2 ms·
So long as the UI surrounding the SMS 2FA setup process makes it clear that strong passwords are as important as ever, I think it's still easily a net positive
by snazz 6y ago
So long as the UI surrounding the SMS 2FA setup process makes it clear that strong passwords are as important as ever, I think it's still easily a net positive for the vast majority of people. Of course, the better solution is Google's default two-step verification flow, which involves sending a push notification to your phone and tapping Yes in Gmail. That's both easier and more secure, since SMS is taken out of the process.
Think about it this way: for an attacker trying to compromise more than one account, SMS-based 2FA makes it significantly more expensive to perform the attack. It certainly isn't much help as the victim of a targeted attack, but it makes account takeovers much more difficult in 99% of cases.