4 ms·
> Having username+password+sms is strictly safer than having username+password. As someone else pointed out: that's not true if the SMS authentication can be
by gspr 6y ago
> Having username+password+sms is strictly safer than having username+password.
As someone else pointed out: that's not true if the SMS authentication can be used to recover the password. But let's for the sake of discussion rule those cases out.
Then yes, SMS verification does perhaps add a tiny bit of "security" to the process for the reason you describe. But that tiny bit of security has to be weighed against the enormous extra burden placed on the users performing the (far more plentiful) legitimate logins. Than burden may well be worth it if a lot of extra security is gained. I think it's definitely not for the "security" provided by SMS.
- 33Backpack33 6y agoWhen you consider SMS 2FA is often used to fix the poor or reused password problem we see it's not helping much at all but only delaying the problem.
- ryanlol 6y agoThat’s bullshit, nobody is going to bother with attacks like this to steal your uber or doordash account. SMS 2fa kills credential stuffing attacks for all but the highest value targets.
- 33Backpack33 6y agoYou do know uber and doordash accounts are hacked all the time because of password reuse? There is a huge black market for hacked accounts from doordash and the like.
- ryanlol 6y agoThat’s my point. These accounts are worth a couple of dollars, nobody would spend $50 on a hacked uber or doordash account. These accounts are only worth anything as long as they’re cheaper and easier to use than stolen credit cards.
- 33Backpack33 6y agoThe original VICE article said it was $16 and they can take as many accounts as they want. It seems worth it to me.
- ryanlol 6y agoYeah, because that $16 plan is totally going to last for long after people start abusing this at scale.