4 ms·
It is? I thought the problem with SMS is you click "forgot password" and they send you a code via SMS to reset your password. Therefore username+password is saf
by asiachick 6y ago
It is? I thought the problem with SMS is you click "forgot password" and they send you a code via SMS to reset your password. Therefore username+password is safer than username+password+sms because username+password+sms = username (no password)
- hansel_der 6y agoi agree that username+sms is not good, but what are the other password reset vectors more secure than sms?
- caskstrength 6y agoAlmost anything (with exception of "3 easily googleable questions about you") is safer than sms. For example, emailing password reset link to my gmail account that is protected with real 2fa.
- lxgr 6y agoYes, and besides being more secure it is also more available: I'm much more likely to be able to receive email when resetting a password than I am to have cell reception and have the correct SIM card in my phone. (Examples for access to email but not SMS include: International travel, airplane Wi-Fi, bad cell signal.) I feel like much of what's wrong with SMS 2FA comes down to a misguided idea of "everyone has exactly one phone number", which is simply not true for a lot of people.
- wccrawford 6y agoI think you mean: username+password+sms = username+sms (no password) But I agree, and would take it a step further: username+password+sms = username+sms || username+password And in the worst scenarios: username+password+sms = sms || username+password And the same goes for email instead of SMS as well, in most scenarios.
- 33Backpack33 6y agousername + unique password would be better than all the other options listed. Adding SMS seems to add new points of attack that either hurt the user or just delays the hurting.