3 ms·
It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code tha
by choward 7y ago
It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.
- r1nkgrl 7y agoUsing your logic, doesn't the ability to social engineer access to a password make passwords less than 1 FA as well?
- deleted 7y ago[deleted]
- theossuary 7y agoA password is a factor of authentication, so by definition is 1FA. Any service which allows access to the account through social engineering could be labeled as having less than 1FA. If an attacker could access your account without knowing any of your secrets, then it's really 0FA.
- daveFNbuck 7y agoSuppose you mistype your password and get a page saying "wrong password, log in anyway?" You click yes and are logged in to your account. Would you consider that account to be password-protected? To me, a second factor that can bypass the first factor is exactly the same as this situation. Being able to hack your way into an account is a different issue.