4 ms·

I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked.. They stole your SIM. SMS optio

I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked.. They stole your SIM. SMS option was now in their control. SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.

Thorrez 7y ago
Everything you said agrees with what simonebrunozzi said. SMS is a bad 2FA option.
mehrdadn 7y ago
> sure its better than not having 2FA but only a little better. I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.
- petjuh 7y ago
  Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone. Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.
  - mehrdadn 7y ago
    If the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.
  - jvanderbot 7y ago
    No, as other threads have pointed out, SMS is trivially hacked
  - privateSFacct 7y ago
    You do realize that the minimum wage worker at your local phone store can setup a new phone with your number? That they may have friends who they accidentally do this for? That they may not detect the fake ID some random person with your name and number shows them? Etc etc. None of this requires getting your phone.
dev_dull 7y ago
The problem is that twitter forces you to add a phone number, and once that phone number is added it will automatically be able for 2FA. If you don’t believe me then remove your phone number and wait. Eventually you’ll login and get a message saying your account is suspicious and you need to add a number.
aianus 7y ago
> sure its better than not having 2FA but only a little better Only if the provider doesn't decide to be "helpful" and start allowing password resets via SMS on your 2FA number.

Thorrez 7y ago

Everything you said agrees with what simonebrunozzi said. SMS is a bad 2FA option.

mehrdadn 7y ago

> sure its better than not having 2FA but only a little better. I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.

petjuh 7y ago
Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone. Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.
- mehrdadn 7y ago
  If the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.
- jvanderbot 7y ago
  No, as other threads have pointed out, SMS is trivially hacked
- privateSFacct 7y ago
  You do realize that the minimum wage worker at your local phone store can setup a new phone with your number? That they may have friends who they accidentally do this for? That they may not detect the fake ID some random person with your name and number shows them? Etc etc. None of this requires getting your phone.

dev_dull 7y ago

The problem is that twitter forces you to add a phone number, and once that phone number is added it will automatically be able for 2FA. If you don’t believe me then remove your phone number and wait. Eventually you’ll login and get a message saying your account is suspicious and you need to add a number.

aianus 7y ago

> sure its better than not having 2FA but only a little better Only if the provider doesn't decide to be "helpful" and start allowing password resets via SMS on your 2FA number.