4 ms·
I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck. If you had parts of eithe
by penagwin 7y ago
I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck.
If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA
- choward 7y agoIt's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.
- r1nkgrl 7y agoUsing your logic, doesn't the ability to social engineer access to a password make passwords less than 1 FA as well?
- deleted 7y ago[deleted]
- theossuary 7y agoA password is a factor of authentication, so by definition is 1FA. Any service which allows access to the account through social engineering could be labeled as having less than 1FA. If an attacker could access your account without knowing any of your secrets, then it's really 0FA.
- daveFNbuck 7y agoSuppose you mistype your password and get a page saying "wrong password, log in anyway?" You click yes and are logged in to your account. Would you consider that account to be password-protected? To me, a second factor that can bypass the first factor is exactly the same as this situation. Being able to hack your way into an account is a different issue.