternative services if it's your only choice.
- Macha 7y agoThe issue is that the forgot/lost device flow allows you to remove your more secure 2FA with only SMS verification.
- knorker 7y agoYou can turn off SMS/phone auth fallback, at least in gsuite.
- rando444 7y agoIf you use one of those secure options, click the lost your device option, and then you can describe to everyone how secure the recovery process is.
- badpun 7y agoI don't know if that's possible in gmail, but in protonmail you can just disable password recovery altogether, which makes your email account secure against these kinds of attacks.