3 ms·
> sure its better than not having 2FA but only a little better. I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but
by mehrdadn 7y ago
> sure its better than not having 2FA but only a little better.
I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.
- petjuh 7y agoSomeone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone. Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.
- mehrdadn 7y agoIf the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.
- jvanderbot 7y agoNo, as other threads have pointed out, SMS is trivially hacked
- privateSFacct 7y agoYou do realize that the minimum wage worker at your local phone store can setup a new phone with your number? That they may have friends who they accidentally do this for? That they may not detect the fake ID some random person with your name and number shows them? Etc etc. None of this requires getting your phone.