3 ms·
> While sms 2FA is marginally better than not having any 2FA at all I used to believe this too. Until this morning. Then I realized something and now I'm not s
by mehrdadn 7y ago
> While sms 2FA is marginally better than not having any 2FA at all
I used to believe this too. Until this morning. Then I realized something and now I'm not so sure: if I don't have SMS 2FA at all, then my phone line is less to become an attack target. Meaning I'm less likely to have to deal with the collateral damage of lost accounts, files, etc. So is it really better to have that SMS 2FA? Especially if you weren't ever having problems securing your stuff before it came along?
- antoinevg 7y agoThank you. I've been waiting years now for someone else to notice this as well.
- mehrdadn 7y agoGood to know! I feel like it stems from the notion that protecting whatever particular account they want you to protect must be the most important priority in your life. Even security folks don't always seem inclined to think in terms of trade-offs... too often they seem to see things as black and white. If something protects your account or computer better then it must be better and you have to do it. They don't care if you might lose your job or if it might burn down your home as a side effect; that's just not part of their threat models...