4 ms·

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.

ClumsyPilot 6y ago
So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.
- hlandau 6y ago
  "Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear. By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is. Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox can only be accessed by me over an SSH tunnel is truly laughable. In fact since sites which demand phone numbers seem to have some completely baseless idea that the phone number is somehow more "secure" than email, often adding a phone number will enable phone number-based recovery methods which therefore actually reduce account security.
  - bawolff 6y ago
    Attackers who can defeat your password typically can also defeat your password protected email account. Being an on-path attacker against SMTP is not a realistic threat model for most users.
  - ClumsyPilot 6y ago
    "mailbox can only be accessed by me over an SSH tunnel" Thats basically fantasy territory for an average user. If you consider the real world" abundant phishing, etc. then you will realise that in practice there is very little daylight between them.
  - tptacek 6y ago
    No mainstream email providers support DANE, which is about as realistic an option as SSH tunnels.
- jjav 6y ago
  > Email is hardly beter than sms, and we do password resets over email. Email is certainly far more secure. Consider the steps an attacker would need to do to be able to intercept an email being sent from the service being accessed (say, your bank) to your email server provider.

No it's not better, it's worse. Because with SMS 2FA, you can most times reset the password and then everything is lost. With just a password and no SMS 2FA you can't just reset the password so easy.

ClumsyPilot 6y ago

So don't allow password reset over SMS. Email is hardly beter than sms, and we do password resets over email.

hlandau 6y ago
"Email is hardly better than SMS" is an absurd claim. As has been written SMS is not secure, easily hijacked, and potentially transmitted in the clear. By contrast email can be made arbitrarily secure nowadays via e.g. DANE/STS-MTA, and it's entirely up to an email provider how secure mailbox access is. Saying that "email is hardly better than SMS" when the former can be secured via DNSSEC/DANE and where the mailbox can only be accessed by me over an SSH tunnel is truly laughable. In fact since sites which demand phone numbers seem to have some completely baseless idea that the phone number is somehow more "secure" than email, often adding a phone number will enable phone number-based recovery methods which therefore actually reduce account security.
- bawolff 6y ago
  Attackers who can defeat your password typically can also defeat your password protected email account. Being an on-path attacker against SMTP is not a realistic threat model for most users.
- ClumsyPilot 6y ago
  "mailbox can only be accessed by me over an SSH tunnel" Thats basically fantasy territory for an average user. If you consider the real world" abundant phishing, etc. then you will realise that in practice there is very little daylight between them.
- tptacek 6y ago
  No mainstream email providers support DANE, which is about as realistic an option as SSH tunnels.
jjav 6y ago
> Email is hardly beter than sms, and we do password resets over email. Email is certainly far more secure. Consider the steps an attacker would need to do to be able to intercept an email being sent from the service being accessed (say, your bank) to your email server provider.