3 ms·

It's less secure than even passwords. Beyond SIM card cloning, I could sit behind a target, initiate a SMS auth, and simply wait for the guy to look at his pho

• drewmol 7y ago
  I'm usually the one on my phone, and when I'm not the user I'm almost always aware of who the user is and I've granted them permission to access the device. The level of security cannot be not objectivly measured across all threat surfaces or catagories of potential bad actors. The parent poster said "login with phone number" but that should be understood as login with a one time password by demonstating access to the receiving end of a fairly private and relatively difficult to intercept communication channel (physically controlling the client registered to receive messages destined for your phone number on the SS7 network). The authentication factor effectively becomes something have (your phone) whereas a password is something you know which allows for a much larger pool of potential bad actors (with a realistic means of gainig access). SMS factor works more like a physical key your in possesion of that can be used to set a new combination (secret/password) for future access. In practice, combinations (passwords) are forgotten much more often than keys (phones) are lost or compromised.