4 ms·
^ Posted yesterday, with more comments. To sum it up: "jasonpeacock 1 day ago [–] He's arguing not just against SMS-2FA, but against 2FA itself, and his simp
by blaser-waffle 6y ago
^ Posted yesterday, with more comments. To sum it up:
"jasonpeacock 1 day ago [–]
He's arguing not just against SMS-2FA, but against 2FA itself, and his simple solution is to "just use a strong password".
The author completely misses the point about the value of 2FA itself. I agree SMS-2FA is not good, but that doesn't mean 2FA is worthless.
reply"
- thephyber 6y agoYeah, "strong password" is necessary but not sufficient. The knowledge of your password can be leaked but your physical device can't. There are legit arguments against SMS (the cell phone provider's customer support and the SS7 are weak points) and badly implemented 2FA, but 2FA definitely has security value add.
- valuearb 6y agoNot just a string password, but also a unique password. I once ran IT for a small startup (As part of a large portfolio as Ops director), none of the employees put any thought into password security, or cared, no matter whether I set them up with 1password, gave them training sessions, etc.