4 ms·
Wells Fargo's 2FA uses SMS. Hardly worth enabling.
by orthecreedence 7y ago
Wells Fargo's 2FA uses SMS. Hardly worth enabling.
- josh2600 7y agoI don’t know why you’re being downvoted. Sms 2FA is not safe, full stop.
- ericleung 7y agoSure, SMS-based 2FA is not nearly as secure as other forms of 2FA. But unless you're targeted, SMS-based 2FA still helps add a layer of security against other issues like password re-use. Of course none of us do that either, but for the general public, I'd rather support SMS-based 2FA across the board than nothing at all.
- blackearl 7y agoFor the average Joe it's good enough, no one is SIM swapping Bob who works at Walmart
- nikolay 7y agoThat's default, but you can buy an RSA hardware token.
- pintxo 7y agoLike this one [1]? Seems that it is not necessarily better than SMS. [1] https://news.ycombinator.com/item?id=4156897 https://news.ycombinator.com/item?id=4156897
- freeone3000 7y agoThere is an actual, material difference between having no 2FA (guess passwords until you get in), SMS 2FA (have a human person call a phone provider and have the number switched), and token 2FA (given the physical device and a few hundred attempts, you're able to make another device that also authenticates). Saying you might as well not enable 2FA because a token cloning attack exists is ridiculous.
- projektfu 7y agoAnd it's not even an attack on the OTP token.