4 ms·
The answer is no, but is it more secure than no 2FA? Of course there are much better 2FA options, but for the general public, they are probably too complicated
by theonething 7y ago
The answer is no, but is it more secure than no 2FA?
Of course there are much better 2FA options, but for the general public, they are probably too complicated to use.
Everyone understands SMS.
- minimaxir 7y agoAwareness may make providers more willing to switch to a better 2FA, such as TOTP.
- 0xffff2 7y agoSadly, providers seem to be going the other way. I had a service try to bully me into disabling TOTP in favor of SMS 2FA this week.
- 1996 7y agoBecause they want your phone number. They are more and more used to link to identities, as people tend to keep (and port) their phone number Hint: if a store ask for a phone number to get a discount, try the local areacode then 634 5789. This is from an old song, and many people seem to have created "anonymous" account with it! https://en.wikipedia.org/wiki/634-5789_(Soulsville,_U.S.A.) https://en.wikipedia.org/wiki/634-5789_(Soulsville,_U.S.A.)
- rocqua 7y agoI think at some point goolge used SMS 2FA as a sole factor in account recovery. So there, you really were worse off with SMS 2FA enabled.
- robbya 7y agoThis is really a criticism that Google called their system 2FA but actually was using it as a sole factor. That's bad security and bad naming. Had they actually used it as a second factor, then you would have seen a security benefit.
- KingMachiavelli 7y agoWell if that's the case they could still offer true MFA. Make at least SMS 2FA mandatory but offer OTP/token based MFA. Obviously banks are a place with a lot of low-value targets and a few very high-value targets, but the cost to implement MFA is the same so they might as well do it.
- jeltz 7y agoYeah, the by far biggest cost of 2FA is the recovery process which you need anyway, not actual 2FA implementation.
- Kalium 7y agoHave you seen the prompt system, as used by Google, Micosoft, Okta, et al.? In my strictly personal opinion, responding to a notification that asks if a login attempt is you is clear enough that people need minimal training to make use of it. This might just be me, though. In my career, I've definitely seen people actively choose SMS over other factors on offer. It was easier for them, and in many cases shouldn't have been offered. Your point about SMS being better than nothing is wise and true and insightful, but it's perhaps not always the question as faced in practice.
- gowld 7y agoThe problem there is that it's not very clear that you didn't trigger the login yourself.
- Kalium 7y agoIt's been my experience that it's often reasonably clear to users that they did perform a login themselves in the past few seconds. Adding an approximate location and a short verification token to the prompt generally helps. Your experience and standards of clarity may be different from mine, obviously.
- sfifs 7y agoThey (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access. In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets delivered.
- DaiPlusPlus 7y agoHOTP-based 2FA systems (like Google Authenticator) do not require internet connections.
- 7y ago